Security And Identity — enterprise stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Identity Provider (IdP) / SSO & Directory
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAuth0 Free: 7,500 MAU, 2 social IdPs, unlimited logins. Essentials $35/mo incl 1k MAU + $0.15/MAU overage, B2B SSO $0.25/MAU. Azure AD Free: 50k dir objects free, P1 $6/user/mo, P2 $9/user/mo incl Identity Protection + PIM. Okta: SSO $2/user/mo min 100 users, Adaptive MFA $4/user/mo, Lifecycle $4/user/mo. Overage $2.50/user/mo. WorkOS: Free 1M MAU dev, prod $99/mo per SSO bundle + $0.10/MAU after. Keycloak VM cost $5-20/mo.
Multi-Factor Authentication (MFA) Enforcement
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAuth0 MFA: TOTP/WebAuthn free, 1k SMS free/yr then $0.05/SMS. Duo Free: 10 users free, Essentials $3/user/mo, Advantage $6/user/mo (risk-based). Okta MFA $4/user/mo incl push + risk engine. Azure MFA free with P1 ($6) / P2 ($9). SMS overage $0.05-0.08/msg, Voice $0.10/verify. Push free unlimited.
Secrets Management (Vault / Parameter Store)
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsVault OSS: free + VM $10-50/mo. HCP Vault Standard $0.03/hr ~$22/mo + $0.08/secret/mo, Plus $0.10/hr. AWS Secrets: $0.40/secret/mo, $0.05 per 10k API calls, free rotation Lambda (1M invocs free). SSM Standard free 10k, Advanced $0.05/param/mo. Doppler: Free 5 users, Pro $10/user/mo 500 secrets $0.30/secret over. Infisical Free 2 projects, Pro $20/mo 10k secrets.
Key Management Service (KMS) - Encryption Key Lifecycle
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS KMS: $1/mo per customer key, $0.03 per 10k symmetric requests, $0.15 per 10k asymmetric/RSA, free 20k requests for AWS-managed keys. GCP KMS: $1/key version/mo, $0.03/10k ops, $0.12/10k HSM ops. Azure Key Vault: $1/key/mo Standard $0.03/10k ops, Premium $5/key/mo $0.15/10k ops. Overage: $0.03/10k ops. Auto-rotation free.
Hardware Security Module (HSM) / Dedicated Key Protection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS CloudHSM: $1.88/hr per HSM ~$1,373/mo, HA 2-HSM cluster ~$2,746/mo + $0.50/hr backup + $0.20/GB snapshot. Min 1. No free tier. GCP Cloud HSM: $5/key version/mo HSM-protected + $1/hr HSM provisioning $0.15/10k ops. Azure Managed HSM: $1.45/hr $1,055/mo per HSM pool min 3 HSMs ~$3,165/mo. Thales Luna Cloud: $2.5/hr $1,825/mo + $0.50/GB backup. YubiHSM 2 hardware $650 one-time.
Encryption at Rest (S3/EBS/SSE-KMS)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsS3 SSE-S3 free, 0% overhead. SSE-KMS: $1/key/mo + $0.03/10k KMS requests, adds ~$0.01 per 1k PUT GET overhead. S3 Bucket Keys $1/mo per bucket key reduces calls 99%. EBS encryption free switch, snapshot copy free + KMS cost if customer key $1/mo. GCS default free. No free tier limit as feature free; overage only KMS API $0.03/10k.
Encryption in Transit / TLS Certificate Management
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsACM Public: free unlimited, auto-renew 13mo. Let's Encrypt free 90d, 50 certs/week/domain, 300 pending auth. Cloudflare Free 15-yr origin cert free. ACM Private CA $400/mo per CA + $0.75 per cert first 1k then $0.35, $0.001 per OCSP. Smallstep $10/mo 100 certs $0.10/cert over. DigiCert OV $250/yr ~$21/mo, EV $600/yr. Private cert overage $0.75 each.
Web Application Firewall (WAF) / Edge Protection
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsCloudflare Free: 1 rule free. Pro $20/mo 20 rules + $5/10k managed req after 10M, $0.50/1k R2? Business $200/mo 100 rules free 10M req. Enterprise $5k/mo custom unlimited + $0.50/M over 100M. AWS WAF: $6/mo WebACL + $1/mo per rule, $1 per 1M requests, Bot Control $10/mo $1 per 1k bot req after 1M, Fraud $10/mo $1/10k fraud eval. Overages $1/1M req.
