Packetman saysPacketman here on pricing. Three DataStun prices: five dollars a month for an endpoint, fifteen for a standard server, thirty for an advanced server. Those buy the technology. Who operates it is your call: run it yourself, or hand it to a security provider you choose, and change your mind later. Providers, monitoring services, and extra technologies are selected and priced separately, by them, not by us.Endpoint $5/month. Standard Server $15/month. Advanced Server $30/month. Those prices buy the DataStun technology. Operate it yourself, or delegate it to one of the security providers you choose — and change providers without changing platforms. 20% off annual, and the price you see is year two’s price.
Three classes, priced per machine per month. Same agent, same protection; the class reflects what the machine is and what it takes to protect it.
For laptops, desktops, and user endpoints — Windows, macOS, and Linux.
For typical application, infrastructure, database, web, and production server workloads.
For higher-exposure, more complex, sensitive, or high-value server environments.
Not a business? Individual ($3 per endpoint, up to 3) and Tribe ($2 per endpoint, up to 33) are the low-cost plans for your own machines, a home lab, a family, a club, or a small nonprofit — endpoints only, no server classes, no minimum. Business accounts bill per machine at the rates above with a 20-machine minimum; Enterprise is a custom contract.
Packetman saysPacketman here. Not every server is the same security problem. An internal application server talking to a handful of known systems is a different job from an internet-facing production system taking connections from a large and varied population. We look at the diversity of systems communicating with the server, the programs doing the communicating, and what the workload needs protecting, not at how many cores it has or what it cost.Not every server presents the same security problem.
An internal application server communicating with a small number of known systems is fundamentally different from an internet-facing production system receiving connections from a large and diverse population of sources.
DataStun server tiers consider the security scope of the workload: the diversity of systems communicating with the server, the executable processes participating in those communications, and the protection requirements of the application and data. Server pricing isn’t determined simply by processor size, memory, bandwidth, operating system, or whether the server is physical or virtual.
DataStun observes the systems communicating with a protected server, not just how much traffic arrives. A server talking to a small, predictable population is a different environment from one taking connections from a large and varied one.
Every network session is tied to the executable that opened it, so the number and diversity of network-active programs on a server is part of the analytical scope DataStun takes on.
DataStun observes network and process behavior directly. What a workload is worth — identity, authentication, sensitive data, business-critical services — is something your administrator tells us by marking the machine mission-critical. That classification is what makes a server Advanced.
An internet-facing application usually runs on several servers or virtual machines behind a load balancer. The balancer spreads the incoming sources across them, but every one of those machines answers the public internet, runs the application’s processes, and holds the same data — so each one needs the full protection, and each one is priced as its own Advanced Server. Six web nodes behind one balancer are six Advanced Servers. The same applies to containers: an application spread across six containers is six Advanced Servers, $30 per container per month, each watched for every IP address it talks to and is reached from. The DataStun agent runs on each machine, which is also how every node’s own listening ports get checked from outside every day.
The model underneath: source systems → sessions → executables → services → protected data. DataStun’s security value comes from understanding those relationships, not from counting bandwidth or reading a spec sheet. DataStun flags machines that behave like servers from the services they listen on; your administrator confirms the class, and a change in class is never applied to your bill silently.
Only the first step is DataStun. The rest is your choice, chosen and priced independently — and none of it is mandatory.
Endpoint — $5/month
Standard Server — $15/month
Advanced Server — $30/month
Your organization retains its DataStun tenant.
Operate DataStun internally — through your own IT team or your own security operations center, with alerts flowing into the tooling you already run — or delegate responsibility to a security provider you choose, and change providers as your requirements change.
MSSP services are provider priced.
Add complementary security technologies, such as Network Detection and Response, where appropriate.
Independently selected and priced.
Add human monitoring, investigation, escalation, containment, and response when required — from your own security operations center if you have one, or from a provider.
Your SOC, or provider priced.
DataStun separates the security technology from the organization that provides managed security services. Three forms of independence follow from that.
Purchasing DataStun does not require purchasing a bundled human security-operations service. If you already run a security operations center, DataStun feeds it; if you don’t, you are not made to buy one. Security technology without mandatory security-service overhead.
