Pricing

Start free. Scale when the work does.

Lookup is self-serve. Platform is annual-contract for the full SOC — volume-pooled lookups, unlimited users, soft overage.

Lookup

Indicator research for individuals

One daily lookup pool covers indicators, CVEs, malware families, bulk rows, compare, and agent turns. Assessment comes with every lookup; reports and source refreshes have their own budgets.

Switch to annual to save up to 15%

Free

40 lookups/mo · full verdict reasoning

Free

40 lookups/mo
10/day max
No manual source refreshes
Export: Markdown

Start free

Analyst

Popular

600 lookups/mo · refresh, bulk, API & MCP

$49/ mo

600 lookups/mo
20 source refreshes/day
Bulk paste
Export: Markdown, CSV, STIX
API & remote MCP access
Overage $0.15/lookup (opt-in)

Start Analyst

Platform

Volume and instances — not seats

Unlimited users. Soft lookup pools with overage alerts — never a hard block mid-incident. Sales-led onboarding.

Platform

Defensible verdicts for regulated SOCs — volume pooled, users unlimited.

$5,000/ mo

Unlimited users
25,000 lookups / mo pooled
Overage $0.20 / lookup (soft — never hard-blocked)
3 connector instances
Audit log, SSO, tenant isolation

Talk to sales

Platform Scale

Higher volume, unlimited connectors, data residency, named CSM.

$10,000/ mo

Unlimited users
100,000 lookups / mo pooled
Overage $0.15 / lookup (soft — never hard-blocked)
Unlimited connector instances
Data residency · priority support

Talk to sales

Prefer a walkthrough first? See Platform or explore Lookup.

Developer platform

Unique observables — not total calls

OEM and API tiers meter distinct intelligence. Repeats are free. Soft overage never hard-blocks. Redistribution rights are OEM-only.

Developer

Free connector tier — OpenCTI reference and sandboxed builds. Attribution required.

Free

1,000 unique observables / mo
Attribution required
No redistribution rights

Build

Embeddable verdicts for product teams. Attribution required; no redistribution.

$500 / mo

10,000 unique observables / mo
Overage $0.06 / unique (soft)
Verdict-change webhooks
Attribution required
No redistribution rights

Volume

High unique-observable volume for SOCs and platforms. Soft overage.

$2,500 / mo

100,000 unique observables / mo
Overage $0.03 / unique (soft)
Verdict-change webhooks
SLA 99.5%
No redistribution rights

OEM

Redistribution and white-label rights for MSSPs. Negotiated ACV.

$25–250K / yr

Negotiated unique observables
Verdict-change webhooks
SLA 99.9% + named CSM
Redistribution + white-label rights

OpenAPI at /api/v1/openapi. Deprecation policy at /docs/api/deprecation.