Monitor
€2,900/ month
For scale-ups that need eyes on glass without building a SOC.
- 24/7 alert triage (EDR + identity)
- Business-hours containment
- Monthly threat report
- Annual external pentest
- Incident response retainer
- Named analyst
Service tiers.
Transparent monthly pricing for up to 250 endpoints. Larger estates get a custom quote within 48 hours.
Managed security
Choose your level of cover.
Defend
€6,400/ month
Our most popular plan: full MDR with a team that knows your name.
- 24/7 triage and containment
- EDR, identity, cloud and email logs
- Named analyst + monthly briefing
- Two pentests per year
- 40h incident response retainer
- Red team exercise
Fortress
€12,800/ month
For regulated companies and high-value targets.
- Everything in Defend
- Threat hunting every week
- Annual red team exercise
- 120h IR retainer, 15-min SLA
- vCISO, 8 hours per month
- NIS2 / DORA reporting support
Compare
Tier details.
| Feature | Monitor | Defend | Fortress |
|---|---|---|---|
| P1 response SLA | 60 min | 15 min | 15 min |
| Log sources | EDR, identity | + cloud, email | + network, OT, custom |
| Pentests per year | 1 | 2 | 4 |
| Incident response hours | pay as you go | 40 | 120 |
| Threat hunting | — | monthly | weekly |
| Data residency | EU or US | EU or US | EU, US or dedicated |
Billing FAQ
No surprises in the invoice.
What counts as an endpoint?
Any laptop, server or VM running our EDR sensor. Cloud accounts and SaaS tenants are included at no extra cost.
Is there a setup fee?
Defend and Fortress include onboarding. Monitor has a one-off €1,500 onboarding fee, waived on annual billing.
Can we change tiers later?
Yes, upgrade any time; downgrades take effect at the next renewal date.
What if we have an incident before onboarding finishes?
We respond anyway. Hours are drawn from your retainer or billed at the standard €290/h rate.
Free · 3 minutes · no agent install
Find out what attackers already see.
Run our external threat check on your domain. We look at exposed services, leaked credentials, email spoofing and TLS hygiene, then send a plain-English report.