Pricing

Why read a price,
when you can build one?

Three packages. One slider for your organisation size. Watch every price update live, compare side by side, and pick what fits. No "Basic + Add-ons" arithmetic required.

Company size 250 employees
Save €0 / year with annual
Basic
Ideal for getting most out of your Microsoft license
€439 / month
per workspace
Free per employee
From €439 base
  • Alert rule calibration
  • Alert enrichment
  • Two-way data sync
  • Cost transparency for log sources
  • …see all features
Toggle add-ons
BUY NOW
Most popular
Pro
Ideal for reducing SOC workload
€899 / month
per workspace
+€0,22/employee
From €899 base
  • Everything in BASIC
  • Classification ML algorithm
  • Monitor log ingestion
  • Customizable automation settings
  • …see all features
Toggle add-ons
BUY NOW
Enterprise
Ideal for scaling advanced security operations
€1.399 / month
per workspace
+€0,39/employee
From €1.399 base
  • Everything in PRO
  • Easy-to-use DCR tool
  • Automatic reporting
  • Custom tags on your Sentinel incidents
  • …see all features
Toggle add-ons
Talk to sales

More than 20.000 employees, an MSSP, or running multiple Sentinel workspaces?

We tailor a license model around your tenant footprint, workspace count and operating model. Let's talk.

Contact sales
Full comparison

See every line, side by side.

What's in each package, down to the limits. Hover the ? on any feature for the full description.

Feature
Basic€439 / mo
Pro€899 / mo
Enterprise€1.399 / mo
Calibrate
1-click bulk update of alert rulesUpdate, enable or disable the alert rules you choose with one single click.
Alert Rule Calibration and RecommendationsOngoing, automatic recommendations based on a value matrix for your environment on which alert rules to enable and disable.
120 alert rules
Log Source Calibration and RecommendationsOngoing, automatic recommendations based on a value matrix for your environment on which log sources to enable and disable.
20 log sources
Configuration RecommendationsOngoing, automatic recommendations based on a value matrix for your environment on which basic configurations to enable and disable.
Top 5
SKU Level OptimizationMonitoring of SKU levels with recommendation to change levels if consumption level can provide savings.
—
—
Cost transparency for Log SourcesOverview of what your log sources actually cost on a detailed table level.
Top 5
Top 5
Customizable Value SettingsOverwrite the recommended value (i.e. cost and gain) from Seculyze for your custom value level.
—
Log changes in alert rules and log sourcesAlert rules and log sources changes are kept in a log with change type, comment, date and name.
—
Automated Rule DeploymentEnable that Microsoft alert rules are updated automatically when new KQL code is released.
—
Automatically follow all recommendationsEnable so all recommendations on alert rules, log sources and configurations are followed.
—
—
Microsoft Alert Rule IntegrationMicrosoft alert rules templates are integrated and shown directly on the interface.
Third-party Alert Rule IntegrationIntegrate 3rd party alert rules in the Seculyze portal. They are shown in the log source value analysis, but does not have a value analysis.
Tune
Classification ML algorithmClassifies alerts into false positives, true positives and undetermined.
—
Customizable Automation SettingsChange settings for your own automatic ML tuning rules, e.g. custom tags in Sentinel.
—
1-Click Close False PositivesClose all false positives with a single click.
—
Auto-handle False PositivesCreate automatic tuning rules based on analytical data for each alert rule.
—
—
Identification of True PositivesThe ML algorithm also indicates which alerts are true positives.
—
Threat Intelligence on Security AlertsA number of open and closed source threat intelligence sources is used to enrich the alerts.
Continuous alert enrichmentA number of OSINT (Open-Source Threat Intelligence) sources, e.g. WHOIS, is used to enrich the alerts to increase analysis speed.
Risk-based priority (low / medium / high)Based on a unique algorithm, OSINT and Threat Intelligence are combined to provide a low, medium and high risk rating of security alerts.
View and Explore your Enriched AlertsGet an easy overview of enriched alerts with observations and, based on that, easy to follow actions.
Custom Tags on your Sentinel incidentsTag incidents with threat intelligence in your Sentinel instance.
—
—
Agent SOC / TriagingAutomatic triaging of alerts as well as recommended actions.
—
—
Cost
Easy-to-use Data Collection Rule toolProvides an easy overview of Data Collection Rules (DCR), both potential savings and current implemented.
—
—
Vertical log ingestion removalRemove ingestion cost in table columns and fields that do not provide value.
—
—
Horizontal ingestion removalRemove cost in log entries that either do not provide value or are duplicate.
—
—
Summary rules & low-cost storage moveAggregate large sets of data to provide cost savings on verbose logs.
—
—
Remove duplicate eventsClean up log sources, so duplicate events in the same log source are not present multiple times.
—
—
Remove log source overheadRemove overhead from select log sources, e.g. comments in logs.
—
—
Monitor log source ingestionMonitor the ingestion level and that logs are actually ingested.
—
Alert management on log ingestionGet an alert if logs are over-ingesting or are not ingested at all.
—
Spike management of individual costsMonitor ingestion and set capacity and ingestion thresholds to ensure spending does not run out of hand.
—
Environment & Support
Two-way Data SyncData is synchronized between Microsoft Security portfolio and Seculyze.
Online SupportSupport is provided through our chat app in the application.
Easy installationThe Seculyze application is created through infrastructure-as-code, so once you have provided the required Azure secrets, installation is run as code.
In-App Onboarding & How-To GuidesAccess to how-to-guides, knowledge articles, and private tours of the application with in-app onboarding.
Multiple User Privilege LevelsAdd users with different levels of privileges, e.g. admin, user and read-only users.
—
Customizable URLGet your own custom URL of at least 4 letters, i.e. xxxx.seculyze.com.
Auto-Generate DocumentationEasy and fast incident reporting, including NIS2 compliant, based on multiple inputs done with AI and masking of data.
—
—
Monthly reportingEasy monthly reporting with management summary, threat intelligence, alert statistics, etc.
—
—
Your Own Managed Key to encrypt dataAlert data transferred to Seculyze is encrypted via keys that are in the Seculyze tenant and managed by the Customer.
—
—
ITSM IntegrationITSM Integration to Jira, Autotask, ServiceNow, etc.
—
—
Add-ons
Single Sign-On (SSO)Federate your AD sign-in with the Seculyze software.
—
+€199
+€199
Segregated InfrastructureYou will have the Seculyze application running on a segregated namespace in Azure.
—
—
+€999
Questions we hear

