What does a threat intelligence platform cost when you self-host it?
A security team weighing a self-hosted MISP or OpenCTI against a commercial TIP subscription should know first that the software license is often zero. MISP is licensed under AGPL-3.0 and is free to use, and OpenCTI's Community Edition is licensed under Apache License 2.0. The cost therefore sits elsewhere: in the infrastructure OpenCTI depends on (Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO), in connector and integration work, in paid feeds, in analyst time spent curating indicators, and in any OpenCTI Enterprise subscription if you need features outside the Community Edition. Infrastructure and staff time recur every year; the initial build, connector configuration and integration into the SIEM and firewalls are largely one-time, though they need upkeep as upstream releases change.
Several of these costs move with scope. The number of connectors and feeds, the volume of indicators retained, the number of analysts who consume or enrich data, and whether you run a sharing community instance all change the sizing and the labor. OpenCTI's documented minimums are a starting point, not a plan: the deployment overview lists 2 cores and at least 8 GB RAM for the platform and 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch, and recommends at least one platform node for every 3 workers. Confirm which of these resources your own hosting model charges for, and whether a backup and disaster recovery copy of the search and storage tiers is included in the estimate. Also confirm whether the OpenCTI LTS line, which requires a specific license key, is part of your plan.
When you request a quote, ask the partner to price each component separately and tie every line to written scope, because DeployOpen does not publish a price list and a quote follows from the agreed scope. Ask for the one-time build items, the recurring operations items, and the licensing items, and ask which OpenCTI features in your requirements need the Enterprise Edition according to the OpenCTI Enterprise Edition documentation. Compare that with the commercial TIP subscription quote on the same basis, including feed fees, connector support and analyst seats. Only a like-for-like scope makes the self-hosted and subscription options comparable.
Which cost components apply to in-house, partner and SaaS delivery
This table shows which cost components apply under each delivery model and whether each one is paid once or recurs. Read each row as a question to put to a quote: who is paid for that item, and does the cost repeat every year. The main takeaway is that open-source platforms remove the license line but keep infrastructure, curation and maintenance costs, which move between your team, a partner and a SaaS vendor.
| Cost component | In-house | Implementation partner | Commercial SaaS |
|---|---|---|---|
| Software license | MISP and OpenCTI Community Edition carry no license fee, so this is recurring only if you buy OpenCTI Enterprise | Usually the same as in-house; partner fees cover work, not the open-source license | Recurring subscription, usually per tenant or per seat, paid to the vendor |
| Infrastructure (Elasticsearch or OpenSearch, Redis, RabbitMQ, S3-compatible storage, MySQL or MariaDB) | One-time build and recurring hosting, paid to your cloud or data center providers | Recurring hosting paid by you to your provider; partner charges for design and setup | Included in the subscription; confirm data residency and storage limits |
| Connector and integration work | One-time build by your staff, then recurring upkeep when SIEM, firewall or SOAR versions change | One-time fixed-scope build paid to the partner, then recurring support if retained | Vendor-provided connectors; custom integrations billed separately, confirm scope |
| Paid threat feeds | Recurring subscriptions paid directly to feed providers | Recurring feed fees paid by you; partner may configure but does not supply feeds | Often bundled in part; premium feeds usually extra, confirm which sources are included |
| Analyst curation time | Recurring internal staff time for triage, tagging, false-positive aging and sharing decisions | Recurring internal time remains; partner may provide curation support under a separate agreement | Recurring internal time remains; SaaS reduces tooling work but not judgment work |
| OpenCTI Enterprise subscription | Recurring fee paid to Filigran if Enterprise features are needed; not required for Community Edition | Recurring fee paid to the vendor, passed through or quoted separately | Not applicable as such; confirm which features the SaaS tier includes |
| Upgrades and patching | Recurring staff time for release tracking, testing and rollout of MISP or OpenCTI versions | Recurring retainer if you buy upgrade support; otherwise paid per upgrade project | Recurring inside the subscription; confirm upgrade windows and change notice |
| Backup, restore testing and support | Recurring storage and staff time; restore testing is often skipped without a budget line | Recurring retainer or one-time setup; support tiers should be stated in writing | Recurring in the subscription; confirm backup retention, restore process and support hours |
Which costs are one-time and which recur every year
MISP is licensed under AGPL-3.0, so there is no software license fee. The money goes to the people and infrastructure around it. One-time work covers installing the platform on a supported base, configuring taxonomies, galaxies and default feeds, choosing distribution levels and sharing groups, and wiring MISP into your SIEM, firewalls and SOAR. Recurring work covers the servers, database and Redis capacity, storage, analyst curation of indicators, paid or community feed subscriptions you choose to add, and upgrades.