Using DataStun does not bind you to a particular MSSP. Your organization retains its tenant; a provider receives delegated responsibility, never ownership. Change providers without changing platforms.
MSSPs familiar with DataStun build their own offerings and set their own prices. DataStun does not set their service prices — you compare providers on capabilities, expertise, coverage, response, terms, and price.
Your organization retains control of its DataStun tenant. Manage DataStun yourself or delegate responsibility to a security service provider. Your security-service relationship can change without surrendering your DataStun environment to the provider: attaching a provider takes both sides’ agreement, detaching is yours alone, and the record of who held responsibility and when is kept.
Responsibility for your tenant can move from one MSSP to another as your requirements change — no agent is re-deployed, and your history stays put. One provider holds delegated responsibility for a tenant at a time; alongside it, your owner can grant individual seats to specialists from another firm when a particular job calls for different expertise.
DataStun provides security technology without requiring every customer to buy a staffed security-operations service. Organizations with their own security operations center run DataStun through it: alerts and findings leave by signed webhook, syslog, and export into the tools that team already watches. Organizations that need continuous human monitoring, investigation, and response and do not have that team can engage an MSSP, MDR provider, or SOC provider. Independent providers determine their own services, coverage, response capabilities, service levels, technologies, and pricing — so you can compare competing providers and select what fits.
Providers can combine DataStun with additional security technologies and professional services to build offerings for different requirements. Each provider determines the technologies, services, and pricing in its offering. Browse listed providers →
Packetman saysThe comparison table below shows exactly what each tier includes. The differences aren't in security quality — every tier gets the same blocklist enforcement, the same reputation grading, the same threat intelligence. The differences are in how many agents you can enroll, how far back your history goes, whether you get the fleet analytics layer, and what your support channel looks like. Individual and Tribe get AI in-app support. Business and above get human-backed escalation. Enterprise adds priority routing to the DataStun team. One number worth knowing: the Business tier's seven fleet analytics — SBOM, first-seen radar, vendor map, deviation scoring, patch lag, SaaS license reconciliation, and location-aware network health — typically pay for the subscription on their own just from the SaaS license reconciliation finding.Same threat-intel quality across every tier. The differences are agent capacity, support level, and integrations.
Every tier includes the Sphere of Trust mesh — continuous device-to-device path monitoring that lists at $10,000–$20,000/yr for ten sites on dedicated path-monitoring tools.
Simple enough for grandma, admired by the CTO — the same protection for every customer.
Not sure which plan fits? Leave your email and phone and we’ll help you choose.
For your own machines — a laptop, a desktop, a private lab box
For the tech who runs the family’s machines, a home lab, a club, a small nonprofit
For businesses and multi-office teams
For regulated, large, or sovereignty-driven orgs
Packetman saysThis calculator does the Business math for you. Endpoints are five dollars a month each, standard servers fifteen, advanced servers thirty. Business accounts have a twenty-machine minimum, so the floor is one hundred dollars a month. Tick annual and every rate drops twenty percent. Past five hundred machines we price by conversation.Endpoints $5, Standard Servers $15, Advanced Servers $30 — per machine per month, 20-machine minimum, no upper cap.
DataStun prices only. Provider services, NDR, MDR, and SOC are selected and priced independently. Individual ($3/endpoint, up to 3) and Tribe ($2/endpoint, up to 33) are endpoints-only plans with no minimum and no server classes. Enterprise is custom.
Two tracks. The partner program pays 15–35% recurring commission on referred customers — any customer earns 15% by sharing their link; Dealers, Distributors, and Master Distributors earn more. The MSSP program is for managed-service providers: wholesale per-agent pricing ($3.75 → $3.25 → $2.75 volume bands), free directory listing, and customer handoff without re-deploying an agent.
For organizations with regulated environments, data residency requirements, or strategic security partnerships — on top of (or in place of) the standard Enterprise tier.
Custom agent count, dedicated infrastructure available, priority escalation routing, master service agreement, custom feature development for genuinely unique needs.
Custom pricing. Typically multi-year, six-figure annual.
