Know more.
Guess less.
Start with research. Add company exposure investigations, then scheduled checks and prioritized alerts as your team grows.
Exposure covers administrator-assigned customer scope. Alerts highlight newly discovered qualifying evidence; source coverage varies.
Investigator
Single analyst. Selector pivots, actor resolution, the knowledge graph and dossier export, with a daily lookup allowance and a few watchlists.
Billed monthly or annually
Get startedAllowances
- 200 actor lookups a day
- 30 agent questions a day
- 3 watchlists
- 80 private conversations a month
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- Domain, email and IP exposure investigations
- Assigned-scope credential reveal and copy
- Scheduled company exposure monitoring
- In-app exposure alerts
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Professional
Shared investigations for three people. Assigned-scope exposure, credential review, API access and higher research allowances.
Billed monthly or annually
Get startedAllowances
- 750 actor lookups a day
- Unmetered agent questions
- 25 watchlists
- 25 assigned domains, emails or IPs
- 3 seats
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- Domain, email and IP exposure investigations
- Assigned-scope credential reveal and copy
- Scheduled company exposure monitoring
- In-app exposure alerts
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Team
Five seats for security teams. Scheduled exposure checks, prioritized in-app alerts, larger asset scope and advanced exports.
Billed monthly or annually
Get startedAllowances
- 5,000 actor lookups a day
- Unmetered agent questions
- Up to 200 watchlists
- 250 assigned domains, emails or IPs
- 5 seats
What is included
- Full actor profiles
- Identifier pivots
- Selector pivot search
- Linked identities and genome
- Dossier export
- Recovered communications context
- Domain, email and IP exposure investigations
- Assigned-scope credential reveal and copy
- Scheduled company exposure monitoring
- In-app exposure alerts
- API access
- STIX / TAXII export
- Audit log
- Knowledge graph
- Watchlists and alerts
- Priority support
- Ransomware knowledge base
- Community browser
Enterprise
More seats, a higher API ceiling, and the record delivered where your team already works. Priced on what you need rather than a tier you grow out of.
RFI & per-dossier
Need one specific attribution without a subscription? Commission a single request for information and we run the case for you, and hand back a sourced, timestamped dossier you can act on or take to court.
Intelligence drawn from across the global threat landscape
.svg.webp){kind=logo}
Compare all plans
A dash means counted, not shown: the row and the number arrive, and the value is withheld by the server rather than hidden in your browser.
| Feature | Free Free | Investigator €299/mo | Professional €899/mo | Team €2,000/mo | Enterprise Custom |
|---|---|---|---|---|---|
| Allowances | |||||
| Actor lookups a day | 3 | 200 | 750 | 5,000 | Unmetered |
| Agent questions a day | 1 | 30 | Unmetered | Unmetered | Unmetered |
| Watchlists | 3 | 25 | Up to 200 | Unmetered | |
| Seats | 1 | 1 | 3 | 5 | Custom |
| Assigned exposure assets | 25 | 250 | Custom | ||
| Company exposure & response | |||||
| Domain, email and IP exposure investigations | |||||
| Assigned-scope credential reveal and copy | |||||
| Shared company workspace and member roles | |||||
| Scheduled company exposure monitoring | |||||
| In-app exposure alerts | |||||
| Identity & attribution | |||||
| Full actor profiles | |||||
| Identifier pivots | |||||
| Selector pivot search | |||||
| Linked identities and genome | |||||
| Dossier export | |||||
| The recovered record | |||||
| Actor search across every community | |||||
| Browse the actor directory | |||||
| Posting history | |||||
| Recovered communications context | |||||
| Knowledge graph | |||||
| Watchlists and alerts | |||||
| Access & export | |||||
| API access | |||||
| STIX / TAXII export | |||||
| Audit log | |||||
| Single sign-on (SSO) | |||||
| Priority support | |||||
| Enrichment | |||||
| Ransomware knowledge base | |||||
| Community browser | |||||
| Infrastructure intelligence (C2, IOCs) | |||||
| Telegram monitoring (Watchtower) | |||||
| Open-source enrichment | |||||
