Pricing
Start free. Scale on-prem when you're ready.
Every tier runs on the same detection engine. What changes is explainability depth, monthly volume, and support.
Athene
Contact us
On-prem, production-grade detection with full-depth explainability.
- Production-grade detection channel
- Full-depth attack-chain explainability
- Standard support
- 90-day license
Bubo
Contact us
On-prem detection at unlimited scale with dedicated support.
- Production-grade detection channel
- Full-depth attack-chain explainability
- Early access to new detectors as they ship
- Dedicated support
- 365-day license
Otus
Free
Cloud-hosted detection — free, no data sharing required. Usage-capped rather than capability-capped.
- Production-grade detection channel
- Core attack explainability
- Capped monthly build-session volume
- Real-time delivery only — findings are never stored
- 500 build sessions / month
- 3 deep explanations / month
- 30-day license
Strix Starter
$59 / month
Cloud-hosted detection for small teams, with more volume than the free tier.
- Production-grade detection channel
- Core attack explainability
- Real-time delivery only — findings are never stored, same as Otus
- Community support
- 2,000 build sessions / month
- 15 deep explanations / month
- 30-day license
Strix Growth
$249 / month
Cloud-hosted detection for growing engineering teams.
- Production-grade detection channel
- Full-depth attack-chain explainability
- Real-time delivery only — findings are never stored, same as Otus
- Standard support
- 10,000 build sessions / month
- 100 deep explanations / month
- 30-day license
Compare plans
Every detail, side by side.
| Plan | Athene | Bubo | Otus | Strix Starter | Strix Growth |
|---|---|---|---|---|---|
| Deployment | On-prem | On-prem | Cloud-hosted | Cloud-hosted | Cloud-hosted |
| Monthly build sessions | — | — | 500 | 2000 | 10000 |
| Monthly deep explanations | — | — | 3 | 15 | 100 |
| Explainability depth | deep | deep | deep | deep | deep |
| Findings storage | Delivered to your SIEM | Delivered to your SIEM | Real-time only, not stored | Real-time only, not stored | Real-time only, not stored |
| License term | 90 days | 365 days | 30 days | 30 days | 30 days |
| Support | Standard support | Dedicated support | — | Community support | Standard support |
FAQ
Plans and billing
What counts as a build session?
One monitored pod's lifetime, from first observed execve to pod teardown. An in-flight build is never cut off mid-way if a monthly cap is reached during it — only a brand-new session past the cap is held back.
What happens when a cloud tier hits its monthly session limit?
New sessions are rejected until the next monthly period starts. Sessions already running when the limit is reached are always allowed to finish.
How does data handling differ between on-prem and cloud tiers?
On-prem tiers run fully inside your own infrastructure — nothing about your build sessions leaves your network. The cloud free tier is real-time only: a finding is delivered live to your dashboard and, if nobody is connected when it fires, it is never stored anywhere. See Security for the full picture.
Can I change plans later?
Yes — talk to us and we'll move you. Reassigning a plan re-issues your license from that plan's current limits and features, so your entitlement always matches what you're actually on.