Threat Intelligence And Digital Forensics — enterprise stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Threat Intelligence Platform (TIP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMISP Free OSS + ~$20/mo VM (2 vCPU/4GB); OpenCTI CE Free + ~$40/mo VM+OpenSearch; ThreatConnect $40k/yr (~$3333/mo) 5 users; Anomali $50k/yr (~$4166/mo) 10 users/1M IOCs/mo; Recorded Future $100k/yr (~$8333/mo) unlimited users/API 5M req/mo
Malware Analysis Sandbox
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAny.Run Free: 5 tasks/day public, 10min analysis; Pro $299/mo 100 private tasks + $0.10/task overage; CAPE Free + ~$50/mo VM; Joe Sandbox Cloud Pro $25k/yr (~$2083/mo) 5k tasks/mo; Ultimate $50k/yr (~$4166/mo) 10k tasks/mo; Any.Run Private Cloud from $10k/mo
Digital Forensics Tool (Disk & Memory)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAutopsy Free OSS; Volatility Free OSS; FTK Imager Free; FTK Toolkit $4000/yr/license (~$333/mo); FTK Lab $8000/yr (~$666/mo); EnCase Forensic $4000/yr/license or $7500 one-time; Magnet AXIOM $4500/yr (~$375/mo) per examiner, AXIOM Cyber $6500/yr (~$541/mo)
Evidence Collection & WORM Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsS3 Object Lock Free feature + Storage: $0.023/GB-mo Standard, $0.0125/GB-mo IA, $0.004/GB-mo Glacier Instant, $0.00099/GB-mo Deep Archive; PUT $0.005/1k; Backblaze B2 $0.006/GB-mo storage + $0.01/GB download; Wasabi $6.99/TB-mo ($0.00699/GB) no egress/API, 90-day min
Threat Feed / IOC Aggregation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOTX Free unlimited pulses/OTX API; Abuse.ch Free unlimited; Shodan Membership $59 one-time + Free 100 query/mo; Shodan Pro $59/mo 10k results; GreyNoise Free 100 req/day, Pro $500/mo 50k req, Enterprise $1800/mo; VirusTotal Free 4 req/min 500/day 15k/mo; Enterprise $30k/yr (~$2500/mo) 750k req/mo $0.004/req overage; VT Hunting add-on $10k/yr (~$833/mo)
SIEM for Threat Intel Correlation
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWazuh Free OSS + ~$50/mo VM 4vCPU; Panther Free 500GB ingested/mo then $0.10/GB after; Elastic Cloud $95/mo 2GB RAM/50GB storage $0.10/GB over; Splunk Cloud $150/GB/mo ingested (approx $1800/TB/yr) min $2000/yr + Enterprise license; Sentinel $2.46/GB ingested + $0.10/GB 90d retention; Chronicle $5/GB ingested
Secrets Management for Intel API Keys
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free + ~$30/mo VM; Infisical OSS Free; Doppler Free 50 secrets 1000 API calls/day then $18/mo Starter; Vault Cloud $0.03/hr dev (~$22/mo) Standard $0.10/hr (~$73/mo) + $0.03/10k req; AWS Secrets Manager: first 30 days free then $0.40/secret/mo + $0.05/10k API; Azure KV $0.03/10k ops + HSM $1.45/HSM-mo
IOC / Artifact Repository (Object Storage)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsMinIO Free AGPL + ~$15/mo 1TB VM disk; Backblaze B2 $0.006/GB-mo storage $0.01/GB egress; Wasabi $6.99/TB-mo $0.00699/GB no egress/API fees 90-day min; AWS S3 $0.023/GB-mo Standard, Intelligent-Tiering $0.023-$0.0125 auto, $0.00099 Deep Archive; S3 Inventory $0.0025/M objects listed
Reverse Engineering Environment
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsGhidra Free OSS; REMnux Free OVA; x64dbg Free; IDA Free Free non-commercial; IDA Pro $2999/yr per seat (~$250/mo) + Hex-Rays $3299/yr; Binary Ninja Personal $299 one-time (perpetual), Commercial $1199/yr (~$99/mo), Cloud $50/mo per user; radare2 Free
