Extended Threat Intelligence plans & pricing:
licensed your way.

From a single module to the full XTI platform, every SOCRadar license is sized to what your team needs.

MonthlyYearlySave up to 40%

Advanced Dark Web Monitoring Essential

Ideal for businesses under 100 employees.

$4,550/year

Buy Now

Fast checkout via Stripe

1 domain
Hacker discussions monitoring
Employee & customer data breaches
Stealer malware & botnet tracking
Tor, Telegram, Discord & IRC sources

Ask for an invoiceMoney-back guarantee

Best value

Advanced Dark Web Monitoring Business

For growing businesses.

$9,100/year

Buy Now

Fast checkout via Stripe

1 domain
Industry-based & country-based dark web monitoring
Ransomware activity monitoring
VIP protection (account breach)
5 brand keywords · 50 IP addresses & IP blocks · 5 VIP accounts

Ask for an invoiceMoney-back guarantee

Advanced Dark Web Monitoring Ultimate

For commercial and enterprise use.

Custom pricing

Talk to Sales

3+ domains (Flexible) · 3 users
Stolen credit card tracking (banks only) & dark web search engine (Flexible)
API & integration (Flexible)
Role-based access
OnWatch services (Flexible)

Want to see the platform in action first? Start for free with SOCRadar Freemium

Compare plansEssentialBusinessUltimate

Credits & limits

Company name limit111

Domain limit113+ (Flexible)

Brand keyword limit–515

IP addresses & IP blocks limit105050+ (Flexible)

Third Party employee limit–2020+ (Flexible)

VIP account limit–55+ (Flexible)

Black market credit ($)–100100

Threat hunting search credit–1,2001,200

Threat hunting deck limit–22

Threat hunting subscription limit–15

Identity & access intelligence credit5120600

User limit113

Copilot credit50100500

Key features

Hacker discussions monitoring✔︎✔︎✔︎

Employee data breaches✔︎✔︎✔︎

Customer data breaches✔︎✔︎✔︎

Stealer malware & botnet tracking✔︎✔︎✔︎

VIP protection (account breach)–✔︎✔︎

Stolen credit card tracking (banks only)––Flexible

Industry-based dark web monitoring–✔︎✔︎

Country-based dark web monitoring–✔︎✔︎

Ransomware activity monitoring–✔︎✔︎

Data source coverage

Dark web forums✔︎✔︎✔︎

Tor✔︎✔︎✔︎

Black markets✔︎✔︎✔︎

Telegram✔︎✔︎✔︎

Discord✔︎✔︎✔︎

IRC✔︎✔︎✔︎

Private hacker forums✔︎✔︎✔︎

Private hacker channel market✔︎✔︎✔︎

Premium services

SOCRadar University access✔︎✔︎✔︎

OnWatch services––Flexible

API & integration

API & integration (Incident Integration, Leak APIs)––Flexible

Management & support

Email & chat support✔︎✔︎✔︎

Log audit–✔︎✔︎

Single sign-on (SSO)–✔︎✔︎

Role-based access––✔︎

For commercial use––✔︎

See the full Advanced Dark Web Monitoring page →

MonthlyYearlySave up to 40%

Best value

Cyber Threat Intelligence Essential

For small and mid-sized teams.

$14,750/year

Buy Now

Instant purchase via Stripe

Threat feed/IoC: 100+ feed sources
Access to 1,000 SIGMA/YARA rules
1,000 threat hunting search credits
100 auto malware analysis credits

Ask for an invoiceMoney-back guarantee

Cyber Threat Intelligence Ultimate

For commercial and enterprise use.

