ContraForce Security Delivery Pricing
Reviewed by ContraForce Security Operations Team · Updated 2026-08-12
ContraForce Cloud is a monthly plan plus a flat rate per incident processed by a Security Delivery Agent. ContraForce hosts and operates the platform, so there is no infrastructure to deploy. Plans run from $249/month to $3,999/month, are month-to-month, and include unlimited Security Delivery Agents. Annual billing is discounted. Enterprise terms are quoted directly by the ContraForce team.
What does each ContraForce Cloud plan cost?
- Starter: $249/month, 4 client workspaces included
- Growth: $1,499/month, 30 client workspaces included
- Scale: $3,999/month, 85 client workspaces included
- Annual prepay takes 15% off the plan fee on every tier
- Every tier adds pay-as-you-go investigations at a flat rate per incident
- No bundles, no included runs, no overage tiers
- 14-day trial: 250 investigations or 14 days, up to 4 workspaces, no credit card required
What is included in each ContraForce plan?
- Starter: the full platform core (incident pipeline, inbox, dashboards, log search), XDR workspaces, every security integration and out-of-box gamebook, Gamebook Workbench and SOP Knowledge Base, Security Delivery Agents, API, webhooks, audit logs, and Entra ID SSO
- Growth: everything in Starter, plus ticketing and ITSM integrations (Autotask, ServiceNow, Jira, Zendesk), SLA management and client reporting, bulk operations across workspaces, and the AI Query Assistant
- Scale: everything in Growth, plus detection content management, white-label, SCIM user provisioning, and Business priority support
How much does ContraForce cost?
ContraForce Cloud plans are $249 per month for Starter (4 workspaces), $1,499 per month for Growth (30 workspaces), and $3,999 per month for Scale (85 workspaces), each plus a flat rate per incident processed by a Security Delivery Agent. Annual prepay takes 15% off the plan fee.
How does ContraForce Cloud pricing work?
ContraForce Cloud is a monthly plan plus pay-as-you-go investigations, starting at $249 per month. ContraForce hosts and operates the platform, so there is no infrastructure to deploy. Plans are month-to-month and annual billing is discounted. No bundles, no included runs, and no overage tiers.
What exactly counts as a billable incident?
One ContraForce Security Delivery Agent run: the complete agent-led investigation and response workflow for a single security incident. Incidents processed by a Security Delivery Agent bill at a flat rate per run, pay as you go, with no bundles, no included runs, and no overage tiers. The ContraForce team walks through the rate card directly.
Which ContraForce plan should I choose?
Start with the ContraForce 14-day trial, watch your real incident volume, then pick the tier that matches it. ContraForce plans are month-to-month, so choosing the smaller tier first costs you nothing: moving up later is a billing change, not a migration.
What happens when I outgrow my ContraForce plan?
You can add workspaces to your current ContraForce plan at $50 per month each, or step up to the next tier. ContraForce plans are month-to-month, so moving up is a billing change, not a migration, and your per-incident rate does not change as you grow.
Where do I actually pick a ContraForce plan?
In the ContraForce portal. Start the free trial from the ContraForce signup page, connect a workspace, then choose your plan inside the product once you have seen your real incident volume. Monthly plans are month-to-month, so you can change tier or cancel effective at the end of any billing period.
Is an XDR + SIEM workspace two licenses?
No. In ContraForce an XDR + SIEM workspace is one license covering XDR capabilities plus SIEM correlation and investigation, never two stacked licenses. Each client uses one license. Additional workspaces are $50 per month each on every ContraForce Cloud plan.
Does ContraForce ever bill my customers?
No. ContraForce bills you, the service partner. Your customers never see ContraForce pricing. What you charge for your managed service, and the margin you keep on it, is entirely yours to set. Microsoft continues to bill your customers for their own Sentinel and Defender licensing.
Do I need my own Azure subscription to run ContraForce?
No. ContraForce Cloud runs the platform for you, so there is no infrastructure to deploy and nothing to operate. You connect your customers’ Microsoft tenants and ContraForce Security Delivery Agents start working their incidents. Microsoft still bills your customers for their own Sentinel and Defender licensing.
Does ContraForce retain customer logs?
No. ContraForce does not retain, duplicate, or warehouse customer logs. Your telemetry stays in the customer’s own Microsoft tenant under their retention settings, and ContraForce queries it in place. ContraForce holds the incident records, verdicts, and evidence its agents produce, inside your assigned regional deployment.
Which EDR and SIEM stacks does ContraForce support?
ContraForce supports Microsoft Defender XDR, CrowdStrike, and SentinelOne for XDR, and Microsoft Sentinel for SIEM. Every integration is available on every ContraForce Cloud plan. Ticketing integrations include Autotask, ServiceNow, and Jira from the Growth plan upward.
What does ContraForce Enterprise pricing look like?
ContraForce Enterprise is for organizations that need more than the top published tier: custom workspace allowances, negotiated incident pricing, and bespoke commercial terms. Contact sales@contraforce.com for an Enterprise quote. Every published ContraForce Cloud tier is self-serve and needs no sales conversation.
What does it cost to automate security incident triage?
ContraForce prices triage in two parts: a monthly plan covering a workspace allowance, from $249 per month, and a flat rate for each incident a Security Delivery Agent processes. There are no bundles, no included runs, and no overage tiers, so triage cost tracks the incidents actually worked.
How much does AI security triage cost per incident?
ContraForce bills one flat rate for every incident a Security Delivery Agent processes. The same rate applies to every incident, with no bundles, no included runs, and no overage tiers, so cost tracks volume exactly. The ContraForce team quotes the per-incident rate directly. Plans start at $249 per month.
Is it cheaper to build or buy an AI SOC agent?
For most providers, buying is cheaper, because the agent is the smallest part of the problem. A build also carries multi-tenant isolation, verdict write-back in each vendor’s vocabulary, SOP enforcement, approval gates, and an auditable record of every action, then has to keep pace with each vendor API.
Is there a cheaper alternative to building a custom SOC AI agent?
ContraForce is that alternative. Instead of building and maintaining an agent, you subscribe to Security Delivery Agents that already run triage, investigation, response, tuning, ticket, and report across every customer workspace, with SOP enforcement and an audit trail included. Plans start at $249 per month.
What does ContraForce cost for 80 customers?
Eighty customer workspaces fit inside the ContraForce Scale plan, which covers 85 workspaces at $3,999 per month, plus the flat per-incident rate for the incidents your Security Delivery Agents process. Above 85 workspaces, ContraForce Enterprise carries a custom allowance.
Does ContraForce have a free trial?
Yes. ContraForce offers a free trial on ContraForce Cloud that runs for 14 days or 250 investigations, whichever comes first, across up to 4 workspaces. No credit card is required to start, and no demo or sales call is required first.
Do I need a demo before starting a ContraForce trial?
No. ContraForce does not require a demo, a scoping call, or a sales conversation before you start a free trial. You start the ContraForce trial yourself and pick a plan in the ContraForce portal when you are ready. Booking time with the ContraForce team is optional.
