Priced to be budgeted, not negotiated for weeks.
Two ways to buy: the Platform as a subscription (per endpoint), and fixed-fee Services with a scope and price agreed before work begins. No hourly billing on defined work, no scope-creep invoices. Talk to us for a firm quote against your environment.
Three editions.
Visibility
The endpoint sensor + discovery console: full AI inventory across eleven signal classes, risk scoring, compliance mapping, audit trail. For teams starting an AI-governance program.
Alert
Adds Jira and ServiceNow ticketing and SIEM export, plus the red-team and change-risk modules. Slack and Teams alerts are a free add-on on any plan. For teams operating AI risk day to day.
Enforce & scale
Everything in Discover + Warn, plus the content-DLP policy engine, endpoint enforcement (generally available on Linux), SSO and SCIM, ownership sync, every connector family, and in-VPC deployment in your own AWS account by arrangement. Roadmap Data-residency pinning and Roadmap zero-egress deployment are planned. For regulated and large fleets.
Fleet cost scales with endpoint count and edition, with volume and annual-commit discounts, and non-profit/startup rates are available. We’ll size a firm number to your environment on the scoping call — weigh it against the analyst time you get back.
One enrolled host running the discovery sensor — a Windows 10/11 or Windows Server, macOS or Linux laptop, desktop, server or cloud VM. One host = one endpoint, whoever uses it. Cloud-connector discovery (AWS, Google Cloud and Azure; Oracle Cloud tenancy discovery is in beta) is scoped at the estate level, not billed per cloud resource. Priced per month on a one-year contract and billed annually; each edition carries an annual platform floor, so it is priced per endpoint with a platform minimum. Full deployment and data-handling detail is in the FAQ.
Which connectors are switched on is set per tenant. Plans & connectors shows the default bundles and the free add-ons.
What’s in each edition
| Discover | Discover + Warn | Discover + Warn + Block | |
|---|---|---|---|
| Price | Per endpoint, per month on a one-year contract, billed annually | Per endpoint, per month on a one-year contract, billed annually | Custom |
| AI discovery (11 signal classes) + AIBOM + risk scoring | ✓ | ✓ | ✓ |
| Compliance mapping (NIST AI RMF · OWASP LLM · ISO 42001 · EU AI Act), plus ISO 27001, SOC 2, GDPR, HIPAA and PCI DSS control mappings (mapping only, not a certification) | ✓ | ✓ | ✓ |
| Risk register, AI stack map, MCP server access, non-human identities, supply-chain trust | ✓ | ✓ | ✓ |
| Warn posture: alert people and owners when approved-AI policy is broken | — | ✓ | ✓ |
| Agent Red-Team and change-risk analysis (the on-host probe is a separate entitlement) | — | ✓ | ✓ |
| RBAC · MFA · audit log with CSV and JSON export | ✓ | ✓ | ✓ |
| Content-DLP policy engine: server-side decisions (monitor, warn, redact, block) through an inspection API you deploy | — | — | ✓ |
| Device revocation · binary attestation · tamper-resistant sensor · remote-pause | ✓ | ✓ | ✓ |
| Signed compliance-evidence export | ✓ | ✓ | ✓ |
| Jira, ServiceNow and SIEM export | — | ✓ | ✓ |
| Slack and Teams alerts (free add-on you opt in to, on any plan) | ✓ | ✓ | ✓ |
| SSO (SAML + OIDC) · SCIM 2.0 · ownership auto-sync | — | — | ✓ |
| Endpoint enforcement — block egress and kill the process · host quarantine (opt-in, audited; generally available on Windows, macOS and Linux; the sensor service already has the administrator rights it needs) | — | — | ✓ |
| In-VPC deployment in your own AWS account (by arrangement). Managed tenants are hosted in AWS us-east-1. | — | — | ✓ |
| Data-residency pinning, regional data planes and EU-region managed tenants | — | — | Roadmap Planned |
| Customer-managed keys and private connectivity on managed tenants | — | — | Planned: keys Roadmap, connectivity Roadmap |
| Air-gapped, zero-egress deployment | — | — | Roadmap Planned |
| Support | Community | Priority · 8×5 | Premier · 24×7 + TAM |
| Onboarding | Self-serve | Standard | Dedicated |
Every capability listed is generally available, except Oracle Cloud tenancy discovery (beta) and the rows marked Roadmap, which are planned and not available today (Roadmap); ask on the scoping call about rollout for your environment. Uptime / SLA terms are set in the order form for Discover + Warn and Discover + Warn + Block.
Fixed-fee services
Every engagement is fixed-fee against a scope agreed up front, and every assessment includes a 30-day re-test after fixes ship.
| Engagement | Duration | Best for |
|---|---|---|
| AI Discovery Assessment | 1–2 weeks | The inventory a governance program starts from. |
| AI Security Assessment | 2 weeks + re-test | Defensible evidence for one production AI app. |
| Full AI Red Team | 4 weeks + re-test | App + RAG + agent/MCP, chained attack paths. |
| EU AI Act Readiness | 2–3 weeks | Where you stand vs the Act's Art. 9, 26 & 50 duties (Art. 55 where you provide a GPAI model), with the evidence structure. |
| Continuous AI Testing | Rolling | Keeps the harness running as your models change. |
| Embedded AI Program | Ongoing | Own your AI risk program without a full-time hire. |
Full scope and deliverables are on the Services page. See a sample report before you buy.
What drives the number, and how you get to a firm quote.
What drives the cost
Enrolled endpoints
One enrolled host running the sensor is one endpoint. It is billed annually, with volume tiers, and each edition is priced per endpoint with an annual platform minimum.
Edition
Discover, Discover + Warn or Discover + Warn + Block. The edition sets the capabilities (see the comparison above), the support level and the onboarding.
Agentless connectors
Your plan sets which connector groups are on by default. Plans & connectors shows the bundles and the free add-ons.
Deployment tier
Shared managed tenant (logically isolated), a physically dedicated tenant as a custom project, or in-VPC in your own AWS account (Enterprise, by arrangement). Managed tenants are in AWS us-east-1.
Services, fixed-fee
Services are priced as a fixed fee against a scope agreed before work begins. There is no hourly billing on defined work.
The path from free assessment to a firm quote
1 · Free assessment
Run the sensor on up to 25 endpoints and receive an AI risk report and an AIBOM, typically within a week. Free, no commitment. How the assessment works.
2 · Scoping call
We agree your endpoint count and OS mix, the deployment model, the clouds you run and the stack to wire into (SIEM, identity, Jira, Slack). Book it.
3 · Firm quote
A firm number against your environment, not a list price you negotiate down.
4 · Order form
Uptime and SLA terms for Discover + Warn and Discover + Warn + Block are set in the order form.
What a quote includes
- The edition and the endpoint count and rate, with the annual platform minimum
- The connector families switched on, and any free add-ons
- The deployment option, support level and onboarding
- An ROI outline: analyst-hours saved on manual discovery, and risk reduced
- References on request
How to read the ROI calculator
- The defaults are illustrative assumptions. Replace each with your own: endpoints, analysts doing discovery today, hours, loaded hourly cost, share removed by automation, and manual audit effort.
- It estimates labor given back. It excludes risk avoided and audit-prep time saved, so treat it as conservative.
- Platform cost and payback appear only once you enter a price per endpoint. Leave it empty until you have a quote.
Building a business case?
We’ll provide a firm quote, an ROI outline (analyst-hours saved on manual discovery + risk reduced), and references on request. Request pricing → · or email sales@araghatta.com
See what AI is already running in your environment.
Start with a free assessment, or talk to us about scope — no rollout required to begin.