Custom pricing

Talk to Sales

API & integration (Included)
5,000 threat hunting search credits
Unlimited access to 20,000+ SIGMA/YARA rules
Instant IoC enrichment
Role-based access

Want to see the platform in action first? Start for free with SOCRadar Freemium

Compare plansEssentialUltimate

Credits & limits

Threat hunting search credit1,0005,000

Threat hunting deck limit1010

Threat hunting subscription limit15

Auto malware analysis credit1001,000

Identity & access intelligence credit1001,200

IoC enrichment credit1001,200

Third Party vendor limit11

User limit11

Copilot credit50500

Threat hunting

Threat investigation: cloud bucket search✔︎✔︎

Threat investigation: public repo search✔︎✔︎

Threat hunting deck: customizable search deck✔︎✔︎

Vulnerability intelligence

Vulnerability trends✔︎✔︎

Vulnerability insight: vulnerability exploit tracking✔︎✔︎

Vulnerability insight: vulnerability risk scoring✔︎✔︎

Subscription: CVE-based vulnerability subscription✔︎✔︎

Subscription: product- or vendor-based subscription✔︎✔︎

Alarm: customized notifications✔︎✔︎

Identity & access intelligence

Infostealer logs: infostealer insights✔︎✔︎

Infostealer logs: Third Party discovery––

Infostealer logs: asset discovery––

Breach service: exposure insight––

Breach datasets: 6,000+ combolist access (credentials and credit cards)––

Combolists––

Tactical intelligence

Threat feed/IoC: 100+ feed sources✔︎✔︎

Threat feed/IoC: paid feed sources––

Threat feed/IoC: attackers✔︎✔︎

Threat feed/IoC: botnet & malware✔︎✔︎

Threat feed/IoC: bad reputation✔︎✔︎

Threat feed/IoC: ransomware✔︎✔︎

Threat feed/IoC: phishing✔︎✔︎

Threat feed/IoC: hacked website✔︎✔︎

Threat feed/IoC: APT feed✔︎✔︎

Threat feed/IoC: DDoS✔︎✔︎

Threat feed/IoC: honeypot✔︎✔︎

Threat feed/IoC: customized collection list✔︎✔︎

IoC enrichment: IoC search✔︎✔︎

IoC enrichment: IoC scoring✔︎✔︎

IoC enrichment: instant IoC enrichment–✔︎

Dark web news: hacker forums/Telegram/Discord/IRC/ICQ✔︎✔︎

Dark web news: ransomware attack monitoring✔︎✔︎

Dark web news: industry- and region-based subscription✔︎✔︎

Malware analysis✔︎✔︎

Threat hunting rules: 20,000+ SIGMA/YARA rules access1,000 rules accessUnlimited

Operational intelligence

Ops intel trend––

Threat actor intelligence: industry- and region-based monitoring✔︎✔︎

Threat actor intelligence: APT & cybercriminal campaign access✔︎✔︎

Threat actor intelligence: MITRE ATT&CK mapping✔︎✔︎

Threat actor intelligence: customized notifications✔︎✔︎

Threat actor intelligence: IoCs✔︎✔︎

Ransomware intelligence: industry- and region-based monitoring✔︎✔︎

Ransomware intelligence: APT & cybercriminal campaign access✔︎✔︎

Ransomware intelligence: MITRE ATT&CK mapping✔︎✔︎

Ransomware intelligence: customized notifications✔︎✔︎

Ransomware intelligence: IoCs✔︎✔︎

Campaigns: industry- and region-based monitoring✔︎✔︎

Campaigns: customized notifications✔︎✔︎

Threat reports: global report access✔︎✔︎

Threat reports: SOCRadar report access✔︎✔︎

Threat reports: industry report access✔︎✔︎

Threat reports: regional report access✔︎✔︎

Supply chain intelligence

Vendor tracking✔︎✔︎

Incident-based vendor monitoring✔︎✔︎

Assessment report✔︎✔︎

Alarms✔︎✔︎

API & integration

API & integration (Threat feeds/IoCs integration, Threat Investigation, Breach Dataset, Vulnerability, Threat Actor APIs)–Included

Management & support

Email & chat support✔︎✔︎

Log audit✔︎✔︎

Single sign-on (SSO)✔︎✔︎

Role-based access–✔︎

For commercial use–Flexible

See the full Cyber Threat Intelligence page →

Attack Surface Management Essential

Discover and monitor your external assets.

