Pricing
Start free. Scale on-prem when you're ready.
Every tier runs on the same detection engine. What changes is explainability depth, monthly volume, and support.
Otus
Free
Cloud-hosted detection — free, no data sharing required. Usage-capped rather than capability-capped.
- Production-grade detection channel
- Core attack explainability
- Capped monthly build-session volume
- Real-time delivery only — findings are never stored
- 500 build sessions / month
- 3 deep explanations / month
- 30-day license
Most popular
Athene
$59 / month
On-prem, production-grade detection with full-depth explainability.
- Production-grade detection channel
- Full-depth attack-chain explainability
- Standard support
- 90-day license
Strix
$249 / month
Cloud-hosted detection for growing engineering teams.
- Production-grade detection channel
- Full-depth attack-chain explainability
- Real-time delivery only — findings are never stored
- Standard support
- 15,000 build sessions / month
- 150 deep explanations / month
- 30-day license
Pulsatrix
$899 / month
Cloud-hosted detection at high volume for large engineering orgs.
- Production-grade detection channel
- Full-depth attack-chain explainability
- Real-time delivery only — findings are never stored
- Priority support
- 60,000 build sessions / month
- 600 deep explanations / month
- 30-day license
Bubo
Contact us
On-prem detection at unlimited scale with dedicated support.
- Production-grade detection channel
- Full-depth attack-chain explainability
- Early access to new detectors as they ship
- Dedicated support
- 365-day license
Compare plans
Every detail, side by side.
| Plan | Otus | Athene | Strix | Pulsatrix | Bubo |
|---|---|---|---|---|---|
| Deployment | Cloud-hosted | Cloud-hosted | Cloud-hosted | Cloud-hosted | On-prem |
| Monthly build sessions | 500 | — | 15000 | 60000 | — |
| Monthly deep explanations | 3 | — | 150 | 600 | — |
| Explainability depth | deep | deep | deep | deep | deep |
| Findings storage | Real-time only, not stored | Real-time only, not stored | Real-time only, not stored | Real-time only, not stored | Delivered to your SIEM |
| License term | 30 days | 90 days | 30 days | 30 days | 365 days |
| Support | — | Standard support | Standard support | Priority support | Dedicated support |
FAQ
Plans and billing
What counts as a build session?
One monitored pod's lifetime, from first observed execve to pod teardown. An in-flight build is never cut off mid-way if a monthly cap is reached during it — only a brand-new session past the cap is held back.
What happens when a cloud tier hits its monthly session limit?
New sessions are rejected until the next monthly period starts. Sessions already running when the limit is reached are always allowed to finish.
How does data handling differ between on-prem and cloud tiers?
On-prem tiers run fully inside your own infrastructure — nothing about your build sessions leaves your network. The cloud free tier is real-time only: a finding is delivered live to your dashboard and, if nobody is connected when it fires, it is never stored anywhere. See Security for the full picture.
Can I change plans later?
Yes — talk to us and we'll move you. Reassigning a plan re-issues your license from that plan's current limits and features, so your entitlement always matches what you're actually on.