ProductsDirectory Decoy
Frequently asked questions
Trials, agents, plans, and deployment — the questions we are asked most often.
- How do I get started?
- Talk to our team. Because Claymore is priced by the number of identities you protect, we confirm your environment with you before activating your account rather than asking you to estimate it yourself. Most accounts are live within a business day, and once activated you deploy agents with a single command.
- What counts as a protected identity?
- A human user account in the Active Directory domains you protect. Service accounts, machine accounts, and disabled accounts do not count, and neither do the decoys themselves.
- Does the number of agents or decoys affect the price?
- No. Price depends only on protected identities. Deploy as many agents and decoys as your environment needs across every domain controller, certificate authority, and file server you cover.
- How do volume discounts work?
- The rate for your band applies to your whole estate, not in slices. At 340 protected identities every identity prices at the 251-500 rate, not 100 at the entry rate plus the remainder lower down.
- How is it billed?
- The default term is a one-year commitment billed monthly. Prepaying the year in a single invoice takes 15% off. Minimum commitment is $75 a month or 50 protected identities.
- What happens if we grow mid-term?
- Add protected identities at any time and they bill at your current band, or at the better rate if the additions move you into a larger band. Reductions take effect at renewal.
- Are any capabilities held back for larger customers?
- No. There are no feature tiers. Every detection, CertGuard blocking, all integrations, and the full API ship to every account at every volume. On-premise deployment and service-level agreements are arranged per contract.
- Do we have to know Active Directory security to run this?
- No. Each decoy comes with step-by-step setup in the dashboard, and every alert explains in plain language what the attacker attempted and what it means. The underlying technique names and MITRE ATT&CK IDs are there when your team or your SOC wants them.
- Is there an on-premise option?
- Yes. On-premise deployment is arranged per contract rather than bundled, because it depends on your environment. Contact sales for details.
Stop tuning and start detecting.
Deploy Directory Decoy across your domain controllers and certificate authority. Priced by the identities you protect, with every detection included.