An industry first: Usage-based billing for EDR

LimaCharlie is doing something that has never been done before in cybersecurity. Along with our predictable per endpoint pricing model, we now offer a pure usage-based billing model for our Endpoint Detection & Response (EDR) capability. Pricing within this model is calculated solely on the time the sensor is connected, events processed, and events stored.

Why is this a big deal?

LimaCharlie is solving problems in a general way that scales. Our per endpoint pricing model is unparalleled for the benefits it offers Managed Security Service Providers (MSSPs) and Managed Detection and Response (MDR) providers. It is a dependable way to calculate the cost of deployments without contractual obligations and offers the best price to performance ratio in the market. We acknowledge that some might not need the entirety of available components all the time, and might benefit from having access to an endpoint agent on an adhoc basis. This approach enables the following.

1. Incident responders will now be able to offer pre-deployments to their customers at almost zero cost. That is, they can deploy across an organization's entire fleet and lay dormant in ‘sleeper mode’ for pennies on the dollar. With agents deployed ahead of an incident, responders can offer SLA’s that their competition can’t conceive of. Respond with the full power of the platform within minutes of an incident occurring.

2. Product developers can take advantage of usage-based billing to leverage narrow bands of functionality at a low cost. This means getting the functionality you need without building it from the ground up or paying for a full EDR deployment: keep more of your margins. At this point, no one else is considering this, and we are so excited to see what people build.

What does pricing look like?

As mentioned initially, there are several dimensions across which usage-based pricing is calculated but the big change is per endpoint pricing. Under the new model deploying an agent in ‘sleeper mode’ is essentially free - the only required cost is sensor connected time which works out to a nominal fee per agent per month. A breakdown of the specific axis as to how usage of the endpoint agent is calculated is as follows.

1. Sensor connected time: the number of seconds a sensor is connected to the LimaCharlie cloud. As demonstrated below, we keep this cost as low as possible to make the service accessible.

2. Events processed: when an event is received from the sensor and processed by LimaCharlie. You are in complete control of this through the use of the Exfil Service, allowing you to specify the events you need. We also have smart mechanisms available that will help reduce usage events further.

3. Events retained: if using the LimaCharlie retention, visualization, and searching service (highly recommended), each event retained (for an entire year) is counted with this metric.

That’s it. We have other services that are already usage-based by nature and those don’t change. But with these 3 metrics, you no longer have to pay a base price for a sensor.

As has always been the case, additional costs for Artifact Ingestion can be found on our pricing page.

How do I get started?

Usage-based billing is currently only available for new organizations and on a limited basis. Please contact us for more information and to get a new organization set up for usage-based billing.