Threat Detection (GuardDuty / Cloud-native)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsGuardDuty: 30d free, then CloudTrail Mgmt $1.20/1M events (100M-500M $1.00, 500M+ $0.90), VPC Flow $0.30/GB first TB then $0.15, DNS $3.50/GB, S3 $0.20/GB, EKS Audit $1.20/1M. Security Hub CSPM $0.0010/check first 100k $0.0008 after 100k. Defender: Servers $15/server/mo. GCP SCC Premium $10-15/vCPU/mo. Overage $0.30/GB flow, $1.20/M events.
Vulnerability / CSPM / CNAPP (Wiz, Prisma, Orca)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWiz: Free 30d POC, then $2,500/mo base for 100 VMs/containers + $0.10/serverless hr overage + $5 per storage bucket extra. Prisma Cloud: $50k/yr base 500 resources ~$4,167/mo + $0.15/resource/mo overage + Compute $10/host/mo over. Orca $2,083/mo 250 assets $8/asset over. Prowler self-host $10/mo VM free scanning unlimited. Commercial overage $5-10/resource/mo.
SIEM / Security Log Lake & Data Lake
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsPanther Free 500GB/mo ingest + 90d retention, then $0.10/GB up to 10TB $0.08/GB over 10TB + $500/mo platform base after 1TB. Splunk Cloud $150/GB/mo ingest min $750/mo, Enterprise $6k/yr per 1GB/day $0.50k. Sentinel PayGo $2.46/GB ingest, $0.12/GB archive, reservations $1.23/GB commitment 100GB/day $0.10/GB over. Security Lake storage $0.023/GB Standard $0.0125 S3 IA. OpenSearch self-host $50-200/mo VM.
Identity Governance / RBAC & Least Privilege (IAM Analyzer)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAccess Analyzer free first 1k active findings + 100k archive rules free, then $0.0010/archive rule check. IAM free unlimited roles. Okta LCM $4/user/mo min 100 users + $3/user gov, $2 overtime. SailPoint SaaS $10/user/mo min $1000/mo + $5/1k entitlements over. Azure Access Reviews incl P2 $9/user/mo.
Service-to-Service Auth (mTLS / SPIFFE / Workload Identity)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsSPIFFE/SPIRE free self-host VM $10/mo. Consul HCP $0.03/hr per service instance ~$22/mo + $0.50/1M service discovery over. App Mesh $0.03/hr mesh + $0.10/1M req. GCP Workload Identity Federation free. mTLS certs via SPIRE free 1hr rotation. Overage $0.03/hr/client.
Certificate Management / PKI Automation (cert-manager)
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitscert-manager free $5/mo VM helm. Let's Encrypt free 50/week. Smallstep $10/mo 100 certs $0.10/cert overage, $30/mo 1k certs. Venafi $2,500/mo base 1k certs $2/cert over. ACM Private CA $400/mo per CA + $0.75 per cert first 1k $0.35 after 10k, $0.001 OCSP. DigiCert $250/yr OV ~$21/mo per cert $0.50 renewal overage.
Audit Logging & Immutable Trail (CloudTrail / Audit Logs)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsCloudTrail: First trail Mgmt events free, data events S3/Lambda $0.10/100k events, Insights $0.35/100k write events. Lake $2.50/GB ingest first TB $2 after $0.50, storage $0.25/GB-mo 1yr $0.05/GB archive. S3 Object Lock free feature + $0.023/GB Standard + $0.0125/1k lock requests. GCP Audit free 30d 400GB then $0.50/GB. Azure free 90d then $2.30/GB Log Analytics.
Security Posture & Compliance Checks (Security Hub / CIS)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsSecurity Hub: 30d free then $0.0010/check <100k $0.0008 100k-1M $0.0005 1M+. Foundational Best Practices same pricing. AWS Config $0.003 per eval 100k free $0.0012 after + $0.0125 per rule eval over. Prowler free self-host $10/mo VM infinite checks. ScoutSuite free. Overage $0.001/check ~$1 per 1k failing.
DDoS Protection (L3/L4/L7)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsShield Standard free unlimited. Shield Advanced $3,000/mo per org + 10k protected resources free $0.05/GB mitigated over 10TB + $50/hr SRT. Cloudflare Free unlimited DDoS free, Pro $20/mo, Business $200/mo, Magic Transit $5k/mo includes 10TB then $0.10/GB. Cloud Armor Standard $5/mo per backend policy + $1/rule + $1/M req Advanced $10k/mo base. Overages $0.05/GB DRT.
