Pricing

Predictable pricing. EU-grade guarantees.

From 3 devices to unlimited. Every plan ships with the NetSenX Math Guarantee (a split-conformal false-positive bound, reported at the level your own calibration data supports), EU data residency, and signed releases. Seats from 1 on Free to unlimited on Enterprise, no telemetry tax.

Save 2 months

Annual billing = two months free. Cancel anytime. Prices exclude VAT.

Choose your plan

Every plan includes the NetSenX Math Guarantee, EU data residency, AES-256-GCM at rest, and Sigstore-signed releases. Upgrade or downgrade at any time.

Free

Start free — up to 3 devices

€0Forever free, no card required

Core behavioural detection

  • Up to 1 user
  • 30-day alert history
  • No reports (AI Act instructions for use included)
  • NQCI crypto inventory — previewUpgrade to unlock

Solo

One person, one machine — exactly 1 device

€190/yrEquivalent to €15.83/mo — save €38 a year

Extended behavioural detection, as in Starter

  • Up to 1 user
  • 60-day alert history
  • Operational reports (NIS2 incident, GDPR, monthly, MITRE); audit pack with annual billing
  • Manual response actions
  • NQCI crypto inventory — previewUpgrade to unlock

Exactly 1 device and one user, with no device add-on — fewer devices than Free (3), which has core detection only. Need more than one device? Starter is the right plan.

Starter

Small teams — up to 10 devices

€490/yrEquivalent to €40.83/mo — save €98 a year

Extended behavioural detection

  • Up to 5 users
  • 60-day alert history
  • Operational reports (NIS2 incident, GDPR, monthly, MITRE); audit pack with annual billing
  • Manual response actions
  • NQCI crypto inventory — previewUpgrade to unlock
Recommended

Pro

Growing SMB — up to 25 devices

€990/yrEquivalent to €82.50/mo — save €198 a year

Advanced behavioural detection + OT/ICS

  • Up to 15 users
  • 90-day alert history
  • All reports including the audit pack
  • Automatic response recommendations
  • REST API access
  • OT/ICS coverage
  • NQCI crypto inventory & post-quantum key-exchange visibility (needs packet capture: Linux agent or SPAN/TAP sensor)

Business

Mid-market & multi-site — up to 100 devices

€2,490/yrEquivalent to €207.50/mo — save €498 a year

Everything in Pro + cryptographic attack detection

  • Up to 50 users
  • 365-day alert history
  • All reports including the audit pack
  • SIEM export
  • Breach & attack simulation
  • NQCI crypto inventory & post-quantum key-exchange visibility (needs packet capture: Linux agent or SPAN/TAP sensor)

Enterprise

MSSP & large networks — unlimited devices

from €9,990/yrEquivalent to €832.50/mo — save €1,998 a year

Full behavioural detection suite

  • Unlimited users
  • Unlimited alert history
  • All reports including the audit pack
  • Custom detection policies
  • White-label & on-premise deployment
  • NQCI crypto inventory & post-quantum key-exchange visibility (needs packet capture: Linux agent or SPAN/TAP sensor)

All prices in EUR, exclude VAT. Annual plans are billed once per year and equal 10× the monthly rate (two months free).

A device is a host running the NetSenX agent. One agent on a SPAN or TAP port monitors a whole network segment and counts as one device.

Compare every feature

The full matrix. No asterisks, no “contact us for details” on standard plans. Scroll horizontally on small screens.

Free and Solo cover the computers NetSenX is installed on (Solo: one computer). A network sensor (SPAN/TAP) starts with Starter.

NetSenX feature comparison across Free, Solo, Starter, Pro, Business, and Enterprise plans.
FeatureFreeSoloStarterProBusinessEnterprise
Detection
Devices31 — no add-on1025100Unlimited
UsersUp to 1 userUp to 1 userUp to 5 usersUp to 15 usersUp to 50 usersUnlimited users
Alert history30-day alert history60-day alert history60-day alert history90-day alert history365-day alert historyUnlimited alert history
Detection levelCore behavioural detectionExtended behavioural detection, as in StarterExtended behavioural detectionAdvanced behavioural detection + OT/ICSEverything in Pro + cryptographic attack detectionFull behavioural detection suite
DNS tunnelling detection
NetSenX Layer 3 Graph Intelligence
NetSenX TLS Fingerprint Engine
NetSenX AI Analyst Core
NetSenX Math Guarantee (conformal false-positive bound)
Rogue Agent Detection
Operations
Alert channelsEmailEmailEmailEmail, Slack & webhookEmail, Slack & webhookEmail, Slack & webhook
Dashboard access
REST API access
Manual response actions
Automatic response recommendations; host isolation via approval
Custom integrationsLimitedFull
Custom detection policies
White-label, on-premise & perpetual license
Security & data
Audit log retention90 days180 days180 days1 year2 years3 years
SIEM export
OT/ICS coverage
EU data residency
AES-256-GCM at rest
SSO / SAML
Sigstore signed releases
Compliance
ReportsNot included on FreeIncludedIncludedIncludedIncludedIncluded
Audit pack (NIS2 quarterly dossier, AI Act documents, SOC 2/ISO, board summary)–annual billingannual billing✓✓✓
GDPR, NIS2, CRA & AI Act evidence
Compliance reports cadenceQuarterlyMonthlyReal-time + audit pack
Triple Crown evidence pack (SOC 2 + ISO 42001 + ISO 27001)
DPA + sub-processors list
Support
SupportCommunityEmailEmailEmail + ChatPriorityDedicated CSM
SLA99.9% target99.9% target99.9% target
OnboardingSelf-serveSelf-serveSelf-serveSelf-serve + guideOnboarding callDedicated implementation

Which plan covers what you need?

