Pricing.

No, and that's deliberate. ThreatLens is an intelligence layer that sits on top of your existing stack, not a replacement for it. Your SIEM continues to be the system of record for logs and alerts. ThreatLens connects to it (and to your EDR, XDR, identity, cloud, and threat intelligence sources), correlates the evidence across those tools, and produces investigation-ready verdicts for your analysts to act on.

Think of it as the layer between detection and response, the part that today lives in analyst heads and browser tabs. We automate the investigation grunt-work; your SIEM keeps doing what it was built to do.

AI Assurance is self-serve: run a free public-repo AI-BOM scan with no account, or start a 30-day Team trial with no card required. See AI Assurance plans.

The AI Governance Platform and ThreatLens Core touch live telemetry, so instead of a self-serve trial we run a structured 30-day proof of concept with your team, connected to one real data source, free of charge and with success criteria agreed upfront. Request a demo to scope one.

AI Assurance has published self-serve plans (Free scan, Team from $300/mo) plus Business and Enterprise. AI Governance Platform and ThreatLens Core are licensed per environment under an enterprise agreement by edition, deployment model, and team, not metered by alert, agent invocation, or LLM token. That keeps budgeting predictable no matter how noisy your stack gets.

Enterprise agreements are right-sized on a scoping call to your actual environment and growth plans.

Available on enterprise plans across the portfolio, on-premise deployment means the product runs entirely within your own infrastructure, and your data never leaves your environment. We ship a containerised deployment package (Kubernetes-based) with a documented runbook and assisted setup. Your team handles the underlying compute; we manage the application lifecycle, update delivery, and provide a dedicated support channel for operational issues.

Minimum requirements: 16 vCPU / 64 GB RAM / 1 TB SSD for a standard deployment; final sizing is confirmed during setup. Air-gapped deployments (no outbound internet) are also supported.

ThreatLens Core ships with native connectors for the most common SOC stack, Splunk, Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, Palo Alto Cortex XDR, Elastic SIEM, QRadar, Okta, Azure AD, AWS CloudTrail, GCP Security Command Center, VirusTotal, and Shodan, plus a webhook API for pushing findings into ticketing systems like ServiceNow and Jira.

Enterprise customers can add custom connectors built to their specification, typically delivered within a 6–8 week build cycle on the enterprise agreement. A full, up-to-date integration catalogue is available in the security & compliance section.