Know more.
Guess less.
Searching is free. The plans buy what is behind the record.
Investigator
Single analyst. Selector pivots, actor resolution, the knowledge graph and dossier export, with a daily lookup allowance and a few watchlists.
Saves €598 against paying monthly
Get startedAllowances
- 200 actor lookups a day
- 30 agent questions a day
- 3 watchlists
- 80 private conversations a month
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Professional
For serious individual investigators and small DFIR and crypto-recovery practices. Higher lookup limits, more watchlists, API access, priority processing and up to three seats.
Saves €1,798 against paying monthly
Get startedAllowances
- 750 actor lookups a day
- Unmetered agent questions
- 25 watchlists
- 3 seats
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Team
For firms. Five or more seats, high lookup limits, the full API, STIX and TAXII export, an audit log and priority support.
Saves €4,000 against paying monthly
Get startedAllowances
- 5,000 actor lookups a day
- Unmetered agent questions
- Up to 200 watchlists
- 5 seats
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Enterprise
More seats, a higher API ceiling, and the record delivered where your team already works. Priced on what you need rather than a tier you grow out of.
RFI & per-dossier
Need one specific attribution without a subscription? Commission a single request for information and we run the case for you, and hand back a sourced, timestamped dossier you can act on or take to court.
Intelligence drawn from across the global threat landscape
.svg.webp){kind=logo}
Compare all plans
A dash means counted, not shown: the row and the number arrive, and the value is withheld by the server rather than hidden in your browser.
| Feature | Free Free | Investigator €2,990/yr | Professional €8,990/yr | Team €20,000/yr | Enterprise Custom |
|---|---|---|---|---|---|
| Allowances | |||||
| Actor lookups a day | 3 | 200 | 750 | 5,000 | Unmetered |
| Agent questions a day | 1 | 30 | Unmetered | Unmetered | Unmetered |
| Watchlists | 3 | 25 | Up to 200 | Unmetered | |
| Seats | 1 | 1 | 3 | 5 | Custom |
| Identity & attribution | |||||
| Full actor profiles | |||||
| Identifier pivots | |||||
| Selector pivot search | |||||
| Linked identities and genome | |||||
| Dossier export | |||||
| The recovered record | |||||
| Actor search across every community | |||||
| Browse the actor directory | |||||
| Posting history | |||||
| Recovered communications context | |||||
| Knowledge graph | |||||
| Watchlists and alerts | |||||
| Access & export | |||||
| API access | |||||
| STIX / TAXII export | |||||
| Audit log | |||||
| Single sign-on (SSO) | |||||
| Priority support | |||||
| Enrichment | |||||
| Ransomware knowledge base | |||||
| Community browser | |||||
| Infrastructure intelligence (C2, IOCs) | |||||
| Telegram monitoring (Watchtower) | |||||
| Open-source enrichment | |||||
