Pricing

Pricing Built for Mid-Market Security Teams

Start free. Scale when you need to. No SIEM contract. No per-endpoint pricing that blows up at 1,000 assets. ThretVyn does not replace your SIEM — pricing reflects correlation capacity, not log volume.

Monthly

Save 17%

Essentials

$299 / month

Up to 500 assets

For security practitioners and early-stage SOC teams establishing a correlation baseline. Validate kill-chain detection coverage before committing to full deployment.

EDR + cloud-trail ingestion
Kill-chain correlation engine (200+ patterns)
Up to 3 data source integrations
Email escalation alerts
14-day data retention
Community support

Start Free Trial

Most Popular

Growth

$899 / month

Up to 2,500 assets

For operational SOC teams running 24/7 correlation across their full stack. Includes identity log correlation and bidirectional SIEM connector — ThretVyn feeds your Splunk or Sentinel, not the other way around.

Everything in Essentials
Identity log correlation
Up to 10 data source integrations
SIEM connector (Splunk / Sentinel)
Slack + PagerDuty escalation
90-day data retention
Priority email + chat support
SOC workflow templates

Start Free Trial

Enterprise

Custom

Unlimited assets

For security teams requiring custom integration depth, extended data retention, and dedicated onboarding. Includes custom SOAR connector build and on-site setup from Reston, VA or remote.

Everything in Growth
Unlimited data source integrations
Custom retention (up to 1 year)
SSO / SAML authentication
Dedicated implementation support
SLA: 99.9% uptime guarantee
Custom SIEM / SOAR integrations
On-site onboarding (Reston VA or remote)

Contact Sales

What counts as an asset?

Can I keep my existing SIEM?

Is there a free trial?

How is data handled and where is it stored?

ThretVyn ingests normalized event metadata — not raw logs or PII. We store event type, technique code, entity identifiers, timestamps, and source attribution. We do not store raw endpoint disk contents, S3 object payloads, passwords, or session tokens. All data is processed and stored in US-based infrastructure (AWS us-east-1). Data is encrypted at rest using AES-256 and in transit using TLS 1.3. See our Security page for full architecture details.

How long does integration take?

Most customers connect their first data source in under 15 minutes. A CrowdStrike Falcon integration requires one Streaming API credential and takes about 8 minutes end-to-end. AWS CloudTrail via EventBridge takes 10–12 minutes to configure. Okta System Log via read-only API token takes under 5 minutes. Full three-source coverage — EDR, cloud, and identity — is typically complete within the first 30 minutes of your trial. ThretVyn does not require professional services to get operational.

Is ThretVyn SOC 2 certified?

ThretVyn is designed with SOC 2 security controls as a guiding framework — including encryption at rest and in transit, role-based access control with least-privilege enforcement, and a documented incident response procedure. We are an independently built early-stage company; formal third-party SOC 2 Type II audit certification is on our roadmap. See our Security page for detailed controls documentation.

Does ThretVyn replace our SOAR platform?

No. ThretVyn is a correlation and escalation layer — it surfaces confirmed kill-chain sequences to your analysts. It does not execute SOAR playbooks, isolate endpoints, revoke credentials, or take automated remediation actions. If you run Splunk SOAR, Torq, or Tines, ThretVyn integrates as an alert source via PagerDuty or webhook. ThretVyn does not perform incident response.

What alert volume should we expect after deployment?

In typical mid-market deployments with 300–2,500 monitored assets across EDR, cloud, and identity sources, customers see 15–20 high-confidence escalations per day — down from 400–700 raw EDR alerts. During initial baseline learning (first 48–72 hours), some false positives from environmental noise are expected while entity baselines are established. The suppression rate stabilizes after the first week of operation.

See What 97% Noise Suppression Looks Like on Your Stack

14-day free trial. Connect CrowdStrike, AWS CloudTrail, or Okta in under 15 minutes. No credit card required.

Start Free Trial Talk to Sales

Pricing Built for Mid-Market Security Teams

Simple, Transparent Pricing

Frequently Asked Questions

See What 97% Noise Suppression Looks Like on Your Stack