One-off review
Assess
A one-off check of which detections really fire.
- Detection coverage snapshot
- Rule and data health review
- Prioritised gap list
Pricing
Compare what each package includes.
Every package is scoped to your SIEM, your log sources and your deployment, so we do not publish a price list. Compare what each one includes, then talk to us.
Packages
From a first check to full operations.
Most teams start with Assess and move up as the evidence builds. Launch is for early-stage teams.
Continuous
Assure
Continuous validation that your detections still work.
- Scheduled detection tests
- Coverage drift alerts
- Evidence for your auditors
Continuous
Operate
AI agents triage and investigate, with analysts in the loop.
- Alert triage by AI agents
- Investigation with evidence trails
- Analyst review of every verdict
Continuous
Respond
Response recommendations your team approves before anything changes.
- Response recommendations
- Approval before any action
- Post-incident evidence pack
Early access
Launch
Security operations for early-stage teams, in early access.
- Starter detection set
- Managed triage
- Room to grow into Operate
Side by side
How the packages compare.
| Assess | Assure | Operate | Respond | Launch | |
|---|---|---|---|---|---|
| What it is | A one-off check of which detections really fire. | Continuous validation that your detections still work. | AI agents triage and investigate, with analysts in the loop. | Response recommendations your team approves before anything changes. | Security operations for early-stage teams, in early access. |
| Engagement | One-off review | Continuous | Continuous | Continuous | Early access |
| What the agents do | Read-only review of your rules and data | Run scheduled detection tests | Triage and investigate alerts | Triage, investigate and recommend responses | Triage alerts from a starter detection set |
| Who approves actions | No actions are taken | No actions are taken | Your analysts review every verdict | Your analysts, before anything changes | Analysts review the verdicts |
| Includes |
|
|
|
|
|
How pricing works
Priced to your environment, not to a list.
Your sources.
The SIEM and the log sources in scope shape the work.
Your deployment.
On-prem, your cloud or air-gapped, each scoped with you.
Your level.
The package and the autonomy level your team chooses.
Questions
Pricing questions.
Why are there no prices on this page?
Each package is scoped to your SIEM, your log sources and your deployment. A list price would be wrong for most teams, so we quote after a short conversation.
Is there a free way to start?
Yes. The free snapshot is a read-only first look at your detection coverage.
Can we change package later?
Yes. Most teams start with Assess or Assure and move to Operate or Respond when they are ready.
What is Launch?
Launch is security operations for early-stage teams. It is in early access.
Talk to us about your environment.
Tell us your SIEM and your sources, and we will scope the package that fits.