Run your own ten on AWS, GCP, Azure, DigitalOcean, Vultr, Hetzner, or on-premises. Your data never leaves your infrastructure. Full feature parity with hosted.
Available on request. License fee on top of your tier.
Run your own rep — become a threat-intel hub. Mirror our findings, contribute back, or join as a federation peer. For organizations with internal security research teams.
Available on request. Annual license + agent fees.
Government CERTs, security vendors, and large enterprises can join as federation peers. Bidirectional, equal-rank threat-intel exchange under formal agreement.
By application. Custom partnership agreement.
Same security underneath, different surface area.
| Feature | Individual | Tribe | Business | Enterprise |
|---|---|---|---|---|
| Price (monthly) | $3/endpoint | $2/endpoint | $5/endpoint · servers $15 / $30 | from $499/mo |
| Price (annual, 20% off) | $2.40/endpoint | $1.60/endpoint | $4/agent/mo $80/mo at the 20-agent floor | annual contract |
| Minimum | none | none | 20 machines ($100/mo floor) | negotiated |
| Server-grade protection Packetman saysA host that runs services exposed to the internet faces a constant onslaught of scans and exploitation attempts — a far more rigorous, ongoing protection workload than a workstation. We auto-detect servers by their listening services and flag them for you to confirm; a confirmed server adds a flat per-server fee for hardened defenses (kernel-level inbound blocklisting, exposure management, scanner-aware grading, auth-boundary monitoring). Workstations are never charged the server rate. | — | — | Standard $15 · Advanced $30 /server/mo | negotiated |
| Agent capacity Packetman saysIndividual and Tribe are capped buckets — 3 and 10 are hard ceilings; to grow past them you change tiers. Business and Enterprise scale by agents with no upper limit: Business is simply $5/agent above the 20-agent minimum. | Up to 3 (hard cap) | Up to 10 (hard cap) | 20+, no upper limit | Unlimited, negotiated |
| History retention | 30 days | 30 days | 90 days | 365 days |
| Sphere of Trust mesh Packetman saysA mesh is an everyone-pings-everyone group of agents rendered as the meshmap. Hard cap of 12 nodes per mesh at every tier. Business and Enterprise pick which 12 agents populate each mesh from their full fleet, and earn one additional mesh per 200 paid agents. | 3-node mesh | Up to 10-node mesh | 12-node mesh, select from your fleet 1 mesh at the 20-agent minimum; +1 per 200 paid agents | 12-node mesh, select from unlimited agents meshes scale 1 per 200 paid agents |
| Real-time blocklist enforcement Packetman saysEvery agent enforces a 20,000+ entry global blocklist at the OS firewall layer (Windows Firewall / iptables / pfctl). Updates within 60 seconds. Source attribution travels with every entry so you can see who flagged the IP. | Yes | Yes | Yes | Yes |
| Public threat intel Packetman saysCurated public threat-intelligence feeds refreshed every 6 hours feed our reputation pipeline; D / F grades land on the global blocklist within minutes of decision. No license required, available to every tier. | Yes | Yes | Yes | Yes |
| Commercial-derived threat data Packetman saysThreat intelligence sourced from licensed commercial feeds (VirusTotal, Recorded Future, others). Broader coverage and earlier signal than public-only. The agent enforcement is identical; the difference is the depth of what gets enforced. | — | — | Yes | Yes |
| Per-tenant dashboard URL Packetman saysYour tenant gets its own subdomain (yourcompany.tenant.datastun.com) with its own DNS, TLS cert, and isolated dashboard. Cleaner sharing with stakeholders, audit-ready URLs in reports, and cleaner SSO bindings down the road. | — | — | Yes | Yes |
| Fleet analytics & insights — intrinsically larger-organization features, billed where the analysis is meaningful | ||||
| SI Governance dashboard Packetman saysBytes uploaded to each AI vendor (Anthropic, OpenAI, Microsoft Copilot, Cursor, etc.) sliced by application, machine, and day. 50+ providers catalogued. Pure metadata — no DPI, no proxy, no MITM. The volume-and-attribution view of corporate AI adoption. (cross-fleet AI vendor traffic) | — | — | Yes | Yes |
| Fleet SBOM Packetman saysAuto-generated software bill of materials: every distinct executable hash, with version, signer, % of agents running it, how often it actually runs, and which external destinations its data goes to. Answers CVE exposure in seconds; also surfaces install-vs-use gaps and surprising external phone-home behavior. (inventory + usage + data-flow) | — | — | Yes | Yes |
