Pricing & Packaging

Built for the Way You Deliver Services

Three ways to consume one investigation platform. Start where your work is today. Extend as your services grow.

Buying Investigation Shouldn't Work Against Your Business Model

Most investigation platforms are priced for enterprises that own one environment. Service providers scope by case, win by customer and bill by service.

We recognise that IR cases, retainer work and MDR services are billed differently, so we price them differently.

The Opportunity

Consume Investigation the Way
You Sell It

Match the platform to your delivery model so cost moves with the work, not ahead of it.

Commit Nothing Up Front

Case-based consumption means no asset forecast before an engagement begins.

Scope Follows the Evidence

Unlimited asset coverage within the case, so an investigation can expand without a commercial conversation.

Turn Response Into Recurring Revenue

Extend from reactive engagements into retained readiness and assurance services.

Grow Without Re-Platforming

Move between models as your services expand. The platform underneath stays the same.

The Packages

Reactive, Retained or Continuous

The same investigation platform, consumed three ways. Each package maps to a delivery model you already run.

Reactive IR — Triggered, per case

  • For case-driven response: DFIR practices, IR consultancies and insurance panel firms.
  • Unlimited assets within the case window. Nothing to forecast, nothing committed before the case exists.
  • An incident and a compromise assessment are the same unit of work.

Outcome: lower-friction new business and more cases per investigator.

Retainer IR — In place, per retained customer

  • For providers whose retained customers expect readiness, not just a number to call.
  • Pre-deployed across the customer estate before anything happens, at any asset count.
  • Scheduled baselines catch environmental drift between engagements.

Outcome: investigation starts in the first hour, and one-off engagements become recurring revenue.

MDR+ — Continuous, per endpoint

  • For providers running continuous detection and response, where investigation is part of the service.
  • Proactive and reactive work with no discrete trigger. API access included.
  • One evidence trail from alert validation through to declared incident response.

Outcome: escalations resolved inside the SOC, and a premium tier above monitoring.

Start Where Your Work Is Today

Work arrives as an engagement? Start with Reactive IR.

Winning retainers? Add Retainer IR for those customers.

Investigation is continuous? MDR aligns cost with the service you already sell.

Moving between models does not mean moving platforms.

Nothing to Forecast Unlimited assets within the case window.

6–8 Hours

to 1–2 To investigate a single machine, end to end.

< 15 Minutes

Turn security alerts into actionable understanding.

Weeks to Hours

Overall investigation time on a live incident.

10X Faster

Evidence acquisition and triage across an estate.

2X Customers

Same Team. Deliver deeper investigation at managed-service scale.

Testimonials

Industry Leaders who Rely on Us

With AIR, when an incident happens, we get the answers. It’s as simple as that.

Andrew Haslett, Director of Security Services

We can investigate as far as EDR allows, but it does not pick up the same things that Binalyze does.

Joe Tinney, Vice President of Cyber Operations

Integrations

Bring forensic depth into SOC investigation workflows

AIR works alongside the existing security stack, adding forensic evidence and investigative context to the workflows your analysts already use. Every package includes the full investigation workflow — acquire, analyse, investigate and report — across Windows, macOS, Linux and cloud.

ROI

Deliver More Value From Every Investigation.

See what it is worth to you. Enter your case volume and hours per machine, and the ROI calculator shows the capacity and margin the same team can recover.