Network Traffic Analysis / PCAP Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsZeek Free + ~$40/mo VM; Suricata Free OSS; Security Onion Free + ~$100/mo 500GB infra; Arkime Free + ~$100/mo infra; Corelight Virtual Sensor $75k/yr per sensor (~$6250/mo) includes support+cloud; Physical AP 200 $125k one-time + $25k/yr support; CloudShark Teams $399/mo 50GB, Enterprise $999/mo 250GB
Endpoint Timeline / Memory Forensics Compute
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsVolatility Free; KAPE Community Free LE version; Velociraptor Free + ~$50/mo t3.medium; Timesketch Free + ~$40/mo VM; Binalyze AIR Free 25 assets then Enterprise $35k/yr (~$2916/mo) 1000 endpoints $5/endpoint/mo over; Magnet AXIOM $4500/yr (~$375/mo) Cyber $6500/yr (~$541/mo); CrowdStrike Falcon Insight $59.99/endpoint/yr + Forensics add-on $12k/yr (~$1000/mo)
Vulnerability Intelligence / CVE DB Hosting
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsNVD API Free 50 req/30s no key, 300 req/30s with key unlimited; cve-search OSS Free + ~$20/mo 40GB VM + Mongo; Vulners Free 100/day, Startup $200/mo 10k req/day, Business $500/mo 100k/day; VulnDB Commercial $30k/yr (~$2500/mo) 5 users; Recorded Future Vuln Module included $100k/yr Enterprise or +$20k/yr add-on
Dark Web Monitoring / OSINT Crawler Infra
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsTor Free; SpiderFoot OSS Free + ~$30/mo VM; Hunchly $129.99/yr (~$11/mo); IntelX.io Free 100 searches/mo then $60/mo Pro 1000; SpyCloud $40k/yr (~$3333/mo) base 3 users API 100k queries/mo $0.03 over; SearchLight $50k/yr (~$4166/mo) 5k dark web queries; ZeroFox $50k/yr (~$4166/mo) min
DNS / Passive DNS Logging
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsPi-hole Free; SecurityTrails Free 50 queries/mo, Pro $299/mo 10k queries $0.02 over; Farsight DNSDB Flex $199/mo 5000 queries, Standard $1995/mo unlimited user 500k queries/mo; RiskIQ PassiveTotal $15k/yr (~$1250/mo) base; VirusTotal Passive DNS included Enterprise $30k/yr (~$2500/mo)
Certificate Transparency Monitoring
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitscrt.sh Free unlimited web/API; CertStream Free firehose + ~$15/mo consumer VM; Censys Free 250 queries/mo, Search Team $999/mo 10k queries/day $0.10/overage 100k/mo, Enterprise $5000/mo; Shodan Monitor Free 1 network + Pro $129/mo 2M scan credits, Enterprise $999/mo; SecurityTrails CT included Pro $299/mo
Honeypot / Deception Infrastructure
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsT-Pot Free OSS + ~$30/mo VPS 4GB; OpenCanary Free; CanaryTokens.org Free unlimited tokens; Thinkst Canary Free 1 Canary, Starter $7500/yr 5 canaries (~$625/mo) + $15/canary/mo over; Scale $15k/yr 20 birds; Enterprise $50k/yr (~$4166/mo) 100 birds; Attivo/SentinelOne Deception $30k/yr (~$2500/mo) base 50 deceptions
Threat Actor Attribution Graph DB
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNeo4j Community Free + ~$40/mo VM 200k nodes; Aura Free 200k nodes 0.5GB then Professional $0.18/hr DB (~$130/mo) + $0.21/GB-hr storage; ArangoDB Free community; TigerGraph Cloud Free 100GB then $0.20/hr instance (~$146/mo) + storage $0.023/GB; AWS Neptune Serverless $0.15/NCU-hr (~$108/mo min) + $0.20/GB-mo
Case Management / Incident Response Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTheHive 5 Free OSS + ~$30/mo VM; Cortex Free OSS; IRIS Free OSS; Jira Cloud Free 10 users then Standard $8.15/user/mo (~$815/mo 100 users) Premium $16/user/mo; ServiceNow SecOps $40k/yr (~$3333/mo) base 5 users Standard; PagerDuty Free 5 users + Team $29/user/mo (~$290/mo 10 users) Business $49/user/mo
Automated IOC Enrichment / SOAR Trigger
