Per server, not per event
You license the number of servers that run the agent. That number is written into the licence, and it is checked when an agent registers. It is the only quantity in the licence.
Pricing
What the licence counts is servers.
There is no public price list here. What we can do is describe the model exactly, so you can size it before you talk to anyone, and so the first call is about your estate rather than about how the meter works.
The unit
One counter, and it counts servers.
The people are not metered
Whoever needs to see the evidence can have an account: analysts, the platform team, an auditor. The licence does not count them, so nobody has to ration logins.
Sub-units share the fleet
Subsidiaries, hospitals or agencies can be separated from each other inside one deployment, and the servers they run count once, against the same fleet.
Editions
What actually moves between editions.
Every edition does the thing the product is for: weigh a file against the original, explain the change, and keep the evidence. What changes is the surface around it.
- Standard
- Integrity monitoring across the fleet, with reports.
- Professional
- Adds compliance frameworks and scoring, and the software inventory surface: packages and versions across the fleet, legitimacy verdicts, vulnerability and end-of-life correlation, and version policies.
- Enterprise
- Adds SIEM forwarding, API keys, your own detection rules, data classification, and binding your own identity provider over SAML, OIDC or LDAP.
- Self-hosted and air-gapped
- The same feature set as enterprise, activated from a signed licence file with no call home. What differs is the deployment, not the vocabulary.
How long evidence is kept has a ceiling that rises with the edition. Under that ceiling you set the retention periods yourself, per kind of record.
Before you buy
Evaluate it on your own estate.
An evaluation licence is time-boxed and for non-production use, and it carries the compliance and inventory surfaces rather than a stripped-down build: what you evaluate should be the thing you would run.
- Bring a real mix of machines. A fleet view means nothing on five identical hosts.
- A first reply within one working day, and the scope written down before anything is installed.
A quote
What we need in order to price it.
Send these and you get a written quote rather than a discovery call about the meter.
How many servers run the agent today, and where that number goes over a year.
The operating system mix, including the older machines nobody wants to talk about.
Where it runs: operated by us, on your own infrastructure, or behind an air gap.
Whether you need SIEM forwarding, your own identity provider, or data classification.
How long evidence has to be kept, and who asks for it.
Why no number here
We would rather not publish a price we renegotiate on the first call.
The estates that run this product differ enough that a list price would be wrong for most of them and misleading for the rest. The model above is fixed; the number follows from your fleet, and you get it in writing.
Ask for a written quote.
The five answers above are enough to price it, and the quote comes back in writing.
Ask for a quote