Secrets Rotation Automation & Dynamic Secrets
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS rotation free VM $10/mo, Lease TTL free. AWS Secrets $0.40/secret/mo + Rotation Lambda $0.20/1M req + $0.0000167/GB-s, free 30d rotation. Doppler Pro $10/user/mo incl auto-rotation 1d min for 20 integrations $0.30/rotated secret over 100. CyberArk $8/user/mo + $0.10/rotated secret. Overage Lambda $0.20/M.
Network Segmentation / Security Groups & Firewall Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSG/NACL free. Firewall Manager $100/mo per org + $10 per WAF/Firewall/Network Firewall policy after 5 free + $6/rule. Tailscale Free 100 devices, Personal Pro $6/user/mo 1 user, Teams $6/user/mo 3+ min $18/mo. Aviatrix $0.50/hr $365/mo. Network Firewall $0.395/hr ~$288/mo per AZ + $0.065/GB processed, overage $0.065/GB. Illumio $15/workload/mo $1500 min + $3/workload over 100.
Privileged Access Management (PAM) / Just-in-Time Access
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsTeleport Community free VM $20/mo. Cloud Teams $20 per server/host/mo + $10/user/mo 5 hosts free $20/host over. Enterprise Cloud $50/host/mo + $25/user/mo. Boundary OSS free $10/mo VM, HCP $0.03/hr ~$22/mo cluster + $0.10/hr over 10 sessions. CyberArk DPA $25/user/mo min $2000/mo + PAM $150/user/mo min $3000/mo. Azure PIM needs P2 $9/user/mo.
Single Sign-On Broker for B2B (WorkOS / SAML Federation)
Enterprise single sign-on and user provisioning. Usually required to sell to larger organizations.Pricing & free-tier limitsWorkOS Free 1M MAU sandbox, Starter $99/mo 5 SSO connections $0.10/MAU after 1k MAU. Enterprise $499/mo unlimited SSO + $0.08/MAU after 5k, Directory Sync $99/mo bundle 5 dirs $0.01/user sync over 10k. Auth0 B2B Essentials $35/mo 500 MAU $0.20/MAU over, Professional $800/mo 5k MAU $0.15 over. FusionAuth self-host free VM $15/mo, Cloud $200/mo 10k MAU $0.02/MAU over.
Device Trust / Endpoint Posture for Zero Trust
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCloudflare Zero Trust Free 50 users 24hr logs 3 apps, Teams $7/user/mo 7d logs $20/mo min + $1/50k Zero Trust Network GB after 10GB, Enterprise $14/user/mo unlimited. CrowdStrike Falcon Pro $5/device/mo $59.99/yr min 100 devices $500/mo, Complete $15/device/mo. Kolide free 10 devs then $4/device/mo. Fleet $3/device/mo open source. Device cert $0.75/cert via Private CA.
API Security Gateway / Rate Limiting & AuthZ
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsKong OSS free VM $15/mo. Konnect $250/mo incl 10M req $0.10 per 1k req $0.01 overage, $0.05/plugin over. Zuplo Free 100k/mo, Dev $250/mo 1M req $0.30/10k over. AWS REST $3.50/M req 333M $3.43, caching $0.02/hr, HTTP $1/M req. Apigee eval free 60d then $500/mo base + $4/100k calls $0.20/GB over 10GB. Salt $4,167/mo $0.50/1k over 5M calls.
Container Image Scanning & Runtime Threat Protection
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsTrivy free self-host VM $10/mo. Falco free $15/mo VM. Snyk Container Team $25/dev/mo 1k scans $0.05/scan over, Business $98/dev/mo unlimited. Sysdig $12/node/mo + $0.20/GB scanning >100GB. Aqua $15/agent/mo min $1500/mo + $0.50/image over 500. Prisma Compute $20/host/mo $2k/100 hosts + $0.10/container over 500. Runtime $0.02/hr/container threat detection overage.
