Know more.
Guess less.
Searching is free. The plans buy what is behind the record.
Investigator
Single analyst. Selector pivots, actor resolution, the knowledge graph and dossier export, with a daily lookup allowance and a few watchlists.
Billed monthly or annually
Get startedAllowances
- 200 actor lookups a day
- 30 agent questions a day
- 3 watchlists
- 80 private conversations a month
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Professional
For serious individual investigators and small DFIR and crypto-recovery practices. Higher lookup limits, more watchlists, API access, priority processing and up to three seats.
Billed monthly or annually
Get startedAllowances
- 750 actor lookups a day
- Unmetered agent questions
- 25 watchlists
- 3 seats
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Team
For firms. Five or more seats, high lookup limits, the full API, STIX and TAXII export, an audit log and priority support.
Billed monthly or annually
Get startedAllowances
- 5,000 actor lookups a day
- Unmetered agent questions
- Up to 200 watchlists
- 5 seats
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Enterprise
More seats, a higher API ceiling, and the record delivered where your team already works. Priced on what you need rather than a tier you grow out of.
RFI & per-dossier
Need one specific attribution without a subscription? Commission a single request for information and we run the case for you, and hand back a sourced, timestamped dossier you can act on or take to court.
Intelligence drawn from across the global threat landscape
.svg.webp){kind=logo}
Compare all plans
A dash means counted, not shown: the row and the number arrive, and the value is withheld by the server rather than hidden in your browser.
| Feature | Free Free | Investigator €299/mo | Professional €899/mo | Team €2,000/mo | Enterprise Custom |
|---|---|---|---|---|---|
| Allowances | |||||
| Actor lookups a day | 3 | 200 | 750 | 5,000 | Unmetered |
| Agent questions a day | 1 | 30 | Unmetered | Unmetered | Unmetered |
| Watchlists | 3 | 25 | Up to 200 | Unmetered | |
| Seats | 1 | 1 | 3 | 5 | Custom |
| Identity & attribution | |||||
| Full actor profiles | |||||
| Identifier pivots | |||||
| Selector pivot search | |||||
| Linked identities and genome | |||||
| Dossier export | |||||
| The recovered record | |||||
| Actor search across every community | |||||
| Browse the actor directory | |||||
| Posting history | |||||
| Recovered communications context | |||||
| Knowledge graph | |||||
| Watchlists and alerts | |||||
| Access & export | |||||
| API access | |||||
| STIX / TAXII export | |||||
| Audit log | |||||
| Single sign-on (SSO) | |||||
| Priority support | |||||
| Enrichment | |||||
| Ransomware knowledge base | |||||
| Community browser | |||||
| Infrastructure intelligence (C2, IOCs) | |||||
| Telegram monitoring (Watchtower) | |||||
| Open-source enrichment | |||||