Enter how you will watch the network and tick what you need. The smallest plan that covers all of it is highlighted. Every value comes from the same plan catalog as the table above.

A device is a host running the NetSenX agent. One agent on a SPAN or TAP port monitors a whole network segment and counts as one device.
What you need

Free

€0

Solo

€19

Starter

€49

Pro

€99

Business

€249

Enterprise

from €999

Price per month

Devices: 1, users: 1. The smallest plan that covers all of it is Free.

Devices
3
People who sign in
1
Alert history
30 days
Show the plans and needs as a table
FeatureFreeSoloStarterProBusinessEnterprise
Price per month€0€19€49€99€249from €999
Devices311025100Unlimited
Users1151550Unlimited
Alert history30 days60 days60 days90 days365 daysUnlimited
DNS tunnelling detection: data hidden inside DNS queriesIncludedIncludedIncludedIncludedIncludedIncluded
PDF reports for auditors and managementNot includedIncludedIncludedIncludedIncludedIncluded
TLS handshake fingerprinting, with the packet-capture sensor on a Linux agent or a SPAN/TAP sensorNot includedIncludedIncludedIncludedIncludedIncluded
OT and industrial protocols (Modbus/TCP, S7comm and others)Not includedNot includedNot includedIncludedIncludedIncluded
Shadow AI: traffic from your devices to AI servicesNot includedNot includedNot includedIncludedIncludedIncluded
Post-quantum and SSH inventory (NQCI): active from Professional with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor; the basic macOS mode does not see handshakesNot includedNot includedNot includedIncludedIncludedIncluded
REST API accessNot includedNot includedNot includedIncludedIncludedIncluded
Alerts to Slack or a webhookNot includedNot includedNot includedIncludedIncludedIncluded
SIEM exportNot includedNot includedNot includedNot includedIncludedIncluded
White label under your own brandNot includedNot includedNot includedNot includedNot includedIncluded
On-premises installationNot includedNot includedNot includedNot includedNot includedIncluded

The evidence that will exist after an incident

Insurers, authorities and auditors ask for records after an incident, and the records have to exist before it. Pick who asks and a plan: the list shows what NetSenX keeps, how far back it goes, and what has to come from elsewhere.

An insurer handling a claim wants to know when the incident started, which systems it touched and what you did about it, with times. (Free: Alert timeline: what was seen, on which host, when 30 days; Audit log: alerts, analyst decisions and configuration changes 90 days)

  • Alert timeline: what was seen, on which host, whenasked for30 days
  • Audit log: alerts, analyst decisions and configuration changesasked for90 days
  • NIS2 incident deadlines trackedIncluded
  • GDPR Article 33 breach notification draft for your DPOfrom Starter
  • Network map: devices seen on monitored segmentsasked forIncluded
  • PDF report of the incidentfrom Starter
  • What ran on each computer: processes and filesasked forNot from NetSenX: comes from your endpoint protection (EDR)
  • Sign-ins and password useNot from NetSenX: comes from your identity provider and VPN logs
  • Backup and restore recordsasked forNot from NetSenX: comes from your backup system
  • E-mail headers and contentNot from NetSenX: comes from your mail system
Show the records per plan as a table
RecordProvided byFreeSoloStarterProBusinessEnterprise
Alert timeline: what was seen, on which host, whenNetSenX30 days60 days60 days90 days365 daysUnlimited
Audit log: alerts, analyst decisions and configuration changesNetSenX90 days180 days180 days365 days730 days1095 days
NIS2 incident deadlines trackedNetSenXIncludedIncludedIncludedIncludedIncludedIncluded
GDPR Article 33 breach notification draft for your DPONetSenXfrom StarterIncludedIncludedIncludedIncludedIncluded
Network map: devices seen on monitored segmentsNetSenXIncludedIncludedIncludedIncludedIncludedIncluded
PDF report of the incidentNetSenXfrom StarterIncludedIncludedIncludedIncludedIncluded
What ran on each computer: processes and filesyour endpoint protection (EDR)——————
Sign-ins and password useyour identity provider and VPN logs——————
Backup and restore recordsyour backup system——————
E-mail headers and contentyour mail system——————

Records a network sensor does not produce stay in the list on purpose: an evidence pack is only as complete as its weakest source. Retention values come from the plan catalog; the audit-log value is the plan's default.

Enterprise, regulated industries, or more than 100 devices?

We support EU CISOs in finance, healthcare, public sector, and critical infrastructure with custom commercial terms and the same detection engine on every tier. Every Enterprise engagement ships with a dedicated CSM and an audit-pack ready for your next ISO, NIS2, or DORA review.

Response time: within 1 business day. EU-based account team.

  • Custom contracts

    MSA, DPA, EU SCC, and procurement workflows tailored to your legal team.

  • Dedicated CSM

    Named customer success manager, quarterly reviews, and direct engineering escalation.

  • Audit-pack-ready compliance

    Triple Crown evidence pack (SOC 2 + ISO 42001 + ISO 27001) and real-time auditor exports.

Frequently asked questions

Short, factual answers. Need something specific? Ask our team.