Question 1

Why is the annual price exactly twelve times the monthly one?

Accepted Answer

Because it is twelve months at the monthly rate. We do not discount for prepayment and we do not surcharge you for paying as you go, so the billing period is the only thing that toggle changes. A vendor who needs a 20% prepayment discount to make the annual number attractive is telling you the monthly number was wrong.

Question 2

What happens when we hit the daily API ceiling?

Accepted Answer

Further calls are declined and the counter resets at 00:00 UTC. No overage billing and no throttled degradation, just a clean and predictable limit. If you hit it regularly that is a tier conversation, not an invoice surprise.

Question 3

Does working in the console count against the quota?

Accepted Answer

No. Panel use is unmetered on every tier: the ceilings meter API calls only, so an analyst chasing a case never rations clicks to protect a number, and nobody has to decide whether a hunch is worth a query. Your API consumption is a live bar in the console.

Question 4

How many people can use it?

Accepted Answer

Core and Professional come with one account. Enterprise adds user management, which is where multiple named users live: your admin creates them, scopes them and revokes them without asking us. What we deliberately do not do is charge per analyst. A seat is not where the value is: twenty-five people reading the same exposure is not five times the value of five reading it, and billing for the twenty-sixth only teaches a team to share a login, which is the opposite of what an audit log is for. So the number of people is a property of the tier, never a line on the invoice.

Question 5

Do the tiers differ in which modules we get?

Accepted Answer

In one respect only, and it is not a fee. Coverage is not a paid axis: eight of the nine windows are open on every tier from the first day, and what a tier buys is depth, the daily API ceiling on each one. There is no per-module fee to add, because pricing the windows separately would mean pricing the analysis apart from the finding, and vulnerability context is what you reason *with* once an exposure surfaces. The ninth is Sours, and it does not arrive on an invoice line either: Operator Surveillance is scoped in a closed briefing under NDA on Enterprise, never switched on from a plan. Two things sit outside a package in the other direction: the public CVE index at cvekit.com is free to everyone with no account at all, and Malveine's STIX/TAXII/Sigma/EDL push is the Enterprise delivery layer while its console is on every tier.

Question 6

What is the Enrichment API (Centragon)?

Accepted Answer

Centragon is the enrichment layer: every post we collect is classified before you ever query it, by content category, sector, the data types it exposes, motivation, severity, and ATT&CK techniques mapped to their tactics. The Enrichment API is that layer on its own meter, so your pipeline can ask for the labels instead of re-deriving them. Its ceilings are deliberately low next to the search quotas, because a call there runs a model rather than an index lookup.

Question 7

Can we add a module later?

Accepted Answer

For eight of the nine there is nothing to add: they are open from the first day of the package, so a team that starts on credentials and later needs Telegram or Discord coverage simply starts using it, with no order form and no mid-term amendment. What you would change mid-term is the tier, and only when the daily API ceiling rather than the coverage is what is in your way. The ninth is Sours, which is genuinely added rather than already open, and it is added by a closed briefing on Enterprise rather than by a plan change.

Question 8

Is there a free tier or self-serve trial?

Accepted Answer

No. Access to this data requires verifying who you are and what you are entitled to monitor, and no signup form can do that. Evaluation happens as a scoped POC against your own domains. What is free and needs no account: the public CVE library at cvekit.com and the Underground Lexicon here.

Question 9

Are STIX/TAXII/Sigma/EDL feeds available today?

Accepted Answer

Feed delivery is packaged with the Enterprise tier. If you need a format we haven't listed, ask. Delivery is the part of the product we obsess over.

Question 10

Is this list price, and what sits outside it?

Accepted Answer

These are list prices in USD, exclusive of local tax. Outside them: volume past the Enterprise ceilings, redistribution or OEM rights, and Sours held on its own rather than inside an Enterprise agreement. Those are scoped as Custom, which is a different conversation from a discount request.

Feature	Core $450 / mo	ProfessionalMost teams $750 / mo	Enterprise $1,250 / mo	Custom Scoped with you
User accounts Per-analyst pricing: none. Why Not a paid axis: there is no per-analyst price at any tier. Core and Professional run on one account; Enterprise adds user management, so an org creates and revokes its own. Additional users are a capability of the tier, not a line item you add to it.	Core: 1 account	Professional: 1 account	Enterprise: User management	Custom: User management
Console use Never counted. Why Working a case in the panel is not metered on any tier. Every ceiling below is an API ceiling.	Core: Unmetered	Professional: Unmetered	Enterprise: Unmetered	Custom: Unmetered
Modules Coverage: not a paid axis. Why Eight of the nine windows are open on every tier, and what a tier sets is the daily API ceiling on each rather than which ones you may open. Sours is the ninth and has a row of its own. There is no per-module fee to add, and Sours is scoped in a briefing rather than switched on from a plan.	Core: All but Sours	Professional: All but Sours	Enterprise: All nine	Custom: All nine
Sherlog API Credential and cookie searches.	Core: 500 / day	Professional: 5,000 / day	Enterprise: 25,000 / day	Custom: Scoped with you
Dragnet API Underground content search and export.	Core: 50 / day	Professional: 150 / day	Enterprise: 250 / day	Custom: Scoped with you
Enrichment API · Centragon The classification layer, on its own meter. Why Every collected post passes through it before you query it: 32 content categories, 27 ATT&CK techniques, sector and severity labels. Metered tighter than search, because a call runs a model rather than an index lookup.	Core: 10 / day	Professional: 150 / day	Enterprise: 250 / day	Custom: Scoped with you
Remaining module APIs Each on its own daily API ceiling. Cvekit Malveine Jabbernaut Telepathy Guildwire Baitback Why Included does not mean unmetered: every one of these windows is open on every tier and draws on a daily API ceiling of its own.	Core: 50 / day per module	Professional: Raised · agreed per module	Enterprise: Raised · agreed per module	Custom: Scoped with you
Sours Operator Surveillance. Why Scoped in a closed briefing under NDA on Enterprise, never self-serve and never switched on from a plan.	Core: —	Professional: —	Enterprise: Closed briefing · NDA	Custom: Closed briefing · NDA
Feed delivery Pushed into your SIEM, no human in the path.	Core: —	Professional: —	Enterprise: STIX 2.1 · TAXII 2.1 · Sigma · EDL	Custom: STIX 2.1 · TAXII 2.1 · Sigma · EDL
API access	Core: X-API-Key	Professional: X-API-Key	Enterprise: X-API-Key · priority support	Custom: X-API-Key · priority support
Governance	Core: Activity audit log	Professional: Activity audit log	Enterprise: Activity audit log · user management · SSO (roadmap)	Custom: Activity audit log · user management · SSO (roadmap)
	Talk to sales	Talk to sales	Talk to sales	Start the conversation

The figures, printed.

Core

Professional

Enterprise

Custom

Nine building blocks

Sherlog

Dragnet

Cvekit

Malveine

Jabbernaut

Telepathy

Guildwire

Baitback

Sours

Price & quota questions

Not sure which blocks you need?