Talk to Sales

Monthly scan period
Continuous digital asset discovery & monitoring
External network security monitoring
Mail, SSL & website security issues
Information disclosure issues

Best value

Attack Surface Management Business

Adds weekly scans and mobile app coverage.

Talk to Sales

Weekly scan period
Mobile application monitoring/analysis & assessment
Log audit & SSO

Attack Surface Management Ultimate

For commercial and enterprise use.

Talk to Sales

Daily scan period
Active vulnerability scanning: CISA KEV check & ransomware check
Advanced Attack Surface Threat Assessment (ASTA), built in-house by SOCRadar
API & integration (Flexible)
Role-based access
OnWatch services (Flexible)

Want to see the platform in action first? Start for free with SOCRadar Freemium

Compare plansEssentialBusinessUltimate

Credits & limits

User limit111

Copilot credit500500500

Discovery & monitoring

Scan periodMonthlyWeeklyDaily

Continuous digital asset discovery & monitoring✔︎✔︎✔︎

Asset discovery path & history✔︎✔︎✔︎

Asset inventory & management✔︎✔︎✔︎

Technology & service identification✔︎✔︎✔︎

Risk prioritization & scoring✔︎✔︎✔︎

Alerting & notification✔︎✔︎✔︎

Customizable alarm management✔︎✔︎✔︎

Code repository monitoring✔︎✔︎✔︎

Cloud storage monitoring✔︎✔︎✔︎

Mobile application monitoring/analysis–✔︎✔︎

Visual attack surface mapping✔︎✔︎✔︎

Legitimate social account monitoring✔︎✔︎✔︎

SSL certificate analysis✔︎✔︎✔︎

Website uptime/IPS monitoring✔︎✔︎✔︎

On-demand port scanning✔︎✔︎✔︎

On-demand SSL certificate analysis✔︎✔︎✔︎

Third Party domain monitoring✔︎✔︎✔︎

DNS monitoring✔︎✔︎✔︎

Security misconfiguration

Information disclosure issues✔︎✔︎✔︎

Mail security issues✔︎✔︎✔︎

DNS security issues✔︎✔︎✔︎

SSL security issues✔︎✔︎✔︎

Mobile application issues–✔︎✔︎

Website security issues✔︎✔︎✔︎

Cloud security issues✔︎✔︎✔︎

External network security monitoring✔︎✔︎✔︎

Vulnerability assessment

Mobile application assessment–✔︎✔︎

Passive vulnerability scanning✔︎✔︎✔︎

Active vulnerability scanning: periodic scan––✔︎

Active vulnerability scanning: CISA KEV check––✔︎

Active vulnerability scanning: ransomware check––✔︎

Advanced Attack Surface Threat Assessment (ASTA, built in-house by SOCRadar): periodic scan––✔︎

ASTA: on-demand scan––✔︎

ASTA: scan configurator––✔︎

ASTA: customized alarm management––✔︎

ASTA: historical vulnerability evidence monitoring––✔︎

ASTA: cloud security––✔︎

ASTA: network security––✔︎

ASTA: mail security––✔︎

ASTA: website security––✔︎

ASTA: API security (beta)––✔︎

ASTA: database security––✔︎

ASTA: DNS security––✔︎

API & integration

API & integration (Incident Integration, Vulnerability, DFP APIs)––Flexible

Premium services

SOCRadar University access✔︎✔︎✔︎

OnWatch services––Flexible

Management & support

Email & chat support✔︎✔︎✔︎

Log audit–✔︎✔︎

Single sign-on (SSO)–✔︎✔︎

Role-based access––✔︎

For commercial use––Flexible

See the full Attack Surface Management page →

Brand Protection Essential

Core impersonation and phishing monitoring.

Talk to Sales

Phishing detection & monitoring
Automated takedown requests
Custom AI-agent workflows
Stolen credit card detection (banks only)
10 IP addresses & IP blocks

Best value

Brand Protection Business

Adds social media and dark web monitoring.

