License paths
Pricing is quoted after a qualified evaluation. CaseScope is designed for internal IR teams, consultancies, and MSPs—not enterprise SIEM pricing. Founding-customer pricing is available during evaluation.
Annual
Ongoing production for the licensed organization
Quoted after evaluation from analyst count, deployment scope, and production use. Founding-customer pricing available.
- Who: internal IR and security teams ready for production
- Production evidence allowed
- Term: 12-month subscription
- Installs and analysts as licensed
- Updates during the term
- Licensed production support
Incident
One production investigation
Who: one live production investigation that cannot wait on an annual agreement.
- One case number; multiple affected systems allowed under that case
- Quoted incident window (commonly 14–30 days)
- Analyst count as licensed
- Extensions quoted if the matter continues
- Evidence remains on customer storage after expiry; production use rights end
- Incident fees may be credited toward Annual if converted in an agreed period
Evaluation
Nonproduction product assessment
Synthetic, demonstration, or expressly approved evaluation data only.
- Duration: typically 14 days. Longer periods are approved exceptions with an evaluation plan—not advertised publicly
- Users and hosts as agreed in writing
- No production investigation use
- Evaluation questions via sales, not production SLA
Paid pilot for time-limited real-environment use · MSP / consulting · Education / lab
| License | Intended use | Evidence |
|---|---|---|
| Evaluation | Product assessment and technical validation | Synthetic, demonstration, or expressly approved evaluation data |
| Paid pilot | Time-limited evaluation in a real operating environment | Real evidence under defined terms |
| Incident | One production investigation | Real case evidence |
| Annual | Ongoing production use | Multiple cases within licensed scope |
| MSP | Client-facing production use | Multiple clients/cases under defined limits |
What “Quoted” means: we set a price after evaluation. It is not a hidden enterprise-SIEM number. It reflects analyst count, hosts, and whether use is evaluation, incident, or annual production. Expiration ends production use rights. Customer evidence remains on customer storage. See evaluation terms.