Usage-based credits, not per-seat. Same cost per query regardless of how many agents call it. Free plan is free forever.
For curious developers and small environments — confidence-scored threat answers, free forever.
Billed annually — 1 extra month free
For one practitioner using it daily — more credits, higher limits, and longer history than Free.
Everything in Free, and
Billed annually — 1 extra month free
For a whole team, not a single practitioner — pooled credits, teammate access, shared agent management, and team analytics.
Everything in Solo, and
For orgs with enterprise requirements — your own feeds (BYOF), SSO, unlimited seats, and marketplace procurement.
Everything in Team, and
Core investigation — entity resolution, evidence lookup, relationship exploration, prioritization, assessments, recommendations — is available on every tier. Plans differ on scale, collaboration, governance, and convenience.
| Capability | Free | Solo | Team | Enterprise |
|---|---|---|---|---|
| Monthly credits | 100 | 1,000 | 3,000 (pooled) | Custom |
| Core investigation workflow | ✓ | ✓ | ✓ | ✓ |
| API + MCP server | ✓ | ✓ | ✓ | ✓ |
| Shared credit pool | No | No | Yes | Yes |
| Invite teammates | No | No | Yes | Yes |
| Batch endpoints | 5 items / request | 20 items / request | 50 items / request | Custom |
| Rate limits | 10 req / min | 60 req / min | 180 req / min | Custom |
| Concurrent active workflows | 1 | 2 | 5 | Custom |
| Saved investigation history | 7 days | 90 days | 1 year | Custom |
| Usage & agent activity history | 7 days | 90 days | 1 year | Custom |
| Team collaboration & analytics | — | — | ✓ | ✓ |
| Credential lifecycle audit | Basic revoke / create | Guided rotation | Guided + auditability | Guided + auditability |
| Bring Your Own Feed (BYOF) | — | — | — | ✓ |
| Dedicated graph instance | — | — | — | ✓ |
| Support | Email support | Priority email | Priority email | Dedicated support |
Yes — the Free plan is free forever. Connect your agent and it's answering threat questions in minutes.
Yes — Enterprise is available via all major cloud and frontier marketplaces (AWS, Azure, GCP, Snowflake, Databricks).
Yes — Bring Your Own Feed (BYOF) is included in the Enterprise tier.
A typical lightweight-to-normal investigation consumes roughly 15–30 credits. Allocations will be revisited after real usage data.
Better decisions, fewer queries, lower cost. Start free in minutes.
