Simple Pricing
Simple, Per-Endpoint Pricing
No per-seat fees. No surprise charges. Pay only for what you protect.
Starter
Get started with core protection
Free
Up to 3 endpoints, forever free
- Up to 3 endpoints
- Brute force detection
- Beaconing detection
- DDoS protection
- Basic dashboard
- 7-day event retention
- Community support
- AI/ML scoring
- Kill chain automation
- Fleet management
Most Popular
Growth
Full detection suite for growing teams
$7
per endpoint / month
Choose your endpoint count
- Per-endpoint billing, no caps
- All core detections
- Ransomware, malware, phishing
- AI/ML scoring & shadow models
- Full kill chain automation
- Fleet management
- Evidence bundling
- Email alerts
- 90-day retention
- Standard support (48hr SLA)
Business
Advanced defense for security teams
$12
per endpoint / month
Choose your endpoint count
- Per-endpoint billing, no caps
- Attack isolation & MITRE mapping
- Memory permission analysis
- DNS tunneling detection
- Encrypted connection analysis
- Deception network (honeytokens)
- Threat actor profiling
- Predictive threat modeling
- Containment playbooks
- Forensic evidence preservation
- One-click incident reports
- Live attack visualization
- Plugin API access
- 1-year retention
- Priority support (4hr SLA)
- Dedicated success manager
Enterprise / MSP
Tailored for your organization
Contact Sales
Custom pricing for your fleet
- Unlimited endpoints
- Custom detection rules
- On-premise deployment (available on request)
- Air-gapped environments (available on request)
- Custom integrations
- Custom portal branding (on request)
- Unlimited retention
- 24/7 dedicated support
- Custom SLA
Compare Plans
Feature Comparison
Every feature across every tier, side by side.
| Feature | Starter | Growth | Business | Enterprise / MSP |
|---|---|---|---|---|
| Detection | ||||
| Brute force detection | ✓ | ✓ | ✓ | ✓ |
| Beaconing detection | ✓ | ✓ | ✓ | ✓ |
| DDoS protection | ✓ | ✓ | ✓ | ✓ |
| Ransomware detection | — | ✓ | ✓ | ✓ |
| Malware analysis | — | ✓ | ✓ | ✓ |
| AI & Machine Learning | ||||
| AI/ML scoring | — | ✓ | ✓ | ✓ |
| Shadow model scoring | — | ✓ | ✓ | ✓ |
| Continuous retraining | — | ✓ | ✓ | ✓ |
| Advanced Defense | ||||
| Attack isolation & MITRE mapping | — | — | ✓ | ✓ |
| Memory permission analysis | — | — | ✓ | ✓ |
| DNS tunneling detection | — | — | ✓ | ✓ |
| Deception network | — | — | ✓ | ✓ |
| Operations | ||||
| Kill chain automation | — | ✓ | ✓ | ✓ |
| Fleet management | — | ✓ | ✓ | ✓ |
| Containment playbooks | — | — | ✓ | ✓ |
| Custom detection rules | — | — | — | ✓ |
| On-premise / air-gapped | — | — | — | ✓ |
| Support & Retention | ||||
| Event retention | 7 days | 90 days | 1 year | Unlimited |
| Support | Community | Standard (48hr) | Priority (4hr) | 24/7 dedicated |
| Dedicated success manager | — | — | ✓ | ✓ |
FAQ
Common Questions
Yes. The Starter tier gives you 3 endpoints with core detection capabilities, forever free. No credit card required. No time limits.
You choose how many endpoints to protect at checkout and pay per endpoint per month. Growth is $7/endpoint/month. Business is $12/endpoint/month. Enterprise / MSP is unlimited. No per-seat fees, no per-user fees, no data ingestion fees.
Click the plan button to create your account. For paid plans, you'll choose your endpoint count and go straight to checkout. For Enterprise or MSP pricing, contact our sales team directly.
The Prometheus agent runs on Linux (Ubuntu, Debian, CentOS, RHEL, Amazon Linux) and Windows Server (2016+). macOS support is on the roadmap.
Yes. Contact our sales team for Enterprise / MSP pricing tailored to larger deployments and multi-tenant environments.
The Prometheus agent collects security telemetry: network connections, process activity, authentication events, DNS queries, and file system changes. It runs as a lightweight service (typically under 50MB RAM) and sends event data to the Prometheus backend via HMAC-authenticated API calls. It can also execute containment actions (block IPs, kill processes) when the adaptive detection pipeline identifies a confirmed threat.
Real. Prometheus runs a five-model deep learning ensemble in production: DeepThreatClassifier, BehavioralSequenceModel, MalwareFeatureClassifier, AnomalyAutoencoder, and an EnsembleScorer. Combined 7M+ parameters, trained on 1M+ unique samples from real honeypot data. 99.6% detection accuracy on held-out honeypot test data with independent leakage audits. Models retrain continuously as new attack patterns emerge. These are real models trained on 2.6M+ attack events from live honeypot sensors, running inference on GPU.
Under 5 minutes. Sign up for the free Starter plan (no credit card), run the one-line install command on a Linux or Windows server, and you will see real events flowing into your dashboard within seconds. You can also try the interactive demo without creating an account.
Prometheus is built for autonomous defense from the ground up. Unlike traditional EDR tools that flood you with alerts for manual triage, Prometheus operates a configurable detection-to-response pipeline: detect, enrich with MITRE ATT&CK intelligence, decide severity, respond with containment, isolate the attacker, share intelligence across your fleet, and harden defenses. It is purpose-built for teams that need real protection without a 24/7 SOC. The ML models are trained on real attack data from live honeypot infrastructure, not synthetic benchmarks.