Predictable pricing. EU-grade guarantees.
From 3 devices to unlimited. Every plan ships with the NetSenX Math Guarantee (a split-conformal false-positive bound, reported at the level your own calibration data supports), EU data residency, and signed releases. Seats from 1 on Free to unlimited on Enterprise, no telemetry tax.
Annual billing = two months free. Cancel anytime. Prices exclude VAT.
Choose your plan
Every plan includes the NetSenX Math Guarantee, EU data residency, AES-256-GCM at rest, and Sigstore-signed releases. Upgrade or downgrade at any time.
Free
Start free — up to 3 devices
Core behavioural detection
- Up to 1 user
- 30-day alert history
- No reports (AI Act instructions for use included)
- NQCI crypto inventory — previewUpgrade to unlock
Solo
One person, one machine — exactly 1 device
Extended behavioural detection, as in Starter
- Up to 1 user
- 60-day alert history
- Operational reports (NIS2 incident, GDPR, monthly, MITRE); audit pack with annual billing
- Manual response actions
- NQCI crypto inventory — previewUpgrade to unlock
Exactly 1 device and one user, with no device add-on — fewer devices than Free (3), which has core detection only. Need more than one device? Starter is the right plan.
Starter
Small teams — up to 10 devices
Extended behavioural detection
- Up to 5 users
- 60-day alert history
- Operational reports (NIS2 incident, GDPR, monthly, MITRE); audit pack with annual billing
- Manual response actions
- NQCI crypto inventory — previewUpgrade to unlock
Pro
Growing SMB — up to 25 devices
Advanced behavioural detection + OT/ICS
- Up to 15 users
- 90-day alert history
- All reports including the audit pack
- Automatic response recommendations
- REST API access
- OT/ICS coverage
- NQCI crypto inventory & post-quantum key-exchange visibility (needs packet capture: Linux agent or SPAN/TAP sensor)
Business
Mid-market & multi-site — up to 100 devices
Everything in Pro + cryptographic attack detection
- Up to 50 users
- 365-day alert history
- All reports including the audit pack
- SIEM export
- Breach & attack simulation
- NQCI crypto inventory & post-quantum key-exchange visibility (needs packet capture: Linux agent or SPAN/TAP sensor)
Enterprise
MSSP & large networks — unlimited devices
Full behavioural detection suite
- Unlimited users
- Unlimited alert history
- All reports including the audit pack
- Custom detection policies
- White-label & on-premise deployment
- NQCI crypto inventory & post-quantum key-exchange visibility (needs packet capture: Linux agent or SPAN/TAP sensor)
All prices in EUR, exclude VAT. Annual plans are billed once per year and equal 10× the monthly rate (two months free).
A device is a host running the NetSenX agent. One agent on a SPAN or TAP port monitors a whole network segment and counts as one device.
Compare every feature
The full matrix. No asterisks, no “contact us for details” on standard plans. Scroll horizontally on small screens.
Free and Solo cover the computers NetSenX is installed on (Solo: one computer). A network sensor (SPAN/TAP) starts with Starter.
| Feature | Free | Solo | Starter | Pro | Business | Enterprise |
|---|---|---|---|---|---|---|
| Detection | ||||||
| Devices | 3 | 1 — no add-on | 10 | 25 | 100 | Unlimited |
| Users | Up to 1 user | Up to 1 user | Up to 5 users | Up to 15 users | Up to 50 users | Unlimited users |
| Alert history | 30-day alert history | 60-day alert history | 60-day alert history | 90-day alert history | 365-day alert history | Unlimited alert history |
| Detection level | Core behavioural detection | Extended behavioural detection, as in Starter | Extended behavioural detection | Advanced behavioural detection + OT/ICS | Everything in Pro + cryptographic attack detection | Full behavioural detection suite |
| DNS tunnelling detection | ||||||
| NetSenX Layer 3 Graph Intelligence | ||||||
| NetSenX TLS Fingerprint Engine | ||||||
| NetSenX AI Analyst Core | ||||||
| NetSenX Math Guarantee (conformal false-positive bound) | ||||||
| Rogue Agent Detection | ||||||
| Operations | ||||||
| Alert channels | Email, Slack & webhook | Email, Slack & webhook | Email, Slack & webhook | |||
| Dashboard access | ||||||
| REST API access | ||||||
| Manual response actions | ||||||
| Automatic response recommendations; host isolation via approval | ||||||
| Custom integrations | Limited | Full | ||||
| Custom detection policies | ||||||
| White-label, on-premise & perpetual license | ||||||
| Security & data | ||||||
| Audit log retention | 90 days | 180 days | 180 days | 1 year | 2 years | 3 years |
| SIEM export | ||||||
| OT/ICS coverage | ||||||
| EU data residency | ||||||
| AES-256-GCM at rest | ||||||
| SSO / SAML | ||||||
| Sigstore signed releases | ||||||
| Compliance | ||||||
| Reports | Not included on Free | Included | Included | Included | Included | Included |
| Audit pack (NIS2 quarterly dossier, AI Act documents, SOC 2/ISO, board summary) | – | annual billing | annual billing | ✓ | ✓ | ✓ |
| GDPR, NIS2, CRA & AI Act evidence | ||||||
| Compliance reports cadence | Quarterly | Monthly | Real-time + audit pack | |||
| Triple Crown evidence pack (SOC 2 + ISO 42001 + ISO 27001) | ||||||
| DPA + sub-processors list | ||||||
| Support | ||||||
| Support | Community | Email + Chat | Priority | Dedicated CSM | ||
| SLA | 99.9% target | 99.9% target | 99.9% target | |||
| Onboarding | Self-serve | Self-serve | Self-serve | Self-serve + guide | Onboarding call | Dedicated implementation |
Which plan covers what you need?