Talk to Sales

Impersonating social account detection & X (Twitter) content detection
Dark web monitoring: hacker discussions, employee/customer data breaches, stealer malware & botnet tracking
5 brand keywords · 50 IP addresses & IP blocks
5 mobile applications · 5 social media accounts
Log audit & SSO

Brand Protection Ultimate

Flexible limits for enterprise-wide brand protection.

Talk to Sales

3+ domains (Flexible) · 15 brand keywords
50+ IP addresses & IP blocks (Flexible)
Dark web monitoring (Flexible)
API & integration (Flexible)
Role-based access

Want to see the platform in action first? Start for free with SOCRadar Freemium

Compare plansEssentialBusinessUltimate

Credits & limits

Company name limit111

Domain limit113+ (Flexible)

Brand keyword limit1515

IP addresses & IP blocks limit105050+ (Flexible)

Mobile application limit–55+ (Flexible)

Social media account limit–55+ (Flexible)

DLP identifier–11+ (Flexible)

Third Party employee limit–1010+ (Flexible)

Anti-phishing web token115

User limit111

Copilot credit50250500

Brand monitoring

Phishing detection & monitoring✔︎✔︎✔︎

Mobile application monitoring–✔︎✔︎

IP/domain blacklist monitoring✔︎✔︎✔︎

Custom AI-agent workflows✔︎✔︎✔︎

Social media monitoring

X (Twitter) content detection–✔︎✔︎

Impersonating social account detection–✔︎✔︎

Fraud protection

Stolen credit card detection (banks only)✔︎✔︎✔︎

Dark web monitoring

Hacker discussions monitoring–✔︎Flexible

Employee/customer data breaches–✔︎Flexible

Stealer malware & botnet tracking–✔︎Flexible

Surface web monitoring

Cloud storage monitoring✔︎✔︎✔︎

Code & API repo monitoring✔︎✔︎✔︎

Malware analysis service monitoring✔︎✔︎✔︎

Takedown management

Takedown management panel✔︎✔︎✔︎

Detailed takedown tracking✔︎✔︎✔︎

Automated takedown requests✔︎✔︎✔︎

Takedown types: impersonating domains, impersonating social media accounts, rogue mobile apps, fraud and scam pages, code repository content✔︎✔︎✔︎

Data source coverage

Dark web sources: private hacker forums, private hacker channel market, Tor, Telegram, Discord✔︎✔︎✔︎

Surface web sources: API repositories, code repositories, public buckets✔︎✔︎✔︎

Social media sources: X (Twitter), Instagram, Facebook, YouTube, TikTok (50+)–✔︎✔︎

API & integration

API & integration (Incident, Takedown, Leak APIs)––Flexible

Management & support

Email & chat support✔︎✔︎✔︎

Log audit–✔︎✔︎

Single sign-on (SSO)–✔︎✔︎

Role-based access––✔︎

For commercial use––Flexible

See the full Brand Protection page →

Your license:

The full XTI platform, your complete pictureBook a Demo

We are secure

ISO/IEC 27001 certified badge — ISO/IEC 27001

SOCRadar helps you comply

ISO/IEC27002
NISTCybersecurity Framework (CSF)
DORADigital Operational Resilience Act
PCI DSS v4.0Payment Card Industry Data Security Standard

HIPAA NIST SP 800-53 CCPA NCA NESA NCSA NCSC NTRA

Trusted by security teams worldwide

A recognized leader in Extended Threat Intelligence

4.7/5

NPS

30,000+businesses protected

3.3M+alarms generated

100+countries

6G2 category badges

What our customers say.

How much does SOCRadar cost?

It depends on the modules and tiers you choose. Some tiers, such as Cyber Threat Intelligence Essential and Advanced Dark Web Monitoring Essential, have published annual prices you can buy online. Other tiers and module combinations are quoted to fit your scope. Book a demo and we’ll help you size the right license.

How much does dark web monitoring cost?

Advanced Dark Web Monitoring Essential costs $4,550 per year, or $600 per month on monthly billing. Business costs $9,100 per year, or $1,145 per month on monthly billing. Ultimate has custom pricing. Essential and Business are fixed packages you can buy online. SOCRadar offers more in custom packages, so we recommend booking a demo to see the full picture before you decide what to buy.

