Pricing
Packages are sized by monitored domain families, module scope and team size. Listed prices are entry level; the final figure comes in a written quote once scope is defined together in the demo session.
Start seeing your external surface.
Who it is forOrganisations inventorying their exposure for the first time
$290 / mo
Billed monthly
Brand, credential and dark web monitoring.
Who it is forSecurity teams watching brand and credential risk
$720 / mo
Billed monthly
Automation, takedowns and integrations.
Who it is forSOCs running SIEM/SOAR that want automation
$1,450 / mo
Billed monthly
Custom scope, SLA and a dedicated analyst.
Who it is forGroups, MSSPs and organisations needing custom scope
Tailored to you
Confirmed once scope is defined
In every package
What sets the price
The main unit. A root domain and every subdomain under it count as one family; separate brands are separate families.
Modules such as brand protection, threat feeds and automation unlock with the package tier.
Seats, support channel and the need for a dedicated analyst are reflected in the price.
Comparison
Click a row name to read what that module does.
| Module / feature | Observe $290 / mo | Detect $720 / mo | Respond $1,450 / mo | Enterprise Quote |
|---|---|---|---|---|
| 01 Attack surface | ||||
| Monitored domain families A root domain and all its subdomains count as one family. | 1 | 5 | 15 | Unlimited |
| Asset profile and risk score | yes | yes | yes | yes |
| ASM findings Subdomain takeover, sensitive paths, known CVEs, email security. | yes | yes | yes | yes |
| Technology and version detection | no | yes | yes | yes |
| Scan frequency | Weekly | Daily | Continuous | Continuous |
| Supplier surface monitoring | no | no | yes | yes |
| 02 Brand protection | ||||
| Phishing and look-alike domains | no | yes | yes | yes |
| Social, ad and app impersonation | no | yes | yes | yes |
| VIP / executive protection | no | no | yes | yes |
| Takedown management | no | no | yes | yes |
| 03 Dark web and threat landscape | ||||
| Compromised assets In Observe: a one-off retrospective sweep. | Basic | yes | yes | yes |
| Dark web posts | no | yes | yes | yes |
| Threat actors | no | yes | yes | yes |
| Underground economy | no | yes | yes | yes |
| Ransomware telemetry | no | yes | yes | yes |
| Vulnerability intelligence | no | no | yes | yes |
| Intelligence wire | yes | yes | yes | yes |
| Briefing room | no | yes | yes | yes |
| 04 Threat feed | ||||
| IP and IoC feed | no | yes | yes | yes |
| IoC lists and export | no | no | yes | yes |
| Hunting rules YARA, Sigma, Splunk, QRadar, SentinelOne, KQL, Suricata, EQL. | no | no | yes | yes |
| 05 Operations | ||||
| Tactical command center | yes | yes | yes | yes |
| Cases and notifications | no | yes | yes | yes |
| Case manager (playbooks) Detect: the ready-made catalogue; from Respond: your own playbooks. | no | Catalogue | yes | yes |
| Entity graph and global discovery | no | yes | yes | yes |
| SOC armory | no | yes | yes | yes |
| 06 Platform | ||||
| Seats | 3 | 10 | 25 | Unlimited |
| REST API and scoped keys | no | no | yes | yes |
| SIEM / SOAR integration | no | no | yes | yes |
| Single-tenant deployment | no | no | no | yes |
| 07 Support | ||||
| Support channel | Email + phone | Dedicated | ||
| Dedicated CTI analyst | no | no | no | yes |
| SLA | no | no | Standard | Custom |
| Monthly briefing | no | no | yes | yes |
| Request a quote | Request a quote | Request a quote | Request a quote | |
FAQ
A root domain (e.g. company.com) and every subdomain under it count as one family. Separate brands or separate root domains (company.net, companypay.com) are separate families.
No, they are entry level. The final price comes in a written quote once the number of families, module scope and seats are defined together in the demo session.
With an annual contract you pay for ten months instead of twelve; the monthly equivalent shows on the price cards when "Annual" is selected.
Yes. Moving up a tier can happen mid-term; the terms are set out in the quote. Adding domain families or seats does not require a package change.
In a 30-minute session we run a live scan on your own domains. The findings drive a joint decision on which modules you need.
Next step
In a 30-minute session we run a live scan against your own domains.