| First-seen radar Packetman saysDaily feed of every executable, destination, or code-signer the fleet has never seen before, ranked by spread velocity. Earliest possible signal for both lateral movement and shadow-IT viral adoption. (new exes, destinations, signers) | — | — | Yes | Yes |
| Vendor concentration map Packetman saysStacked bytes-out per cloud / SaaS vendor, sliced by department or location, over time. Single-pane answer to "how dependent are we on each vendor" and "if AWS us-east-1 vanished, what stops?" (bytes per cloud / SaaS) | — | — | Yes | Yes |
| Per-machine deviation score Packetman saysEvery agent gets a daily score for how unlike the rest of the fleet its destinations and executables look. The top 1% surfaces as "review this machine." Cheap pre-filter for SOC analysts who cannot watch every endpoint. (outlier ranking) | — | — | Yes | Yes |
| Patch-lag scoreboard Packetman saysVersion-share distribution per common product (Chrome, Firefox, OpenSSL, OpenSSH, Office, Java) vs current GA. "Chrome 110 still on 12 of your 400 machines." Auditor-ready histograms; vulnerability-management feed. (version distribution vs GA) | — | — | Yes | Yes |
| SaaS license reconciliation Packetman saysPer-application unique-machine-per-month counts. "You licensed 50 Adobe seats; 67 distinct machines opened acrobat.exe last month. Top 17 violators →." Same for Office, Slack, Cursor, Figma, Notion. Pays for the tier on its own. (seats vs actual usage) | — | — | Yes | Yes |
| Location-aware network health Packetman saysPer-location TCP retransmission rate (link quality) and TCP RST rate (middlebox misbehavior) ranked vs your fleet baseline. Catches bad VPN gateways, captive portals, MTU black holes, NAT exhaustion. "Tampa office has 14× normal RST rate" is gold for a network-team buyer. (TCP RST + retransmission rollup) | — | — | Yes | Yes |
| Org-wide executable analysis Packetman saysSaturation, drift, rename detection, executable outliers across the whole fleet. Living-off-the-land malware persists by impersonating known-good binaries; cross-fleet hash anchoring is the cleanest detection. Needs ~50 agents of baseline. (outliers, drift, rename, LotL) | — | — | — | Yes |
| Beaconing detector Packetman saysCross-machine search for consistent low-bandwidth periodic outbound connections — the network signature most C2 traffic prints. Catches dormant or staged compromises that single-machine EDR misses. Signature of behavior, not signature of binary. (cross-machine C2 signature) | — | — | — | Yes |
| Data-sovereignty rollup Packetman saysBytes uploaded to each destination country, sliced by department / location tag, over arbitrary time ranges. Filter to "non-EU destinations from EU-tagged agents." GDPR / Schrems II answered with measurement, no DPI. Compliance audience pays for this alone. (bytes by destination country, by tag) | — | — | — | Yes |
| In-app support Packetman saysAI in-app support answers first, in tenant context. Tenant admins can run more AI assistance themselves or escalate to a real human at DataStun. No email, no phone tag, no ticket numbers — the full thread lives in your dashboard. | AI only + community | AI + human-backed | AI + human-backed | AI + human-backed priority queue |
| Agent rules + custom blocklists Packetman saysTenant-scoped blocklist overrides distributed to every agent within 60 seconds. Block a specific destination, IP range, or executable hash for your fleet only — without affecting other tenants. Same enforcement primitive as the global blocklist. | — | — | Yes | Yes |
| SAML / OIDC SSO Packetman saysSingle sign-on via your existing identity provider (Okta, Entra, Google Workspace, Auth0, etc.). Group claim → tenant role mapping; SCIM provisioning so deactivated identity-provider accounts auto-deactivate in DataStun. | — | — | — | Yes |
| Compliance reports (SOC 2, HIPAA) Packetman saysPre-built compliance evidence reports with the dated, signed format auditors expect. Evidence binders for SOC 2 CC6.6 / CC7.2, HIPAA §164.308 access controls, ISO 27001 A.12.4 logging. Saves weeks per audit cycle. | — | — | — | Yes |
| Dedicated account manager Packetman saysA named human at DataStun who knows your tenant, your fleet, and your priorities. Quarterly reviews, roadmap input, and an escalation channel. Not a sales rep — a technical AM who can route a question to the right engineer. | — | — | — | Yes |
Hover any i for a one-paragraph definition; click it for the full deep-dive in the glossary. MSSP and affiliate partnerships are in the “For partners” section above.