How much does threat intelligence cost?

Cyber Threat Intelligence Essential costs $14,750 per year, or $1,625 per month on monthly billing. Ultimate has custom pricing. Essential is a fixed package you can buy online. SOCRadar offers more in custom packages, so we recommend booking a demo to see the full picture before you decide what to buy.

Is there a free version of SOCRadar?

Yes. SOCRadar Freemium is a free license you can use to explore SOCRadar intelligence at your own pace.

Can I buy a single module, or do I need the whole platform?

Either. Start with one module, combine several into one flexible license, or license the full XTI platform. You can add modules later.

What’s the difference between a module and the XTI platform?

A module covers one area and can be licensed on its own. The full XTI platform is all five modules together: Attack Surface Management, Brand Protection, Cyber Threat Intelligence, Advanced Dark Web Monitoring and Supply Chain Intelligence.

What does each module cover?

Attack Surface Management discovers your internet-facing assets and monitors them for exposures, with vulnerability scanning and SSL, DNS and cloud storage checks. Brand Protection detects lookalike phishing domains and manages takedowns of impersonating domains, social media accounts and rogue mobile apps. Cyber Threat Intelligence provides threat feeds, enrichment for indicators of compromise (IoCs), threat actor intelligence, vulnerability intelligence, malware analysis and SIGMA/YARA rules. Advanced Dark Web Monitoring tracks hacker discussions, data breaches and stealer malware across the deep and dark web. Supply Chain Intelligence assesses the security posture of your vendors for Third Party risk management.

What is Agentic Threat Intelligence (ATI)?

ATI is the AI-agent layer of the SOCRadar XTI platform. AI agents help your team track threats and assess their context.

How long does setup take?

SOCRadar runs fully online, so there is nothing to install. After your first login, setup usually takes a couple of hours and can take up to 24 hours.

What happens when I run out of credits?

With a flexible license, you can buy more credits at any time. Credit top-ups aren’t available on fixed packages such as Cyber Threat Intelligence Essential or Advanced Dark Web Monitoring Business.

Do you cover Third Party and supply chain risk?

Yes. The Cyber Threat Intelligence module includes vendor tracking, incident-based vendor monitoring, assessment reports and alarms. For vendor risk management, the Supply Chain Intelligence module adds vendor security assessments with a Security Trust Score for each vendor, risk findings mapped to frameworks and white-label reporting.

Does SOCRadar support GDPR, DORA, PCI DSS and HIPAA?

Yes. SOCRadar is SOC 2 Type 2 and ISO/IEC 27001 certified, and helps you meet the requirements of frameworks such as GDPR, PCI DSS v4.0, DORA, NIST CSF, ISO/IEC 27002 and HIPAA.

Where is my data stored?

SOCRadar runs on Google Cloud, which lets us store your data locally in your region.

Do you offer pricing for MSSPs and resellers?

The plans on this page are for direct customers. MSSPs and resellers can apply to our partner program through the partner application form.

See your organization through an attacker’s eyes

Book a 30-minute demo to size the right license, or start for free today.

Book a Demo Start for Free

Build your flexible Extended Threat Intelligence (XTI) license

Advanced Dark Web Monitoring (deep & dark web) plans & pricing

Advanced Dark Web Monitoring Essential

Advanced Dark Web Monitoring Business

Advanced Dark Web Monitoring Ultimate

Cyber Threat Intelligence (CTI) plans & pricing

Cyber Threat Intelligence Essential

Cyber Threat Intelligence Ultimate

External Attack Surface Management (EASM) plans & pricing

Attack Surface Management Essential

Attack Surface Management Business

Attack Surface Management Ultimate

Brand Protection plans & pricing

Brand Protection Essential

Brand Protection Business

Brand Protection Ultimate

Supply Chain Intelligence (TPRM) plans & pricing

Supply Chain Intelligence

We are secure

SOCRadar helps you comply

A recognized leader in Extended Threat Intelligence

What our customers say.

Plans & pricing FAQ

See your organization through an attacker’s eyes