Data Loss Prevention (DLP) / Sensitive Data Discovery (Macie)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMacie Free 1GB/mo + 30d trial, then $1/GB first 50,000 GB/mo, $0.50/GB 50k-500k, $0.25/500k+, classification $0.10 per 10k objects, bucket eval $0.05 per 10k buckets after first 10k free. Nightfall Free 100 scans, Dev $20/mo 500 scans $0.05/scan over, Pro $500/mo 10k scans $0.03/scan over. BigID $4,167/mo 10TB $1/GB over + $0.50/100k files over 1M. Google DLP $1/GB inspection + $0.01/1k transformations.
Compliance Automation (SOC 2 / ISO 27001 / HIPAA)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVanta: $12k/yr $1k/mo for up to 20 employees + 20 vendors + 5 frameworks, + $25/employee/mo over 20 + $200/vendor over 20, overage: extra frameworks $2k/yr. Drata: $10k/yr $833/mo up to 25 employees + frameworks, $20/employee/mo over + $15/vendor. Secureframe: $10k/yr $833/mo 50 employees, additional $30/employee/mo over. Free tiers trial 7-14d then pay. Audit marketplace $5k-15k one-time SOC2 auditor.
Incident Response / SOAR Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTines Free 1k story runs/mo, Starter $500/mo 50k tasks $0.01/task over, Growth $1k/mo 200k tasks $0.008 over, Enterprise $2k/mo. Splunk SOAR Community 100 actions/day free, Cloud $35k/yr 10k actions/mo $0.50/action over $2k/yr support. PagerDuty Free 1 user, Professional $41/user/mo 50k events $0.40/1k over, Enterprise $61/user/mo. n8n OSS free VM $10/mo.
Security Analytics / UEBA (User & Entity Behavior)
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsPanther Free 500GB/mo 90d + UEBA free unlimited users, then $0.10/GB up to 10TB $500/mo base $0.08/GB over. Exabeam Fusion $60k/yr $5k/mo base 100 users $10/user over + $0.15/GB over 500GB/day, includes UEBA. Elastic Cloud $95/mo 4GB 50GB storage $0.10/GB over hot $0.05 warm. Wazuh OSS free VM $20/mo. Securonix $6,667/mo $0.15/GB over 500GB/day.
Zero Trust Network Access (ZTNA) / Private Access
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCloudflare Free 50 users 24hr logs 3 private apps, Teams $7/user/mo min $20/mo + $1/50k Gateway Network GB after 10GB + $0.10/GB Zero Trust. Enterprise $14/user/mo unlimited. Tailscale Free 100 devices, Teams $6/user/mo 1 user min $18/mo net $75/mo enterprise relay, Enterprise $18/user/mo $300/mo min. Zscaler ZPA $30/user/mo annual $360/user/yr min 100 users $3000/mo + $0.15/GB over 50GB/user. Perimeter81 $8/user/mo + $40/gateway/mo $10/GB over 5TB.
Backup & Immutable Vault for Security Logs / Key Backup
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsS3 Object Lock free flag + $0.023/GB-mo Standard $0.0125 IA $0.004 Instant Retrieve $0.00099 Deep Archive 180d min + $0.0125/1k Object Lock req. Glacier Vault Lock free policy + $0.004/GB. AWS Backup Vault Lock free + $0.05/GB warm $0.01 cold storage + $0.02/GB restore $0.05/10k early delete. Velero OSS free VM $15/mo + S3 storage cost. Veeam $20/VM/mo + $0.05/GB over 100GB per VM. Immutable 7yr $0.023/GB/mo S3.
Customer Managed HSM Cluster / FIPS 140-2 Level 3 Compliance
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsAWS CloudHSM: $1.88/hr per HSM = $1,373/mo, HA 2-HSM $2,746/mo + $5/hr multi-AZ cluster fee multi-region $4k/mo min, backup $0.50/hr + $0.20/GB. Azure Managed HSM: $1.45/hr $1,055/mo per HSM pool min 3 = $3,165/mo $0.10/10k transactions over, $0.50/hr backup over 10GB free. Thales DPoD $2.50/hr ~$1,825/mo per partition $0.08/operation over 1M. FIPS 140-2 L3 cert included. Overage $1.88/hr per HSM.
Federal / Regulated Compliance (FedRAMP, PCI-DSS, GDPR Automation)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVanta SOC2 base $12k/yr $1k/mo 20 employees, FedRAMP add-on $13k/yr extra total $25k/yr $2,083/mo + $25/employee over + $2k/framework. Drata FedRAMP $20k/yr $1,667/mo 25 employees $20/employee over. Coalfire FedRAMP readiness $15k one-time + 3PAO audit $40-80k/yr $3,333-6,666/mo. PCI QSA audit $15-35k/yr $1,250-2,917/mo. AWS GovCloud $5k/mo min + $0.50/hr extra compliance, Assured Workloads free tier + $1k/mo FedRAMP environment. Overages $2.5k/audit.
