How Shield is Priced
Three layers, counted on units you can see, with specialist work scoped separately. Every quotation is built from a scoped count of your real environment.
Three layers, priced three different ways
Shield Platform
A flat monthly fee per organization. 24/7 SOC, monitoring infrastructure, the Shield Portal, detection tuning, reporting and account management.
Shield Coverage
Priced per endpoint, identity, mailbox, sensor, workload, firewall, training seat or GB retained. Scales with your environment, both directions.
Shield Engagements
Penetration testing, vCISO, CMMC readiness, incident response. Always separately scoped, never a hidden line inside a subscription.
What we count, and what we don't
Each service is priced on the unit it protects. If you can't see why you're paying for a quantity, the unit is wrong.
| Service | The unit | Not counted |
|---|---|---|
| Shield MDR Endpoint detection and response | Per endpoint - workstations, laptops, servers and virtual machines running the Shield Agent. | Devices absent for more than 30 consecutive days are not billed. |
| Shield ITDR Identity threat detection | Per identity - Entra ID user accounts and service principals in scope. | Disabled accounts and dormant guest accounts are excluded. |
| Shield Email Protection Email security | Per licensed user mailbox. | Shared, resource and room mailboxes are monitored at no charge. |
| Shield NDR Network detection | Per sensor. | - |
| Shield Cloud Cloud workload monitoring | Per onboarded subscription, account or tenant boundary - not per VM. | - |
| Managed firewall | Per firewall. | A high-availability firewall pair counts as one unit. |
| Security awareness training | Per training seat. | - |
| Log retention | Per GB retained. | - |
When we count it
- Units are counted on the last calendar day of the month.
- Coverage is billed in arrears - you pay for what was actually there.
- The platform fee is billed monthly in advance.
- Mid-month additions start the following month. No surprise proration.
Fair counting, in writing
- Shared, resource and room mailboxes are monitored at no charge - only licensed user mailboxes count.
- Devices absent for more than 30 consecutive days aren't billed; disabled and dormant guest accounts are excluded; a high-availability firewall pair counts as one unit.
- Units are counted on the last calendar day of the month and billed in arrears; the platform fee is billed monthly in advance. Mid-month additions start the following month.
- Annual prepayment of Platform and Coverage charges earns two months free. Engagements are not eligible.
- Every counting rule is stated on your quotation, so your invoice is never a surprise.
Annual prepayment
Annual prepayment of Platform and Coverage charges earns two months free. Engagements are not eligible.
Why we don't publish a per-device rate
A single per-device rate cannot fund a mailbox, a firewall, a network sensor and a penetration test at the same time. Providers who quote one either bill you for quantities that have nothing to do with your risk, or quietly don't deliver the parts that cost the most. We price each service on the unit it protects and scope engagements separately, so both numbers stay honest.
Specialist work - penetration testing, vCISO advisory, CMMC readiness, incident response - is scoped and quoted as a Shield Engagement, never bundled into a subscription tier.
Choose your tier
Tiers differ by telemetry coverage - what we can see and defend - not by an arbitrary feature list.
Essential
Endpoint and email.
Organizations with no external compliance driver.
Professional
Endpoint, identity and email, with network available as an add-on.
Any organization with a CMMC, NIST 800-171 or HIPAA obligation.
Enterprise
Endpoint, identity, email, network and cloud, with custom detection engineering and a named analyst pod.
Complex, multi-site or high-scrutiny environments.
Request a Scoped Quotation
Ready for a SOC behind your business? Tell us about your environment and we will build a scoped Shield quotation from a real count of what needs protecting. We will get back to you within one business day.
Ready for a SOC behind your business?
Contact SOClogix for a scoped Shield quotation. Every quotation is built from a scoped count of your real environment.
We will get back to you within one business day.