Enter how you will watch the network and tick what you need. The smallest plan that covers all of it is highlighted. Every value comes from the same plan catalog as the table above.
Free
€0
Solo
€19
Starter
€49
Pro
€99
Business
€249
Enterprise
from €999
Price per month
Devices: 1, users: 1. The smallest plan that covers all of it is Free.
- Devices
- 3
- People who sign in
- 1
- Alert history
- 30 days
Show the plans and needs as a table
| Feature | Free | Solo | Starter | Pro | Business | Enterprise |
|---|---|---|---|---|---|---|
| Price per month | €0 | €19 | €49 | €99 | €249 | from €999 |
| Devices | 3 | 1 | 10 | 25 | 100 | Unlimited |
| Users | 1 | 1 | 5 | 15 | 50 | Unlimited |
| Alert history | 30 days | 60 days | 60 days | 90 days | 365 days | Unlimited |
| DNS tunnelling detection: data hidden inside DNS queries | Included | Included | Included | Included | Included | Included |
| PDF reports for auditors and management | Not included | Included | Included | Included | Included | Included |
| TLS handshake fingerprinting, with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor | Not included | Included | Included | Included | Included | Included |
| OT and industrial protocols (Modbus/TCP, S7comm and others) | Not included | Not included | Not included | Included | Included | Included |
| Shadow AI: traffic from your devices to AI services | Not included | Not included | Not included | Included | Included | Included |
| Post-quantum and SSH inventory (NQCI): active from Professional with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor; the basic macOS mode does not see handshakes | Not included | Not included | Not included | Included | Included | Included |
| REST API access | Not included | Not included | Not included | Included | Included | Included |
| Alerts to Slack or a webhook | Not included | Not included | Not included | Included | Included | Included |
| SIEM export | Not included | Not included | Not included | Not included | Included | Included |
| White label under your own brand | Not included | Not included | Not included | Not included | Not included | Included |
| On-premises installation | Not included | Not included | Not included | Not included | Not included | Included |
The evidence that will exist after an incident
Insurers, authorities and auditors ask for records after an incident, and the records have to exist before it. Pick who asks and a plan: the list shows what NetSenX keeps, how far back it goes, and what has to come from elsewhere.
An insurer handling a claim wants to know when the incident started, which systems it touched and what you did about it, with times. (Free: Alert timeline: what was seen, on which host, when 30 days; Audit log: alerts, analyst decisions and configuration changes 90 days)
- Alert timeline: what was seen, on which host, whenasked for30 days
- Audit log: alerts, analyst decisions and configuration changesasked for90 days
- NIS2 incident deadlines trackedIncluded
- GDPR Article 33 breach notification draft for your DPOfrom Starter
- Network map: devices seen on monitored segmentsasked forIncluded
- PDF report of the incidentfrom Starter
- What ran on each computer: processes and filesasked forNot from NetSenX: comes from your endpoint protection (EDR)
- Sign-ins and password useNot from NetSenX: comes from your identity provider and VPN logs
- Backup and restore recordsasked forNot from NetSenX: comes from your backup system
- E-mail headers and contentNot from NetSenX: comes from your mail system
Show the records per plan as a table
| Record | Provided by | Free | Solo | Starter | Pro | Business | Enterprise |
|---|---|---|---|---|---|---|---|
| Alert timeline: what was seen, on which host, when | NetSenX | 30 days | 60 days | 60 days | 90 days | 365 days | Unlimited |
| Audit log: alerts, analyst decisions and configuration changes | NetSenX | 90 days | 180 days | 180 days | 365 days | 730 days | 1095 days |
| NIS2 incident deadlines tracked | NetSenX | Included | Included | Included | Included | Included | Included |
| GDPR Article 33 breach notification draft for your DPO | NetSenX | from Starter | Included | Included | Included | Included | Included |
| Network map: devices seen on monitored segments | NetSenX | Included | Included | Included | Included | Included | Included |
| PDF report of the incident | NetSenX | from Starter | Included | Included | Included | Included | Included |
| What ran on each computer: processes and files | your endpoint protection (EDR) | — | — | — | — | — | — |
| Sign-ins and password use | your identity provider and VPN logs | — | — | — | — | — | — |
| Backup and restore records | your backup system | — | — | — | — | — | — |
| E-mail headers and content | your mail system | — | — | — | — | — | — |
Records a network sensor does not produce stay in the list on purpose: an evidence pack is only as complete as its weakest source. Retention values come from the plan catalog; the audit-log value is the plan's default.
