// plans
Compare plans.
Every plan includes detection, investigation, response approvals and single sign-on. Core covers one tenant. Professional and Enterprise support unlimited isolated tenants under one organisation. Pricing is per protected identity, the licensed Entra user in each tenant. Devices, log sources and investigations are not separately billed.
| Included in your plan | Core security operations for one tenant per protected identity Talk to us | Professional multi-tenant operations and exposure management per protected identity Talk to us | Enterprise provisioning, audit and isolation annual agreement Talk to us |
|---|---|---|---|
| Detection and response | |||
| Defender for Endpoint alerts investigated by the agent | Included | Included | Included |
| SIEM over syslog, Microsoft 365, Entra and Defender | Included | Included | Included |
| Curated detections you can tune | Included | Included | Included |
| Evidence-backed verdict on every case | Included | Included | Included |
| Threat intelligence enrichment on every case | Included | Included | Included |
| Bring your own Recorded Future and Flare licences | Not included | Included | Included |
| Policy-governed actions with approval from Teams or email | Included | Included | Included |
| Emergency stop within each tenant | Included | Included | Included |
| CrowdStrike and SentinelOne response | Included | Included | Included |
| Posture and exposure | |||
| Microsoft 365, Entra and email posture findings | Included | Included | Included |
| Vulnerability findings from Defender, Qualys and Tenable | Not included | Included | Included |
| External attack surface management | Not included | Included | Included |
| Identity attack paths: privilege escalation, lateral movement and RBAC gaps | Not included | Included | Included |
| Cloud posture | Not included | Included | Included |
| Tenants and administration | |||
| Tenants per organisation | 1 | Unlimited | Unlimited |
| Roles and invitations per tenant | Included | Included | Included |
| Policy and retention settings per tenant | Included | Included | Included |
| Tenant switcher across customer or business tenants | Not included | Included | Included |
| Separate users, policies and evidence across tenants | Not included | Included | Included |
| Organisation-wide emergency stop across tenants | Not included | Included | Included |
| Dedicated database isolation | Not included | Not included | on request |
| Data residency choice | Not included | Not included | on request |
| Evidence and retention | |||
| Searchable retention | 30 or 90 days | up to 180 days | up to 365 days |
| Original evidence kept with provenance and integrity metadata | Included | Included | Included |
| Case and evidence export | Not included | Included | Included |
| Compliance-mode retention no administrator can bypass | Not included | Not included | on request |
| Agent transparency | |||
| Evidence and conclusion shown for every decision | Included | Included | Included |
| Reasoning traces retained per case | Not included | Included | Included |
| Per-case cost reporting | Not included | Included | Included |
| Investigation replay against a newer model | Not included | Not included | Included |
| Reporting | |||
| Posture, alert and case views per tenant | Included | Included | Included |
| Fleet views across every tenant you run | Not included | Included | Included |
| Scheduled reports for the people you answer to | Not included | Included | Included |
| Identity and access | |||
| Sign in with Microsoft or Google | Included | Included | Included |
| SAML or OIDC single sign-on with your identity provider | Included | Included | Included |
| SCIM provisioning and deprovisioning from your directory | Not included | Not included | Included |
| Support | |||
| Email support | Included | Included | Included |
| Priority support and an onboarding session | Not included | Included | Included |
| Named contact and a written service level | Not included | Not included | Included |
| Security review pack: architecture, tenancy, evidence handling | Not included | Not included | Included |
| Custom detection content | Not included | Not included | on request |
Log ingestion includes a fair-use allowance pooled per tenant. If you consistently exceed it, we discuss capacity with you. Dedicated isolation, residency and compliance retention are available on Enterprise by agreement.
// founding partners
Put Fusebox to work.
Get founding-partner terms and a direct line to the team building Fusebox. Tell us about your environment.
Become a founding partner