Pricing
Annual terms. No per-user or per-agent charge.Plan limits are below; pricing is provided with a quote.
Direct plans
| Team | Enterprise | Enterprise Plus | Government | |
|---|---|---|---|---|
| Compartments (companies) | 1 | 5 | 15 | 15 |
| Policies (agent roles) | 25 | 100 | 300 | 300 |
| Agent identities | Unlimited | Unlimited | Unlimited | Unlimited |
| Fair-use active identities | 5,000 | 25,000 | 100,000 | 100,000 |
| Static sites (egress IPs) | 10 | 50 | 150 | 150 |
| Events per month (5-minute dedup) | 150M | 500M | 1.5B | 1.5B |
| Retained log storage | 450 GB (90 days) | 1.5 TB (90 days) | 4.5 TB (180 days) | 9 TB (1 year) |
| Forwarding per month | 50 GB | 200 GB | 600 GB | 600 GB |
| Support | Business hours | 24x7 | 24x7, named contact | 24x7, named contact, purchase order terms |
| Request pricing | Request pricing | Request pricing | Request pricing |
Government: the same platform with one-year retention included, US-only data handling documentation, NIST 800-171 and CMMC control mapping, and purchase order terms.
MSSP plans
For managed security service providers delivering Agent DNS to their customers. Each customer is a tenant compartment under the MSSP parent. Events, storage and forwarding pool at the parent.
| MSSP Core | MSSP Growth | MSSP Scale | |
|---|---|---|---|
| Tenants included | 10 | 40 | 150 |
| Policies included per tenant | 5 | 5 | 5 |
| Agent identities | Unlimited | Unlimited | Unlimited |
| Fair-use active identities per tenant | 10,000 | 10,000 | 10,000 |
| Pooled events per month | 1B | 3B | 10B |
| Pooled retained storage | 3 TB | 9 TB | 30 TB |
| Pooled forwarding per month | 100 GB | 500 GB | 2 TB |
| Global lists to tenants | Included | Included | Included |
| White-label | Not included | Included | Included |
| Support | Business hours | 24x7 | 24x7, named contact |
| Partner Program | Partner Program | Partner Program |
Add-ons
Additional compartments, policies, tenants, events, storage, forwarding and three-year retention are available on every plan. Rates are provided with a quote.
| Item | Applies to |
|---|---|
| Additional compartment | Direct plans |
| Additional policy | Direct plans |
| Additional tenant | MSSP plans |
| Additional policy | MSSP plans |
| Storage | All plans |
| Forwarding | All plans |
| Events | All plans |
| Three-year retention | All plans |
How usage is measured
Events. Resolutions are deduplicated per client, name and type in 5 minutes windows before they are counted. Repeated lookups of the same name by the same client inside a window count once.
Sizing. A workstation generates about 330,000 deduplicated events per month. An agent workload generates 90,000 to 270,000 per month depending on how many distinct destinations it reaches. One thousand employees therefore consume roughly 330M events per month; one hundred agent workloads consume 10M to 30M.
Storage. Retained storage is measured on the log index, at about 1,000,000 events per GB. Retention is the plan allocation divided by monthly ingest.
Forwarding. Measured in bytes delivered to the customer's syslog collector.
Identities. Unlimited. The fair-use figure is the number of concurrently active identities the platform is sized for on each plan.
Included in every plan
Unlimited agent identities (DoH virtual sites)
Greywall with learning, hold and block modes
Allow and block lists with source, reference and expiry
Category policy
Customer-supplied threat feeds (STIX, CSV, TXT, JSON)
Syslog forwarding, CEF, JSON and CSV export
Six signed webhook events and the IOC push API
Change log with rollback
Dashboard with 17 filter fields
Ten PDF report templates
Global anycast network
US-based data handling
Pricing questions
How is usage measured?
Events are counted after deduplication: one event per client, name and type per 5 minutes window. A workstation generates about 330,000 events per month; an agent workload generates 90,000 to 270,000 depending on activity. Retained storage is measured on the log index at about 1,000,000 events per GB. Forwarding is measured in bytes sent to the customer's collector.
What is a compartment?
A compartment is a company in Securd, with its own policies, agent identities, logs, first-seen baselines and users. Organizations typically run one compartment, or one per business unit or environment. On MSSP plans, each customer of the MSSP is a tenant compartment under the MSSP parent.
What is a policy?
A policy is the unit of scope for one agent role: its allow and block lists, category rules, Greywall mode and hold time, and its first-seen baseline. Identities bound to the same policy share that baseline.
Why are agent identities unlimited?
An identity is a DoH address issued to one agent instance. Agent platforms create identities as they schedule work, so a cap on identities would be a cap on the customer's own orchestration. Identities carry negligible cost; policies and compartments carry the cost, and those are the meters.
What happens at a limit?
Compartment and policy limits are enforced at creation. Events, storage and forwarding above the plan allocation are billed at the add-on rates. The fair-use identity figure is the concurrently active count the platform is sized for; above it, Securd contacts the customer to plan capacity.
What are the contract terms?
All plans are annual. Monthly invoicing is a payment schedule, not a month-to-month plan. Government plans are available on annual purchase order with net terms.
Is there an evaluation?
Yes. A 60-day paid evaluation on a single compartment, credited against the first year of any plan. Request pricing for the evaluation fee.
Do smaller organizations have an option?
Organizations below the Team plan are served through Securd MSSP partners, who deliver Agent DNS as a managed service on the MSSP plans above.
Evaluate Agent DNS with your own agent traffic
A 60-day evaluation on a single compartment, credited against the first year.