Two ladders, because analysts and businesses buy different things.
An analyst has no estate to defend, so monitoring is a different product for them, not an upgrade. We price it that way instead of bundling one into the other and charging you for the half you do not use.
We are not taking payment yet — the company is mid-formation. Plans marked available are built and running; ask for access and we will set you up and tell you honestly when billing starts. Monthly, cancel any time. Solo prices include VAT; business prices exclude it and are reverse-charged to VAT-registered buyers elsewhere in the EU.
Swipe the table sideways to compare all six plans.
| Capability | Researcher €25 /mo incl. VAT Available Malware analysts and security researchers, paying out of their own pocket. | Analyst €49 /mo incl. VAT Available Analysts whose day job runs on this, not a weekend curiosity. | Analyst Pro €89 /mo incl. VAT Available Two or three people sharing the work. | Brand Watch €149 /mo excl. VAT Available One business that also does its own analysis — one domain, one brand. | Surface €249 /mo excl. VAT Coming soon A real estate — several domains, subsidiaries, or brands. | Estate Quoted Contact us Coming soon Organisations that need findings inside their own tooling and process. |
|---|---|---|---|---|---|---|
| Analysis | ||||||
| Static analysis: PE, ELF, .NET, scripts, Office, PDF, LNK, archives | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Reverse-engineering workspace: decompiler, functions, cross-references | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| YARA family matching against 12,390 curated rules | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Tiered verdict with its evidence chain, and a coverage manifest | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Rule replay and retro-notification | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Export: JSON, IOC-CSV and .yar rule drafts | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Files a day | 50 | 250 | 500 | 1,000 | 1,000 | Unmetered |
| Results kept | 7 days | 14 days | 30 days | 3 months | 6 months | 12 months |
| Priority in the analysis queue | – | – | ✓ | ✓ | ✓ | ✓ |
| Monitoring your own estate | ||||||
| Lookalike and typosquat domains, with evidence captured | – | – | – | ✓ | ✓ | ✓ |
| External attack surface: subdomains, services, TLS, exposures | – | – | – | ✓ | ✓ | ✓ |
| Email spoofability: SPF, DMARC, MTA-STS, DNSSEC | – | – | – | ✓ | ✓ | ✓ |
| Dark-web and ransomware leak-site exposure | – | – | – | ✓ | ✓ | ✓ |
| Domains monitored | – | – | – | 1 | 5 | Scoped with you |
| Integration and team | ||||||
| IOC lookup, threat feed, ransomware landscape, daily digests | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Programmatic API keys | – | – | 1 | 1 | 1 | 10 |
| Findings as a feed to your SIEM or SOAR | – | – | ✓ | ✓ | ✓ | ✓ |
| Pushed into your own MISP or TheHive | – | – | – | – | – | ✓ |
| Case management and ticketing | – | – | – | – | – | ✓ |
| NIS2 reporting deadlines tracked against your incidents | – | – | – | – | – | ✓ |
| Seats | 1 | 1 | 3 | 1 | 3 | 5 |
| Get started | Request access | Request access | Request access | Request access | Register interest | Register interest |
For one analyst: Prices include VAT. What you see is what you pay.
For a business: Prices exclude VAT. Sales to VAT-registered businesses in other EU member states are reverse-charged.
Questions before you buy?
Where your data lives, whether your files leave our infrastructure, what active scanning needs, and how billing works are all answered on the FAQ.