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsShuffle Free self-hosted unlimited + Cloud Free 10k exec/mo then Pro $500/mo 100k exec; n8n OSS Free self-hosted + Cloud Starter $20/mo 2.5k execs 5 workflows $0.01/exec over; Tines Community Free 10k tasks $0.02/task over, Pro $500/mo 50k tasks, Enterprise $2500/mo; Cortex XSOAR $75k/yr (~$6250/mo) 1000 actions/day; Splunk SOAR $30k/yr (~$2500/mo) 10k actions/mo $0.05/action over; Swimlane $60k/yr (~$5000/mo)
Scalable Malware Cluster (K8s for CAPE/Cuckoo)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCAPE Free OSS + ~$100/mo 3x spot c6i.large ($0.05/hr each) + EKS $0.10/hr control plane (~$73/mo) + 500GB EBS $40/mo; Karpenter Free; Any.Run Private Cloud from $10k/mo single region; Joe Sandbox On-Prem Cluster $50k/yr (~$4166/mo) node + $25k/yr HA; VMRay Private Cloud $80k/yr (~$6666/mo) entry
File Reputation & Hash Lookup Cache (Redis)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsRedis OSS Free + ~$15/mo 1GB VM; Upstash Free 10k cmds/day 256MB then Pay-as-you-go $0.20/100k cmds; Redis Cloud Free 30MB then Essentials $5/mo 100MB $0.15/GB over, Pro from $400/mo 10GB $0.15/GB over; ElastiCache Serverless $0.125/GB-hr (~$90/mo for 1GB constant) + $0.20/M ETCP requests + storage $0.023/GB; Momento Free 50GB transfer then $0.20/GB
Threat Intel Sharing (TAXII 2.1 Server)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsOpenTAXII Free OSS + ~$20/mo VM 2 vCPU; MISP TAXII Free module; Anomali TAXII included with ThreatStream $50k/yr (~$4166/mo) unlimited collections; ThreatConnect TAXII included $40k/yr (~$3333/mo) 10 collections; EclecticIQ Platform $60k/yr (~$5000/mo) + TAXII server $200/mo hosting if external
YARA Rule Management & Scanning Engine
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsYARA Free OSS + ~$20/mo VM scanner; Valhalla OSS Free (1.5k rules) + Pro $1000/yr (~$83/mo) 10k rules; ClamAV Free; InQuest Free 1k files/day (public), Pro $500/mo 50k files/day private $0.01/file over; ReversingLabs A1000 $60k/yr (~$5000/mo) 1M file lookups/mo $0.005 over; VT YARA RetroHunt $20k/yr (~$1666/mo) add-on; Nextron THOR Cloud $3000/yr (~$250/mo) one scanner
OSINT Search & Crawling Cluster (Elasticsearch)
Lets users find things fast. A slow or missing search directly costs engagement and conversions.Pricing & free-tier limitsOpenSearch Free + ~$50/mo 100GB VM; IntelOwl OSS Free + ~$40/mo VM; Typesense Cloud Free 500k docs then $29/mo 2M docs; Meilisearch Free self-hosted; Elastic Cloud $95/mo 2GB RAM 50GB storage, $0.15/GB over + $0.12/hr ML; Algolia Free 10k records/10k searches then Starter $250/mo 100k records; GreyNoise Search embedded $1800/mo Enterprise
Document / Office Malware Extraction
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsoletools Free OSS; CyberChef Free browser + self-hosted; Hybrid-Analysis Free 100 API/day public, Pro $200/mo 500/day private $0.02/scan over; Any.Run Doc Pro $299/mo 300 docs/mo; Joe Sandbox Doc included $50k/yr Ultra bundle; VMRay $80k/yr (~$6666/mo) 5k files/day $0.15 each over limit
Blockchain Analysis / Crypto Tracing Node
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsBitcoin Core Free + ~$100/mo 1TB NVMe; Geth Erigon Archive Free + ~$200/mo NVMe 2TB node (m6i.xlarge spot $0.12/hr); Etherscan Free 5 calls/sec 100k/day, Pro $199/mo 3M calls/mo 10/sec $0.001 over; Alchemy Free 300M CU/mo then Growth $49/mo 1.5B CU; Chainalysis $60k/yr (~$5000/mo) 3 seats API 100k/yr $0.20 over; Elliptic $60k/yr (~$5000/mo) 10k queries/mo $0.25 over; TRM Labs $75k/yr (~$6250/mo)
Email Threat Analysis Gateway