Before you ask.

How is the per-employee price counted?

We count employees in your organisation, not Sentinel analysts or seats. Drag the slider in the configurator to see your exact price. We verify headcount once per year on renewal.

Can I start on Basic and upgrade later?

Yes. You can upgrade at any time and the price difference is pro-rated. Downgrading is allowed at the end of your billing period. No lock-in, no migration when you move between packages.

Is there a free trial?

30 days on Pro Cost, Pro Tune or Enterprise, using your real Sentinel data. No credit card. You see the noise reduction and cost cut on your own workspace before you sign anything.

What's the difference between Pro Cost and Pro Tune?

Pro Cost focuses on cutting your Sentinel bill (DCR, SKU, log reduction). Pro Tune focuses on cutting alert noise (ML, threat intelligence, auto-close). Most customers end up on Enterprise to get both, but you can run them separately.

Do add-ons stack on any package?

SSO (€199/month) is available on Pro and Enterprise. Segregated Infrastructure (€999/month) is Enterprise only because it spins up dedicated resources. Automatic Incident reporting is included with Pro Tune and Enterprise, and Your Own Managed Key (CMK) for encryption is part of every license at no extra cost.

What happens if we cross 20.000 employees?

The slider caps at 20.000 because above that we design a custom contract, typically with volume discounts and named success engineer. Talk to sales and we'll size it to your actual org-chart.

Can we pay in DKK or another currency?

The builder shows EUR. Invoices can be issued in DKK, EUR, GBP, SEK or NOK. Annual contracts get -10% regardless of currency.

Where is our data stored?

EU by default (Denmark). Your Sentinel data never leaves your tenant, Seculyze reads through native APIs. For regulated workloads, Enterprise can add Segregated Infrastructure for a dedicated region.

Still reading?

Get a quote on your stack.

A 30-minute call, your Sentinel workspace, and a number you can take back to finance the same day. No deck first.

Contact sales