Home / Pricing
Pricing
Managed plans are per endpoint per month with a minimum. Assessments, compliance projects and retainers are fixed price. The quote adds the add-ons you choose and tax, and nothing else.
Managed plans
Essential
$14 / endpoint / month
$1,250 monthly minimum
Companies with 25 to 150 endpoints that need real monitoring without a security hire.
- 24×7 endpoint detection and response with EDR license
- Email and identity monitoring (Microsoft 365 or Google Workspace)
- Containment playbook: host isolation and account disable
- Quarterly vulnerability scan
- Weekly digest and monthly report
- Client portal
Critical alerts acknowledged in 15 minutes, automated containment, analyst follow-up within 4 hours.
Most chosen
Professional
$26 / endpoint / month
$2,950 monthly minimum
Companies with 100 to 1,000 endpoints, cloud workloads and a compliance obligation.
- Everything in Essential
- Cloud monitoring: AWS, Azure, GCP control plane and workloads
- Monthly vulnerability scanning with a ranked remediation list
- Security awareness training and phishing simulations for all users
- Continuous cloud posture monitoring
- Quarterly review with your leadership
- Compliance evidence export for SOC 2, HIPAA and PCI DSS
Critical alerts acknowledged in 15 minutes, contained within 1 hour, 24×7.
Enterprise
$42 / endpoint / month
$7,900 monthly minimum
Companies with 500 to 2,500 endpoints, multiple sites, auditors and a board that asks questions.
- Everything in Professional
- SIEM with 12-month searchable log retention
- Network sensors for up to five sites
- Proactive threat hunting, weekly
- Virtual CISO, 8 hours a month
- Incident response retainer with 20 prepaid hours
- Annual external penetration test included
- Dedicated analyst and quarterly tabletop exercise
Critical alerts acknowledged in 15 minutes, contained within 1 hour, named analyst and incident responder on call.
Prices in US dollars, effective 2026-08-20. Twelve-month term billed monthly; annual prepayment takes 8% off and waives onboarding. Bring your own CrowdStrike, SentinelOne or Microsoft Defender for Endpoint P2 license and pay $5 per endpoint less. Nonprofits, schools and districts receive 15% off.
How plan pricing works
- Endpoint
- A workstation, laptop, server or virtual machine running our agent. Mobile devices under MDM are half price. Printers, phones and IoT devices are not counted.
- Minimum
- Each plan has a monthly minimum so small environments get the same staffing. Below the breakpoint you pay the minimum; above it you pay per endpoint.
- Term
- Managed plans are 12 months, billed monthly by ACH or card. After the first year, 60 days' notice to cancel. Annual prepayment takes 8% off.
- Onboarding
- A one-time onboarding fee equal to one month of the plan covers deployment, tuning and the playbook. Waived on annual prepayment.
- Bring your own EDR
- Already licensed for CrowdStrike, SentinelOne or Microsoft Defender for Endpoint P2? Plans are $5 per endpoint less.
- Assessments
- Fixed price after a 30-minute scoping call, invoiced 50% at kickoff and 50% at report delivery. Retest within 90 days included.
Estimate a plan
Billed as Professional
$0 per month before tax
The estimator applies the plan minimum the way the order form does. Assessments and compliance projects are quoted separately below.
Plan add-ons
| Add-on | Unit | Per month |
|---|---|---|
| Extended log retention, 24 months | per endpoint | $6 |
| Network sensor | per site | $350 |
| Additional vCISO block, 8 hours | per month | $2,200 |
| OT / industrial network monitoring | per site | $1,400 |
| Managed vulnerability remediation | per endpoint | $4 |
Assessments and testing
Fixed price after a 30-minute scoping call. Larger scopes are quoted from the same unit prices. Every assessment includes a readout call, a retest of remediated findings within 90 days and an attestation letter.