Sending transactional email (receipts, resets, alerts) and sometimes marketing mail. Deliverability matters more than features here.Pricing & free-tier limitsurlscan.io Free 100/day public, Free Community API rate-limited, Pro $29/mo 5000 private scans API, Team $199/mo 20k scans $0.004 over; PhishTank Free unlimited; Proofpoint TAP Enterprise $60k/yr (~$5000/mo) for 1k users ($5/user/mo) + $0.30/GB over; Mimecast Email Security $3.50/user/mo min 100 users (~$350/mo) + $2/user/mo URL Protection add-on; Abnormal Security $40k/yr (~$3333/mo) 500 users ($6.66/user/mo)
Log Pipeline for Forensics (Kafka + S3 / Kinesis)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsKafka OSS Free + ~$100/mo 500GB 3 brokers spot; Vector Free; Redpanda Cloud Free tier 2 vCPU 2GB then Starter $0.20/hr + $0.10/GB storage; Upstash Kafka Free 10GB ingress/mo then $0.10/GB ingested + $0.20/GB egress; Confluent Standard $75/mo + $0.18/GB ingress + $0.12/GB egress + $1.50/hr CKU; Kinesis On-demand $0.15/MB-hr ingress $0.023/shard hr provisioned + S3 $0.023/GB; WarpStream Free 1GB then $0.05/GB ingested
Chain of Custody & Audit Logging
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsCloudTrail Mgmt Events: First copy of mgmt events Free per region 90 days UI, additional $2/100k events; Lake $2.50/GB ingested, storage included 7yr $0.023/GB-mo after first 7yr? $1.99/GB scanned query; SigNoz OSS Free, Cloud Free 30-day retention 100GB then $0.30/GB, Teams $199/mo 500GB; Axiom Free 500GB then $0.15/GB ingested + $0.02/GB scanned query; Chronicle $5/GB ingested + $1/GB scanned
Secure Evidence Transfer (SFTP / S3 Replication)
Runs in multiple regions for speed and resilience. Enterprise-grade reliability and the hardest to retrofit.Pricing & free-tier limitsOpenSSH SFTP Free; SFTPGo Community Free; FileZilla Server Free; AWS Transfer Family SFTP $0.30/hr endpoint (~$216/mo always-on) + $0.04/GB data up/down + S3 $0.023/GB; S3 CRR $0.023/GB + replication $0.005/1k req + S3 RTC $0.015/M metrics; Globus Standard Free for non-profit, Enterprise $10k/yr (~$833/mo) 50 endpoints $15/endpoint/mo over
Private Threat Intel LLM / RAG for Reports
Powers AI features — model access, embeddings, and inference. Costs scale with usage, so watch the meter.Pricing & free-tier limitsOllama Free + ~$200/mo A10 GPU (24GB) on-demand $0.75/hr spot $0.35/hr ~$180/mo 50% util; Qdrant OSS Free + ~$30/mo VM, Cloud Free 1GB 5M vectors, Standard $70/mo 10GB, Dedicated $0.40/hr; Together AI Free $25 then $0.20/M tokens input $0.20/M output Llama 70B; OpenAI Team $25/seat/mo (2 seats min) then Enterprise $60/seat/mo min 100 seats ~$6000/mo + GPT-4o $2.50/M input $10/M output; Claude Team $40/user/mo min 5, Enterprise $75/user/mo min 50; Pinecone Starter Free 100k vectors then Starter $70/mo 2GB, p2 Dedicated $0.40/hr (~$288/mo) + storage $0.16/GB + $0.20/M reads
Global Sensor Network / IDS Telemetry Fleet
Runs in multiple regions for speed and resilience. Enterprise-grade reliability and the hardest to retrofit.Pricing & free-tier limitsZeek/Suricata Free + ~$500/mo infra 10 sensors c6g.large $0.05/hr each + storage $0.023/GB; Security Onion Grid Free + ~$300/mo infra 10 sensors; Wazuh Free; Corelight Virtual Sensor $75k/yr each (~$6250/mo) or Physical $125k + $25k/yr support, Fleet discount $50k/yr per sensor at 20+; CrowdStrike Falcon Insight $59.99/endpoint/yr (~$4999/mo 1k endpoints); Velociraptor Enterprise $25k/yr (~$2083/mo) 5k endpoints; Emerging Threats Pro Ruleset $500/yr per sensor (~$42/mo)