Every paid business tier gets a deep set of cross-fleet analyses derived from data the agent already collects. Each one becomes meaningful at scale — that’s why they’re bundled with Business and Enterprise, not Individual or Tribe. The first seven start paying off at 10+ agents; the last three need 100+ to be worth the compute.
Business & Enterprise
Bytes uploaded to each AI vendor — by application, by machine, by day, fleet-wide. 50+ providers catalogued. The volume-and-attribution view of corporate AI adoption, no DPI. Full feature page →
Business & Enterprise
Auto-generated software bill of materials: every executable hash, with version, signer, % of fleet running it, how often it actually runs, and which external destinations its data goes to. Answers CVE exposure in seconds. Also surfaces the install-vs-use gap (“you have 67 Adobe seats but only 12 actually opened the app last month”) and surprising external phone-home behavior on supposedly-internal tools.
Business & Enterprise
Daily feed of every new (executable, destination, code-signer) the fleet has never seen before, ranked by spread velocity. Earliest signal of both lateral movement and shadow-IT viral adoption.
Business & Enterprise
Stacked-bar of outbound bytes per cloud / SaaS vendor, sliced by department and over time. Single-pane answer to “how dependent are we on each vendor” and “if AWS us-east-1 vanished, what stops?”
Business & Enterprise
Every agent gets a daily score for how unlike the rest of the fleet its destinations + executables look. The top 1% surfaces as “review this machine.” Cheap pre-filter for SOC analysts.
Business & Enterprise
Version-share distribution across your fleet vs current GA, per common product (Chrome, Firefox, OpenSSL, Java, OpenSSH, Office). “Chrome 110 still on 12 of your 400 machines.” Auditor histogram included.
Business & Enterprise
Per-application unique-machine-per-month counts. “You licensed 50 Adobe seats; 67 distinct machines opened acrobat.exe last month.” Same for Office, Slack, Cursor, Figma. Pays for the tier.
Business & Enterprise
Per-location TCP retransmission rate (link quality) and TCP RST rate (middlebox misbehavior) ranked vs your fleet’s baseline. Catches bad VPN gateways, captive portals, MTU black holes, NAT exhaustion. “Tampa office has 14× normal RST rate” is a network-team buyer’s dream.
Enterprise only
Saturation, drift, rename detection, executable outliers. Living-off-the-land malware persists by impersonating known-good binaries; cross-fleet hash anchoring is the cleanest detection. Needs ~50 agents of baseline.
Enterprise only
Cross-machine search for consistent low-bandwidth periodic outbound connections — the network signature most C2 traffic prints. Catches dormant or staged compromises that single-machine EDR misses. Signature of behavior, not signature of binary.
Enterprise only
Bytes uploaded to each destination country, sliced by department / location tag, over arbitrary time ranges. Filter to “non-EU destinations from EU-tagged agents.” GDPR / Schrems II answered with measurement, no DPI, no content access. Compliance officers will pay for this alone.
Each of these is derivable from data the agent already collects — no new collection, no privacy regression. They’re the analyses that only become valuable when there’s a fleet to analyze, which is why they’re bundled with the tiers that have one.
Every DataStun tenant gets the same model: an AI that knows your fleet answers first, your administrator owns the conversation, and the DataStun team backs it all up when a case needs us. No email, no phone tag, no ticket numbers — the full thread (AI replies, admin notes, our response) lives in your dashboard.
The dashboard’s chat surface understands your tenant — your devices, your destinations, your blocklist activity, your SI Governance numbers — and answers in context. The first reply lands in seconds, not in a ticket queue. Most questions stop here.
