Simple Pricing

Choose the plan that fits your threat intelligence workloads.

Starter
Free
Perfect for individuals and small tests.
  • 1 User Workspace
  • Local Dev Sandbox Execution
  • Basic Static Analysis (Hashes, Strings)
  • Community YARA rules
  • Standard JSON reports
  • 24-hour Data Retention
  • Community Support
  • Rate limited API access
START FREE
Professional
$499/mo
For SOC teams requiring advanced threat intelligence.
  • Full XGBoost AI Classifier
  • Hugging Face Analyst Reports
  • Neo4j Attack Graphs (React Flow)
  • WebSocket Telemetry Streaming
  • MITRE ATT&CK Capability Mapping
  • VirusTotal & AbuseIPDB Enrichment
  • Firecracker microVM Isolation
  • 7-day Telemetry Retention
GET STARTED
Enterprise
Custom
Uncompromised security for large orgs.
  • Dedicated Kubernetes Infrastructure
  • Multi-tenant Workspace RBAC
  • Custom YARA/Suricata rules
  • SIEM (Splunk/Elastic/Sentinel) Webhooks
  • gVisor & Kata Container Isolation
  • Cross-Job Infrastructure Correlation
  • Unlimited Neo4j Graph Queries
  • Long-term S3 Payload Storage
  • Custom Threat Hunting Queries
  • 24/7 Priority IR Support
CONTACT SALES

Frequently Asked Questions

What sandbox engines do you support?

ACROS supports local execution (for dev), Firecracker microVMs for hardware-level isolation, and gVisor/Kata Containers for secure containerized execution on Kubernetes.

Can I export telemetry to my SIEM?

Yes. Enterprise customers can configure Webhooks to push structured JSON alerts directly to Splunk, Elastic, or Azure Sentinel. You can also poll the REST API.

How does the AI Analyst Report work?

We use an XGBoost classifier for initial malware family detection, followed by a Transformer-based LLM that synthesizes the structured telemetry and MITRE mappings into a readable executive summary.

Is my data kept private?

Absolutely. All payloads are stored in encrypted MinIO buckets, and ephemeral sandbox states are securely wiped immediately after analysis completes.

Return Home