High-Scale PCAP / S3 Glacier Archive (Evidence Lake)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsStenographer Free OSS + ~$200/mo 10TB NVMe ring buffer; Arkime Free + $100/mo 4 vCPU viewer + storage $0.023/GB hot, $0.004/GB Glacier Instant; S3 Glacier Instant $0.004/GB-mo + retrieval $0.03/GB; Flexible $0.0036/GB-mo + expedited retrieval $10/1k req; Deep Archive $0.00099/GB-mo retrieval $0.025/GB bulk + $0.0025/1k req restore; Example 100TB Deep = $99/mo storage + $2500 bulk restore; CloudShark Archive $999/mo 1TB+
Dedicated Forensics Bare Metal / Nitro Enclave
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsQubes OS Free; KVM Free; Nitro Enclaves Free feature (no surcharge) + EC2 cost: c6a.4xlarge $0.50/hr on-demand $0.22/hr spot (~$120/mo at 50% duty), enclave 2-8 vCPU free; i3en.metal $6.02/hr (~$4334/mo on-demand) 60TB NVMe, i3en.metal-2tb $3.01/hr; Firecracker Free; Magnet AXIOM Cyber $6500/yr (~$541/mo) + FIPS workstation $10k one-time
Compliance Vault for Legal Hold / eDiscovery
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsS3 Object Lock Compliance Free feature + $0.023/GB-mo Standard indefinite legal hold (no auto delete); S3 Object Lock Legal Hold $0 + storage; Wasabi Vault Compliance $6.99/TB-mo $0.00699/GB no egress/API min 90d; Backblaze Legal Hold Free; Proofpoint Enterprise Archive $6/user/mo min 100 users (~$600/mo) + eDiscovery $3/user/mo; Smarsh $10k/yr (~$833/mo) base + $5/user/mo; Microsoft Purview eDiscovery Hold included E5 $35/user/mo or add-on $12/user/mo
Threat Hunting Data Lake (Snowflake / BigQuery 10TB+ logs)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsDuckDB Free + S3 $0.023/GB ~$50/mo 2TB; ClickHouse OSS Free + ~$100/mo 1TB VM; ClickHouse Cloud Free 15GB storage 100GB scanned, Growth $0.20/GB storage mo + $0.15/GB scanned query, min $150/mo; BigQuery On-demand $7.50/TB scanned Free 1TB/mo query + $0.023/GB storage active $0.0125 long-term; Flat rate Enterprise $2500/mo 100 slots; Snowflake $4/credit Standard (~$400/mo 100 credits) + storage $40/TB compressed/mo ($0.04/GB); Databricks SQL Pro $0.70/DBU-hr (~$500/mo 1 cluster); Panther Data Lake $500/mo 1TB ingested then $0.15/GB; AWS Security Lake Free but Glue + S3 costs ~$200/mo 2TB
Cross-Cloud Forensic Acquisition (Velociraptor Fleet)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVelociraptor Free OSS + ~$100/mo infra (t3.xlarge + 500GB S3) for 1k agents; KAPE Free; AWS Lambda $0.20/1M requests + $0.00001667/GB-sec + S3 $0.023/GB; CrowdStrike Forensics Add-on $12k/yr (~$1000/mo) per team; Binalyze AIR Enterprise $35k/yr (~$2916/mo) 1000 endpoints $5/endpoint/mo overage; Cado Response Platform $50k/yr (~$4166/mo) 10TB auto-acquisition $0.10/GB over; Magnet AXIOM Cyber Cloud $7500/yr (~$625/mo)
Zero-Trust Access for IR Team (ZTA / Bastion)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTeleport Community Free + ~$30/mo VM for auth/proxy 5k sessions; WireGuard Free; Pomerium OSS Free; Tailscale Free 3 users 100 devices, Personal Pro $6/user/mo (~$18/mo 3 users) + $18/mo extra users, Teams $6/user/mo min 5 seats; Cloudflare Zero Trust Free 50 users then $7/user/mo standard Enterprise minimum $2000/yr; Teleport Enterprise $12k/yr (~$1000/mo) Starter 25 users $5/user/mo over, Pro $30k/yr (~$2500/mo) 100 users; Zscaler ZPA $25k/yr (~$2083/mo) 100 users $21/user/mo; StrongDM $85/user/mo
How this enterprise threat intelligence and digital forensics checklist works.
Each requirement below is something a enterprise threat intelligence and digital forensics build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.