Cross-Cloud Identity Federation & Directory Sync (SCIM)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsWorkOS Free 100 dirs dev + 1M MAU, Directory Sync $99/mo 5 dirs bundle incl 1k synced users $0.01/user over 10k users $100/mo extra per 10k. Enterprise $499/mo unlimited dirs + unlimited SSO $0.08/MAU after 5k + $0.005/user sync. Okta Lifecycle $4-8/user/mo 100 min $400-800/mo + SSO $2/user/mo. SCIM self-host free VM $15/mo. Azure AD B2B free 50k monthly unique guests then $6/guest after P1.
Advanced Threat Intelligence Feed Integration
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOTX free 50k IOCs/day 10k API calls/day, $0 commercial. MISP OSS free $10/mo VM hosting feeds free. GreyNoise Community free 1k/day, Basic $50/mo 100k queries $0.50/1k over, Advanced $500/mo 1M $0.30/1k over. Recorded Future $2,500/mo base 10k IOCs $0.10/IOC over ~$100/1k. CrowdStrike Intel $4,167/mo $0.15/IOC over 5k/day. Anomali $5k/mo 20k IOCs $0.08/IOC over. Threat intel enrichment $0.10/1k lookups over.
Security Chaos Engineering / Breach & Attack Simulation (BAS)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCaldera free self-host $20/mo VM + agent free. Atomic free. AttackIQ Flex $500/mo 250 simulations $5/sim overage 1000 api calls free, Enterprise $2,917/mo unlimited sims + 20 users $100/user/mo over, $500/mo support. Cymulate $4,167/mo 1000 attacks simulated $1/attack over $2/advanced scenario over. SafeBreach $4,167/mo 500 nodes $8/node over. Picus $3,333/mo 500 assets $6/asset over.
Policy as Code / OPA & Organization SCPs Enforcement
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOPA free $10/mo VM self-host infinite policies. Gatekeeper/Kyverno free. Styra Free 1 system 50 policies 10k decisions/day, Pro $500/mo 500 policies 500k decisions/day $0.10/10k decisions over ($1 per 100k). Enterprise $2k/mo unlimited. Sentinel HCP $0.03/hr per workspace ~$22/mo + $0.10/10k checks over 100k. AWS Organizations SCPs free, Config rules $0.003/eval 100k free $0.0012 after. OPA Bundle storage $0.023/GB.
Fraud / Bot Protection & Abuse Prevention
Moves money — charges, payouts to sellers, taxes, fraud checks. Highest-stakes integration: get it wrong and you break compliance or lose revenue.Pricing & free-tier limitsCloudflare Free Bot Fight Mode free, Super Bot Fight free 1 rule. Pro $20/mo + Bot Management Enterprise $5k/mo includes 10M good bot req $0.50/1k bad bot over 1M, $1/M JS challenges over. AWS WAF Bot Control $10/mo per ACL + $1 per 1k bot req after 1M, Fraud Control ATP $10/mo $1/10k fraud eval after 1M, Account Takeover Prevention $10/mo. DataDome $3k/mo 1M req incl $0.60/1k over 5M + $0.30/1k bot > 1M. Akamai $5k/mo 10M req $0.40/1k over. Arkose $3.5k/mo $0.25/1k over.
Enterprise Audit & eDiscovery / Legal Hold for Security Events
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsCloudTrail Lake $2.50/GB ingest first TB $2.5 after $0.50 100TB, storage $0.75/GB-mo 7yr $0.023/GB S3 archive $0.25/GB 1yr retention. Purview E3 $23/user/mo free 100GB hold $0.20/GB over, E5 $57/user/mo free 100GB hold + Advanced eDiscovery $0.12/GB export over. Exterro $2.5k/mo 1TB $5/GB over. Varonis $3,333/mo 500 users $6.66/user over + $0.50/GB scanned > 10TB. Logikcull $400/mo project + $25/GB processed over 10GB $0.20/GB storage/mo over 100GB. Legal hold free up to limit then $0.20/GB/mo.
How this enterprise security and identity checklist works.
Each requirement below is something a enterprise security and identity build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.