| Assessment | Scope | Lead time | Price |
|---|---|---|---|
| Vulnerability assessment | Authenticated scan of up to 500 hosts, validated and ranked | 1 week | $2,400 |
| Microsoft 365 security review | One tenant: identity, mail flow, Defender, sharing, audit | 1 week | $3,900 |
| Google Workspace security review | One domain: identity, Gmail, Drive sharing, admin audit | 1 week | $3,900 |
| Wireless assessment | Up to 3 sites, rogue AP and client attacks | 1 week | $3,200 |
| Phishing and social engineering campaign | Up to 500 users, three pretexts, voice optional | 2 weeks | $2,800 |
| Cloud configuration review | One AWS, Azure or GCP account or subscription | 2 weeks | $5,500 |
| External penetration test | Up to 64 external IPs and 2 web applications | 2 weeks | $6,500 |
| Web application penetration test | One application, up to 3 roles, authenticated | 2–3 weeks | $8,500 |
| Internal network penetration test | One site, assumed breach, up to 1,000 hosts | 2–3 weeks | $9,500 |
| Mobile application penetration test | One app, iOS and Android, with its API | 3 weeks | $9,800 |
| Red team exercise | Objective-based, 4 weeks, physical optional | 6 weeks | $28,000 |
Compliance and advisory
| Service | Scope | Price |
|---|---|---|
| vCISO retainer, 16 hours | Named consultant, monthly | $4,500 / month |
| vCISO retainer, 32 hours | Named consultant, monthly | $8,000 / month |
| HIPAA security risk assessment | Required annual assessment with risk register | from $7,500 |
| PCI DSS gap assessment | SAQ scoping, gap analysis, remediation plan | from $9,000 |
| NIST CSF 2.0 assessment | Current and target profiles, roadmap | from $12,000 |
| SOC 2 readiness | Gap assessment through audit management | from $18,000 |
| ISO 27001 readiness | Scope, SoA, ISMS build, internal audit | from $24,000 |
| CMMC Level 2 readiness | NIST 800-171 assessment, SSP, POA&M | from $22,000 |
| Policy library | 25 policies mapped to your framework | $4,800 |
| Tabletop exercise | Half-day ransomware or BEC scenario, facilitated | $3,500 |
Readiness projects include the gap assessment, policies, control implementation support, evidence collection and audit management. The auditor's fee is separate and quoted with the project.
Incident response
| Service | What it covers | Price |
|---|---|---|
| Incident response retainer | Hotline, 1-hour response, 40 prepaid hours, IR plan, annual tabletop | $12,000 / year |
| Retainer hours beyond the 40 | Same team, same SLA | $275 / hour |
| Emergency response, no retainer | 4-hour response, 20-hour minimum | $425 / hour |
| Forensic investigation | Imaging, analysis, report to evidentiary standard | $350 / hour |
| Breach notification support | Scope of affected data, notice drafting with counsel | quoted |
Enterprise plans include the retainer. Essential and Professional clients receive 25% off it. Emergency engagements for companies without a retainer are invoiced weekly.
Hourly rates
For work outside a package, by role. Quoted in advance with an estimate of hours; we do not bill past the estimate without asking.
| Role | Per hour |
|---|---|
| Principal consultant / vCISO | $285 |
| Senior penetration tester | $250 |
| Incident responder | $275 |
| Cloud security engineer | $225 |
| SOC analyst | $165 |
Pricing questions
What counts as an endpoint?
A workstation, laptop, server or VM running the agent. Mobile devices under MDM are half price. Printers, phones, cameras and IoT devices are covered by network sensors and are not counted.
Is there a setup fee?
A one-time onboarding fee equal to one month of the plan. It is waived when you prepay the year.
Can we change plans or counts mid-term?
Counts are trued up quarterly from the agent inventory, up or down. You can move up a plan any time; moving down takes effect at renewal.
Do assessments include a retest?
Yes, one retest of remediated findings within 90 days of the report, at no charge. The attestation letter reflects the retest.
What forms of payment do you take?
ACH and wire at no charge; Visa, Mastercard and American Express. Assessments are invoiced 50% at kickoff and 50% at report delivery, net 15. Managed plans bill monthly in advance.
Do you offer nonprofit or education pricing?
Yes. Registered nonprofits, schools and districts receive 15% off managed plans and awareness training.
Get the number in writing.
Endpoints, users, cloud accounts and sites. The quote shows the plan, any assessments and the total.