Threat intelligence shouldn't cost more than the threats themselves

Common questions

Is Community actually free, or is there a catch?

No catch. Community includes all 13 extractors, Detection-as-Code, full MISP/STIX/TAXII integration, Syslog/CEF connectors, and Graph Context. The limits are 3 users, 30-day retention, and 10K IOCs. No time-boxed trials. No "upgrade to unlock" prompts inside the platform.

Why flat pricing instead of per-seat?

Per-seat pricing penalizes you for growing your team. A 5-person SOC on our Team plan pays $149/month regardless. That's $1,788/year for the entire team — about what you'd spend on a single seat with legacy vendors. We want you to add analysts, not ration licenses.

What is ZK-STIX?

ZK-STIX uses zero-knowledge proofs to verify that a threat observation is authentic without revealing the source environment or internal telemetry. It lets you share indicators with ISACs, partners, or the Threat Pool while proving provenance cryptographically — no trust assumptions, no data leakage. Available on Team and above.

What's included in On-Prem?

On-Prem ships with STIG-hardened container images, a dedicated deployment engineer for installation, and all Enterprise features. Designed for air-gapped networks, SCIF environments, and organizations with strict data-sovereignty requirements. ITAR and CMMC compliance support included. Contact us to scope your deployment.

Can I switch plans or add capacity later?

Yes. Upgrades are prorated and take effect immediately. Downgrades apply at the start of the next billing cycle. No lock-in contracts on any cloud tier — cancel anytime.