Pricing
$4–9 per endpoint-or-user, per month.
Autonomous 24/7 detection, response, and dark-web defense for SMBs. Three tiers covered on this page — pick the surface blend your stack actually runs; one line on your invoice, no add-on pile, no analyst-hour overage. Tiered per endpoint or per user, whichever the surface sets the count on.
Three pricing tiers
Starter
Endpoint-only
The floor for autonomous 24/7 response — endpoint telemetry, autonomous containment, the weekly one-pager.
- Endpoint telemetry — process tree, LSASS, scheduled tasks, persisted services
- Autonomous response — isolate, revoke, block in seconds, not in shifts
- Weekly one-page readout — board-ready language a CIO can paste as-is
- Detection + triage, no analyst-hour line, no analyst-hour overages
- Per-endpoint billing — no seat minimum, no 30-seat commitment
Growth
Endpoints + identity
Pair the device and the Entra ID + on-prem AD account in the same eye-line — without doubling the invoice.
- Everything in Starter — endpoint telemetry, autonomous response, the weekly readout
- Identity telemetry — sign-in anomalies, role drift, MFA exemptions, OAuth grant abuse
- Identity-attributed response — revoke the session the moment the verdict lands
- Weekly readout, identity-attributed — board-ready one-pager that names the surface
- Per-endpoint or per-user billing — billed where the seat actually sits
Complete
The full signal blend
Endpoints + identity + dark-web + cloud config — the four surfaces that actually catch a compromise watched continuously.
- Everything in Growth — endpoints, identity, autonomous response, identity-attributed readout
- Dark-web credential monitoring — forums, paste dumps, stealer logs tied back to the directory
- Cloud + SaaS config drift — M365, AWS, Azure, Google Workspace, including inbox-rule and IAM remediation
- Autonomous response across all four surfaces — isolate, revoke, rotate, or patch-in-place
- Weekly executive readout — covering the four surfaces, not just the endpoint stream
Comparison matrix
What each tier covers, side by side.
Each higher tier includes everything the previous tier covers. The matrix below is where that becomes a checkout-table check, not a deck promise — eight rows, three columns, every row honest on what the SMB gets.
| Feature | Starter$4 | Growth$7 | Complete$9 |
|---|---|---|---|
| Endpoints monitoredProcess tree, LSASS, scheduled tasks, persisted services — autonomous containment in seconds | |||
| Identity (Entra ID + on-prem AD)Sign-in anomalies, role drift, MFA exemptions, OAuth grant abuse | — | ||
| Dark-web credential monitoringForum + paste + stealer-log scrape, tied back to the directory | — | — | |
| Cloud + SaaS config driftM365, AWS, Azure, Google Workspace — IAM, public buckets, inbox rules | — | — | |
| Autonomous response SLAContain under 1 second across the tiers — the metric a concierge SOC cannot match | |||
| Weekly executive readoutOne-page board-ready summary, every Monday — paste-as-is language for the executive review | |||
| Detection + triage, no analyst-hour billNo analyst queues, no hourly overages, no add-on lines | |||
| Per-endpoint or per-user billingNo 30-seat minimum, no $20k/yr add-ons — billed where the seat actually sits |
All prices are per endpoint or user monitored, billed monthly. The autonomous-response SLA holds under-1-second across tiers — the metric a concierge SOC cannot match.
Thought-starters from the SOC
Replace the concierge-SOC contract before the next renewal.
Concierge SOC contracts are uniform in shape because their cost structure is uniform — analyst hours. Vantari is uniform in a different way, because the marginal cost of one more endpoint is compute, not headcount. The items below are the framing one of our SOC analysts would give on a 20-minute call, written so a non-technical CFO can carry them into the renewal conversation.
On the 4-hour MTTR
A concierge SOC with a 4-hour mean time-to-respond has already lost to a credential-stuffing wave that converts in minutes. Vantari contains before the conversion finishes.
On the dark-web add-on
Concierge vendors bill dark-web and identity exposure as a $15k+/yr add-on. Vantari bundles dark-web credential monitoring into Complete, and identity-surface telemetry into Growth.
On the analyst-hour line
Vantari bills per endpoint-or-user, per month — no analyst-hour overage, no quarter-end true-up. The line on your invoice stays the line on your invoice.
On the cloud-drift surface
A misconfigured public S3 bucket or a quietly-added inbox rule is the compromise surface a concierge SOC contracts never caught in time. Vantari surfaces drift on the four surfaces a compromise actually needs.
Still shopping the category
Replace the concierge-SOC contract before the next renewal.
The exact line on your invoice depends on endpoints and seats, but dark-web credential monitoring and autonomous exposure remediation are bundled in — not upsold as add-ons. The 20-minute call we run lands a tailored detection & response plan for your stack and a quote against the line items you are about to renew against.
Direct line vantari-4@polsia.app — we reply within one business day.