all systems operational · status.vaultsecurity.example SOC 2 Type II · ISO 27001 · fictional demo attestations
[ Pricing / Per workload, no mystery ]
Per-workload rates, published upgrade thresholds, and an honest note on every tier — including the one that says when not to buy us at all. Your connect screen shows your exact workload count before you pay anything.
annual billing saves ~20%
Single cloud, first security program
$11 $14 / workload / mo
billed annually billed monthly
Up to 250 workloads
Most teams start here
Multi-cloud teams heading into audits
$17 $21 / workload / mo
billed annually billed monthly
Up to 1,000 workloads
Platform teams running detection & response
$24 $30 / workload / mo
billed annually billed monthly
Up to 2,500 workloads
Regulated estates & 2,500+ workloads
Custom
volume rate shown before the call ends
Custom volume pricing
[ Full comparison ]
| Feature | Core | Growth | Scale | Enterprise |
|---|---|---|---|---|
| Workloads included | 250 | 1,000 | 2,500 | Custom |
| Cloud providers | 1 | All | All | All |
| Posture Graph & attack paths | Included | Included | Included | Included |
| Data exposure classification | Not included | Included | Included | Included |
| IaC scanning & PR gates | 1 repo platform | Included | Included | Included |
| Identity Map (effective permissions) | Not included | Included | Included | Included |
| Least-privilege policy PRs | Not included | Included | Included | Included |
| JIT elevation workflows | Not included | Not included | Included | Included |
| Runtime Detect (control-plane) | Not included | Not included | Included | Included |
| eBPF runtime sensor | Not included | Not included | Optional | Optional |
| Guarded containment actions | Not included | Not included | Included | Included |
| Evidence Engine frameworks | SOC 2 only | Any 5 | Any 12 | All 27 |
| Auditor workspace seats | Not included | Not included | 2 | Unlimited |
| SSO / SAML + SCIM | Not included | Included | Included | Included |
| Audit-log export | Not included | Included | Included | Included |
| API access | Read-only | Included | Included | Included |
| Support | Next business day | 8 business hours | 24×7 critical | Custom SLA + TAM |
| Deployment | Shared cloud | Shared cloud | Shared cloud | Private tenancy option |
[ Straight answers ]
A billable workload is a VM, a container host node, a serverless function group, or a managed database instance. S3 buckets, IAM identities, and network resources are never billed — we count compute and data stores, not everything with an ARN. Your connect screen shows the exact count before you pay anything.
Nothing breaks and nothing bills silently. Coverage continues for 30 days while we flag the overage and offer the next tier pro-rated. We do not throttle security coverage as a sales tactic.
There is a 14-day proof of value on your real estate — full platform, no card. We do not offer a forever-free tier: a security tool you never operationalize is worse than none, and we would rather be honest about that.
No. Per-workload rates are locked for the term, and renewals are capped at 5% over the prior term's rate for existing scope.
If you run under ~50 workloads with no compliance deadline, cloud-native tooling is honestly enough. If your estate is overwhelmingly on-prem hardware, we are the wrong shape — our agentless model is cloud-first. The comparison tool on this site will tell you the same thing.
[ Next step ]
Connect read-only and the platform counts your billable workloads before you spend a dollar — or ask a solutions engineer to run the volume math with you on a call.