If the AI’s answer didn’t land, one click forwards the full conversation (with all the context the AI saw) to your tenant administrator. They can run additional AI assistance themselves or push it to the DataStun team. For Tribe tier the administrator is the household sponsor; for Business and Enterprise it’s your tenant admin.
When the administrator decides a case needs us, they forward it as an escalated request from inside the dashboard. A real human at DataStun reads it, replies in the same thread, and the admin closes the loop with the original user. Enterprise and MSSP tiers receive priority routing on these handoffs.
Product support is not SOC monitoring or MDR. This is help using DataStun. Nobody at DataStun watches your systems around the clock; organizations that need continuous human monitoring, investigation, and response engage an MSSP, MDR provider, or SOC provider separately.
AI handles the volume, humans handle the judgment calls. Every thread is auditable, searchable, and resumable from the dashboard later. Individual tier ends at step 1 (AI plus the community forum); paid tiers carry through to a human at DataStun.
Coming in through a partner or a referral? They can extend a free starting period on the add-ons below; we apply it after you are set up.
Capabilities sold à la carte so you pay only for what you use. Hop Starvation, Speed Test and packet diagnostics are available on Business tier and above; Remote Assist on Tribe and above.
What it does: TTL-based packet lifetime enforcement. Cap the travel distance of packets to any destination so they die before they can reach the internet — distributed across every endpoint and gateway, no middlebox, no single point of failure.
Why it’s worth paying for: Stops lateral movement, data exfiltration, and nation-state reach at the packet layer. Your Oracle database can talk to its local switch and nothing beyond.
Per agent, per month. Pro-rated on enable/disable. Gateway pricing (UCG, MikroTik, Linux routers) available separately.
What it does: N² network performance testing across your fleet — latency, throughput, jitter, packet loss, and traceroute path, each direction, between every pair of agents. 500 agents = 124,750 measurement pairs.
Why it’s worth paying for: Answers “why is the network slow?” with real measurements instead of a shrug. Catches asymmetric routing, VPN under-performance, and ISP shortfalls with evidence you can forward to your vendor.
Per agent, per month. Scheduled baselines + on-demand. Pro-rated on enable/disable.
What it does: The help desk reaches out through the same system that already diagnosed the problem — your own admin, your IT provider, or DataStun support sees the person’s screen and, with their permission, takes the keyboard and mouse to fix it. Same agent, same console, same audit trail; no second remote-support product to deploy.
Consent is absolute. The person at the keyboard says yes each time, sees who is asking and why, sees a banner the whole session, can keep it to viewing only, and can end it at any time. A user’s “never” cannot be overridden by an administrator, a policy, or us. Nothing is recorded.
What it does today: attended remote help for Windows users — screen, mouse, keyboard, several monitors, text clipboard, admin changes the person approves. On Linux and macOS it opens a terminal on the device instead of the screen. Not yet: file transfer, the Windows login screen or elevation prompts, reconnect after a drop, screen sharing on macOS; and the picture is a few frames a second, fine for fixing a setting, not for watching video. We say this up front so you know what you are buying.
Per endpoint, per month, on every endpoint in your tenant — the add-on is turned on for the tenant, not per device, so it is billed on all of them whether or not a given device ever uses it. Off until an administrator turns it on.
What it does: On-demand packet capture from your agents — including both ends of a mesh test — with a per-direction IO graph, TCP expert analysis (retransmissions, dup-ACKs, out-of-order), an in-tenant AI diagnosis, and a downloadable .pcapng you can open in Wireshark.
Nothing to install on your endpoints. The agent captures with what’s already on the device — no Wireshark, no Npcap, no capture drivers pushed to your machines. The capture is brief, scoped to the one test, and removed from the device after upload; all decoding happens server-side inside your tenant.
What an incident is: one problem, one 8-hour session, up to 4 captures — enough to capture both ends of a test, re-run it, and compare. You buy incidents as credits; a credit never expires, and a failed or canceled run refunds itself.
What it costs: $49 per incident, no subscription — you pay only when you use it. Coming in through a DataStun partner or a referral? Ask them about a starter grant of incidents, scaled to your fleet — partners can extend one, and we apply it after you are set up. Credits never expire.
