PRICING // TRANSPARENT BY DESIGN
Enterprise-grade response. Mid-market terms.
No opaque seven-figure contracts, no alert-volume surprises. Pick a deployment model, pick a tier, and know exactly what your defense costs before you talk to anyone.
DEPLOYMENT // TWO MODES, ONE SOFTWARE
Where the Dome runs.
CLOUD
Managed cloud, live in days.
We run the agents in US cloud regions and wire them into your stack. Fastest path to coverage — most teams are watching their environment within a week.
Subscription + per-source connectors
- → us-region hosting, encrypted in transit and at rest
- → zero infrastructure for your team to operate
- → live coverage typically within 5 business days
- ✓ suited to: lean IT teams, fast time-to-value
ON-PREM
Inside your perimeter, under your lock.
Deploy the identical agent software into your own infrastructure — VMware, Kubernetes, or bare metal. Built for data-residency mandates and air-gapped networks.
Annual license + deployment engagement
- → identical agent software, your hardware
- → no telemetry leaves your network
- → guided deployment with our engineers
- ✓ suited to: regulated industries, data-residency mandates
TIERS // SCALE TO YOUR SOC
Three tiers. Same agents. More autonomy.
Every tier runs the full detect-investigate-respond loop. The tiers differ in connector surface, autonomy depth, and the support relationship behind it.
SENTINEL
For lean IT teams standing up coverage.
- 1 environment, up to 5 telemetry sources
- Full detect + investigate loop, guided response
- Analyst-approved containment actions
- Business-hours support, US-based
- Standard integrations: one SIEM, one EDR
WARDEN
For 24/7 SOCs that want the agents working overnight.
- Up to 3 environments, 15 telemetry sources
- Autonomous containment within your thresholds
- Custom response playbooks + approval gates
- 24/7 support with named escalation path
- Extended integrations: SIEM, EDR, identity, cloud
BASTION
For regulated teams that need the Dome inside the walls.
- Unlimited environments and connector surface
- On-prem deployment, fully air-gap capable
- Custom autonomy policies + compliance pack
- Dedicated response engineer + quarterly review
- SOC 2 / ISO reports under NDA, data-flow diagrams
Included in every plan.
Full audit log of every agent action
Role-based access control
US-based support from the engineers who build it
All platform updates, no upgrade fees
Guided onboarding and connector setup
SOC 2 / ISO documentation available under NDA
QUESTIONS // ANSWERED PLAINLY
Pricing questions, straight answers.
Do you charge per alert or per analyst seat?
No. Pricing is a flat subscription by tier and environment count — your alert volume never changes the bill, and every seat your team needs is included.
What does the on-prem deployment engagement involve?
A guided deployment with our engineers: architecture review, install into your VMware, Kubernetes, or bare-metal environment, connector wiring, and a validated live exercise. Most deployments complete in two to three weeks.
Can we start on cloud and move on-prem later?
Yes. Both modes run identical agent software, so moving between them is a redeployment, not a rebuild. Your playbooks and autonomy policies carry over.
Is there a minimum term?
Annual billing is standard; month-to-month is available on the Sentinel tier for pilot deployments.
What happens during the demo?
We map your stack, configure a simulated intrusion, and run the full detect-investigate-respond loop live against a threat model shaped like yours. Thirty minutes, no slideware.
NEXT STEP // 30 MINUTES
Price your environment, not your panic.
Tell us your stack size and we'll map it to the right tier and deployment model — with real numbers, not "contact sales" theater. If we're not the right fit, we'll say so.