Per-analyst pricing. No per-endpoint overhead.

MDR platforms charge per endpoint because they manage the tooling. Sockindle is an AI layer on top of your existing SIEM — your analysts still run the SOC, Sockindle handles the tier-1 volume. Per-analyst-seat pricing aligns with how SOC teams are staffed and budgeted, not with your endpoint count.

A SIEM source is one connected SIEM or EDR platform — e.g., Splunk counts as one source. Connecting both Splunk and CrowdStrike Falcon is two sources. Analyst tier supports 1 source; SOC tier supports 3; Enterprise tier is unlimited.

Hunt loops continue running — enrichment queries beyond the monthly cap are queued and processed when the quota resets at the next billing cycle. Critical-severity alerts are always enriched; lower-severity items are queued. You'll receive a notification when approaching the cap.

Monthly billing is month-to-month with no long-term commitment. Annual billing saves approximately 11-13% depending on tier and provides a predictable budget line. Enterprise tier contracts are custom — typically 12-36 month terms with SLA guarantees.

Full Analyst tier features — 1 SIEM connection, autonomous hunt loops, IOC enrichment (capped at 20K during trial), MITRE ATT&CK mapping, and coverage report generation. No credit card required to start. Enterprise trial available by request for federal/healthcare environments requiring custom data handling agreements.