Why it’s worth paying for: The evidence grade that used to require a network engineer with a tap — work that bills $300+/hour when you hire it in — delivered in minutes from wherever your agent is.
Remote Assist is listed above with the per-agent add-ons: $4 per endpoint per month, billed on every endpoint in the tenant, with the person’s consent absolute and a user’s “never” that no administrator can override. Read more →
Common questions about pricing and what fits your situation.
Each device running the DataStun agent — Windows, macOS, or Linux. One install on one machine = one agent. Reinstalling on the same machine doesn’t count as a new agent. Individual covers up to 3 endpoints at $3 each and Tribe up to 33 at $2 each, with no minimum; Business is billed at $5/agent/month (20-agent minimum, no upper cap) based on actual enrolled count.
You’re billed for the actual number of agents enrolled at the end of each billing period. Add an agent mid-month, you’re pro-rated for the partial period. Remove an agent, you stop being billed for it on the next cycle. No surprise overages, no minimum lock-in for the Business tier.
Annual billing is 20% off the per-agent rate ($4/agent/month vs $5/month on Business). You pay 12 months upfront and get 12 months of service. Switch from monthly to annual at any time and the discount applies on the next renewal. The rate you sign up at is the rate you renew at — no first-year teaser, no renewal markup.
Yes, in either direction. Upgrades are immediate; downgrades take effect at the end of your current billing period. Switching tiers never requires re-enrollment of agents — your tenant_id is stable across tier changes.
Threat intelligence sourced from commercial feeds (VirusTotal Enterprise, Recorded Future, etc.) that we license and derive blocklist + grading data from. Business and above tiers receive the derived data; Individual uses public threat sources only. Quality of agent enforcement is the same; commercial-derived data is broader in coverage.
MSSP gives you a single billing relationship across all your managed customers, wholesale per-agent pricing (25–45% below the $5 direct rate), a cross-customer aggregate view for your operators, and white-label dashboards included. Registration and directory listing are free. The math wins from your first managed customer; from there, the volume bands ($3.75 → $3.25 → $2.75) reward growth. Customers who find you through our provider directory carry a +$0.50/agent/mo sourced fee for their first 24 months; customers you bring yourself never do. See the MSSP partner program →
Three reasons: you absorb tier-1 support that we’d otherwise staff for; you commit volume by bringing N customers; and you handle onboarding and configuration. The wholesale rate reflects the work you’re doing on our behalf. It’s the same model CrowdStrike, SentinelOne, Sophos, and Bitdefender use for their MSSP partners.
Pricing applies to your total agent count across all your managed customers, not per-customer. So 5 customers at 30 agents each = 150 total agents, billed at the 100–499 band ($3.25/agent/mo = $487.50/mo). Cross the next threshold and the per-agent rate steps down for all your agents going forward, not just the marginal ones. Annual billing takes the same 20% off the band rate.
Self-hosted ten means your tenant control plane (your dashboard, your data, your agents’ home) runs on your infrastructure. Self-hosted rep means you operate your own threat-intelligence backend that federates with ours. Most customers who self-host pick ten for data residency reasons. Self-hosted rep is for organizations with internal threat-research teams. Both are available on request.
Yes — we offer 50% off Business and Enterprise tiers for registered non-profits, public schools, and accredited universities. Reach out for the verification process.
DataStun pricing starts at $5 per month for an endpoint, $15 per month for a Standard Server, and $30 per month for an Advanced Server. These prices cover the DataStun technology platform. For your own machines, a lab, a family, or a small group: Individual is $3 per endpoint (up to 3) and Tribe $2 per endpoint (up to 33), endpoints only, no minimum.
No. DataStun provides the security technology platform. Organizations with their own security operations center run DataStun through it, with alerts and findings delivered into their existing tooling. Organizations requiring continuous human monitoring, investigation, and response without that team can separately engage an MSSP, MDR provider, or SOC provider.
No. The DataStun subscription covers DataStun technology. Organizations requiring staffed security monitoring can separately engage an MSSP, MDR provider, or SOC provider. In-app product support is help using DataStun, not monitoring of your systems.
