Plans and pricing
One product, priced by the identities you protect. Every detection, integration, and blocking capability is included.
101–250 identities
$4.25 per identity, per month
$12,750.00 a year, billed monthly on an annual commitment.
Prepay the year and save $1,912.50.
1 more identity reaches $3.50 per identity.
- Set up with our team, usually within a business day
- Every capability included at every volume
- Prepay the year and save 15%
Volume Discounts
Larger organizations can benefit from our volume-based pricing model.
| Protected identities | Per identity / month | Per identity / year | Prepaid / identity / year |
|---|---|---|---|
| 1–100 | $5.00 | $60.00 | $51.00 |
| 101–250 | $4.25 | $51.00 | $43.35 |
| 251–500 | $3.50 | $42.00 | $35.70 |
| 501–1,000 | $2.80 | $33.60 | $28.56 |
| 1,001–2,500 | $2.30 | $27.60 | $23.46 |
| 2,500+ | $1.90 | $22.80 | $19.38 |
All prices in US dollars, plus applicable sales tax. The default term is a one-year commitment billed monthly; prepaying the year takes 15% off. Minimum commitment is $75.00 a month or 50 protected identities. Above 2,500 identities we will quote a negotiated flat rate — talk to sales.
What counts as a protected identity
The billing unit is a human user account in the Active Directory domains you protect.
Service accounts, machine accounts, and disabled accounts do not count, and neither do the decoys themselves. Deploy as many agents and as many decoys as your environment needs. The number of domain controllers, certificate authorities, and file servers you cover has no effect on the price.
Everything is included
There are no feature tiers. A fifty-identity customer and a five-thousand-identity customer run the same product.
- Kerberoasting, AS-REP Roasting, and DCSync target detection
- Pre-2000 machine account, Shadow Credentials, and RBCD detection
- ADCS abuse detection (ESC1, 2, 3, 4, 9, and 13)
- CertGuard active blocking
- Email alerts, webhooks, and SIEM integration
- PSA integration (ConnectWise)
- Full API access
- Multi-org support for MSPs and MSSPs
Stop tuning and start detecting.
Deploy Directory Decoy across your domain controllers and certificate authority. Priced by the identities you protect, with every detection included.