Predictable. Partner-led. No hidden modules.
Annual contract, scaled to your environment, not your incident volume. Every deployment includes the full platform, with no per-module paywalls inside it. The services and integrations you add on are always quoted separately and clearly, never buried in the bill.
How our pricing works
Predictable.
Annual price quoted up front, scaled to your environment size. No incident-based surcharges, no per-event surprise bills, no overage fees during normal operations.
Partner-led.
We sell through partners. Your trusted reseller, MSP, or integrator quotes you, contracts with you, and stays in the loop on delivery. We're the platform behind their service. Never above it.
No hidden modules.
Every deployment includes the full platform: vulnerability management, vendor risk, and external attack surface, with no per-module paywalls inside it. Add-ons like Advise, Guided Implementation, and the Integration Marketplace are always quoted separately, never bolted on mid-contract.
The full platform. Every deployment.
Things some vendors charge extra for. We don't.
24/7 U.S.-based SOC
includedHuman Tier 1, Tier 2, and incident response analysts on U.S. soil. Critical/High response targets at 30 minutes.
All five hubs
includedVisualize, Operations, Governance, Environment, Threat Intel. Every hub on every deployment.
AI triage + incident response
includedAI classifies every alert with a confidence score and written rationale; a SOC analyst reviews each one. The always-on six-phase IR workflow runs on every incident.
Vulnerability management
includedInventory, CVSS scoring, POAM linkage from the same data plane your SOC operates on.
Vendor risk & attestations
includedOngoing BAA / DPA tracking with aging and renewal reminders.
External attack surface
includedContinuous outside-in view of exposed assets, mapped to internal ownership. Included up to 300 subdomains, expandable.
All control matrices
includedCMMC L2, SOC 2, PCI DSS v4.0, HIPAA, NIST CSF. Every framework, every deployment.
Post-eradication hours: 5 hrs/month, included.
A use-it-or-lose-it monthly bank for post-eradication forensics, hardening, or follow-up investigation. If you exceed it, additional hours are quoted by your partner. Most months, customers don’t.
Add the services you want. Nothing you don’t.
The platform is whole on its own. These are quoted separately and clearly, so you only pay for what you choose.
Advise
add-onSenior security advisors on the same U.S. residency standard as the SOC. Strategy, framework readiness, and post-incident guidance, quoted alongside the platform.
Guided Implementation
add-onHands-on onboarding to stand up your environment, connect sources, and tune detections faster. A fixed-scope engagement, not open-ended consulting.
Integration Marketplace
add-onBidirectional integration packages beyond your included sources. Activated per package, when you need them.
EDR licensing
add-onBring your own EDR, or license SentinelOne, CrowdStrike, or Cybereason through ArmorPoint. Microsoft Defender is supported as a two-way integration.
Tied to your environment, not your incidents.
For organizations
Quote based on environment size: identities, endpoints, data sources, and frameworks in scope. Annual contract, locked rate. Multi-year discounts available through partners.
For MSPs & service providers
Volume-tiered. Per-tenant economics that improve with scale. White-label reporting with optional co-delivery. The margin question MSPs actually want answered, not avoided.
Deployment model affects cost too: cloud is standard, and physical sites that need network monitoring add sensors. Your partner provides a specific quote on the demo call.
The questions buyers ask before the demo call.
Why don’t you publish prices?
What about incident-volume surcharges?
Are modules priced separately?
Do you sell direct?
What happens at renewal?
Trust signals
Get a real number on the demo call.
30 minutes with a security engineer. We'll scope your environment, your partner quotes the price, and you walk away with deployment timelines on the same call.