Yes. Organizations can operate their own DataStun tenant — through their IT team or their own security operations center, with alerts flowing into the tooling they already run — or delegate responsibility to a security service provider, and switch between the two.
Yes. Customers can authorize an MSSP familiar with DataStun to operate or support their tenant. The MSSP independently determines its services, terms, and pricing.
Your organization retains its DataStun tenant. The MSSP receives delegated responsibility — its operators act as administrators on your tenant, never as its owner — according to the assignment your organization agreed to. Attaching a provider takes both sides’ agreement; detaching is your decision alone.
Yes. Responsibility for a DataStun tenant can be moved from one MSSP to another. Your agents are not re-deployed and your history stays put; the handoff is an account change, and the previous provider’s access ends when the new assignment takes effect.
One provider holds delegated responsibility for a tenant at a time. Alongside that provider, the tenant owner can grant individual seats — admin or member — to people from another firm, for example a specialist incident-response or compliance practice, and revoke them at any time. Broader multi-provider delegation is on our roadmap.
No. MSSPs are independent service providers. Each determines its own services, additional technologies, service levels, contract terms, and pricing. DataStun sets only the price of the DataStun technology.
MSSPs establish their own pricing; DataStun does not set MSSP service prices. Compare providers on capabilities, expertise, service scope, coverage, response capabilities, terms, and price.
MDR providers independently determine their service offerings and pricing. DataStun does not establish MDR service prices.
DataStun observes the machine’s behavior — the services it listens on and the systems communicating with it — and flags machines that behave like servers for your administrator to confirm. Classification reflects the security scope of the workload, not simply the operating system or hardware. A change in class is never applied to your bill silently.
Not every server presents the same security problem. DataStun server tiers consider the diversity of source systems communicating with the server, the executable processes involved in those communications, and the security requirements of the workload and data being protected. Advanced Server is the class for machines your administrator marks mission-critical.
Incidents are $49 each with no subscription; an incident is one problem, one 8-hour session, up to 4 captures, and credits never expire. If you come in through a DataStun partner or a referral, they can extend a starter grant of incidents scaled to your fleet — up to 3 for a fleet under 50 machines and up to 10 at 500 and above — which we apply after you are set up. Ask them.
They can be. A DataStun partner or referrer can extend up to two months free of Hop Starvation, Speed Test and Remote Assist on the agents they cover; we apply it after you are set up, and after that they bill per agent per month at the published rates.
Each one is its own Advanced Server. A load balancer spreads the incoming sources across the machines behind it, but every machine still answers the public internet, runs the application’s processes, and holds the same data — so every one needs, and gets, the full protection. Six nodes behind one balancer are six Advanced Servers at $30 each per month.
A container that serves part of a mission-critical application is an Advanced Server: $30 per container per month, with every IP address the container talks to and is reached from watched the same way as a physical or virtual server. Ten containers behind one balancer are ten Advanced Servers. A container that only runs a background task on a workstation-class host is not charged the server rate; classification follows the security role, not the packaging.
No. Processor speed, memory, storage capacity, and hardware cost do not by themselves determine DataStun server classification.
No. Physical versus virtual deployment does not by itself determine classification. DataStun considers the behavior and security role of the protected system.
Network Detection and Response provides additional network-level visibility, detection, evidence, and investigation capabilities. NDR may be added to a DataStun environment when appropriate, and is independently selected and priced.
Managed Detection and Response combines security technology with operational services provided by security professionals — human monitoring, investigation, escalation, containment, and response. MDR is separate from the DataStun technology subscription; an MSSP or security operations team may use DataStun as part of an MDR service they provide.
Get in touch. The Enterprise tier exists precisely for situations that don’t fit the standard buckets. If you have unusual scale, regulated requirements, or strategic security partnership ambitions, we’ll build the right arrangement.
No. DataStun captures only connection metadata — IP addresses, domain names, ports, protocols, and byte counts. The contents of your communications are never inspected, stored, or disclosed, even in Advanced Packet Diagnostics (which captures headers only by default).
Three agents on the Individual tier. Talk to us about what your team needs and we’ll help you get started.
Partner & affiliate programs available — email [email protected].