Enterprise, regulated industries, or more than 100 devices?
We support EU CISOs in finance, healthcare, public sector, and critical infrastructure with custom commercial terms and the same detection engine on every tier. Every Enterprise engagement ships with a dedicated CSM and an audit-pack ready for your next ISO, NIS2, or DORA review.
Response time: within 1 business day. EU-based account team.
Custom contracts
MSA, DPA, EU SCC, and procurement workflows tailored to your legal team.
Dedicated CSM
Named customer success manager, quarterly reviews, and direct engineering escalation.
Audit-pack-ready compliance
Triple Crown evidence pack (SOC 2 + ISO 42001 + ISO 27001) and real-time auditor exports.
Frequently asked questions
Short, factual answers. Need something specific? Ask our team.
You choose the deployment: a single SPAN/TAP port on your switch watches a whole network segment and counts as one device, or install the NetSenX agent on the specific hosts you choose. Both are documented; no kernel modules. On Linux the installer only installs a package whose signature matches the NetSenX release key, and refuses anything else; macOS agents are set up together with NetSenX support.
Customer telemetry and alerts are stored exclusively in the EU — EU-region object storage and EU-region Postgres, encrypted at rest with AES-256-GCM. Stripe (payments) processes data in the USA, and several of our providers are US-incorporated; both are covered by EU Standard Contractual Clauses. Some AI Analyst capabilities may use a provider outside the EU only with your explicit consent. A full sub-processor list is published with our DPA.
There is no separate trial period. Every new account starts on the Free plan — up to 3 devices, no credit card required, no time limit. Free protects the computers the agent is installed on; monitoring a network segment with a SPAN or TAP sensor starts with Starter. Upgrade to a paid plan whenever you need more capacity; plan changes apply immediately.
On Business and Enterprise tiers, you can register an AWS KMS or HashiCorp Vault key with your tenant through our BYOK API.
It guarantees a method, applied to your data, and full visibility into what that method currently supports. A split-conformal layer derives a false-positive bound on the alerts the engine surfaces, at a configurable confidence level, from analyst-labelled benign traffic in your own tenant. A finite calibration set can only resolve a bound so tight, so the dashboard shows the bound your data supports — and states that it supports none yet, together with what would close the gap, rather than displaying a figure we cannot back. The methodology is documented in our Trust Center and is independently reviewable.
Enterprise customers receive evidence mapped to SOC 2 Type I (in progress), ISO 42001 (AI management), and ISO 27001. Each control includes timestamped artifacts, sub-processor attestations, and an exportable auditor view, refreshed on a real-time cadence.
Yes. The Business and Enterprise onboarding includes a structured cut-over: parallel running for two weeks, alert taxonomy mapping, and analyst playbook migration.
Yes. Verified non-profits, universities, and accredited research labs receive 50% off Starter and Pro tiers, or extended Free-tier device caps. Email sales@netsenx.com with verification.
Credit and debit cards (Visa, Mastercard, AmEx), SEPA Direct Debit on annual plans, and bank transfer for Business and Enterprise contracts. All processed through EU payment providers that hold PCI-DSS certification; the certification is the provider's, not NetSenX's.
Annual plans on Business and Enterprise can be invoiced with Net-30 terms. Starter and Pro annual plans can request manual invoicing on approval. Every payment generates a VAT-compliant invoice automatically.
Yes: Solo, at €19 per month or €190 per year (prices exclude VAT), for exactly 1 device and one user. It has Starter's detection, reports and 60-day alert history, without team management. It protects the computer the agent is installed on; monitoring a network segment with a SPAN or TAP sensor starts with Starter. Solo has no device add-on and covers fewer devices than the Free plan (3); from two devices up, Starter at €49 per month is the right plan. Solo is a business plan: like every NetSenX plan it is sold to businesses, freelancers and sole traders buying for their work, not to consumers.