- Start on the current line: MISP 2.5 is the recommended version for new deployments, and MISP 2.4 is end of life with security fixes only. Do not budget a new 2.4 instance, and plan a 2.5 upgrade path from day one.
- Setup: installation on Ubuntu 24.04 with the provided installer or another supported method, connector and export configuration, and SIEM or firewall integration.
- Data model decisions: agreeing on distribution levels, sharing groups and who may publish, which are one-time design costs that are expensive to reverse later.
- Recurring infrastructure and feeds: hosting, backups, and any commercial feeds your analysts rely on, each renewed on its own schedule.
- Recurring curation and upgrades: ongoing analyst time to review and age out indicators, plus periodic upgrades and security patching.
Ask any implementation partner to split the quote into these one-time and recurring lines, and confirm who holds the upgrade and patching obligation after handover.",
OpenCTI Community Edition is licensed under Apache License 2.0, so the software itself carries no license fee. Its cost profile is heavier on infrastructure than MISP because a deployment includes the platform, Python workers consuming RabbitMQ messages, connectors, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO. One-time work includes standing up this stack, configuring connectors for each feed and tool, and designing the STIX2-based data model. Recurring work includes running all of those components and keeping connectors current.
- Sizing: the documented minimums are 2 cores and at least 8 GB RAM for the platform, and 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch, with at least one platform node for every 3 workers.
- Connector work: each import, enrichment or export connector is configured once and then maintained as versions change.
- Release cadence: non-LTS releases ship from daily to weekly, so budget time to test and apply them.
- Dependency versions: Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, and RabbitMQ 3.11 or later must be kept supported.
- Community support: no vendor support contract is included, so any production support must come from your team or a partner.
Confirm with the partner whether connector maintenance and dependency upgrades are inside the fixed scope or sit in a separate retainer.",
OpenCTI Enterprise Edition is proprietary and governed by the OpenCTI Enterprise Edition License, so it adds a subscription cost on top of the infrastructure. Enterprise features and LTS access are the reasons to check this option. LTS releases require a specific LTS license key, are distributed as container images, and receive only critical bug and security fixes after a one-month stabilization period. The subscription is therefore a recurring cost, and it may need renewal with each LTS line.
- Subscription: a recurring license cost, with terms set by the vendor, Filigran, rather than by DeployOpen. Request the price and renewal terms in writing.
- LTS cadence: LTS releases occur every 6 months, each supported for 1 year, with a 6-month overlap between consecutive LTS versions, which shapes your upgrade calendar.
- Feature scope: confirm which features your use case needs are in the Enterprise Edition, since some may be absent from Community.
- Migration: moving from Community to Enterprise, or from one LTS line to another, is a planned upgrade with its own test cost.
- Infrastructure stays: the same Elasticsearch or OpenSearch, Redis, RabbitMQ and storage costs still apply.
Ask for the Enterprise Edition docs and the license terms before the quote, and confirm which LTS line the partner will deploy and how upgrades are billed.",
A commercial threat intelligence platform is usually bought as a subscription, so most of the cost recurs. The subscription typically bundles hosting, updates and some feeds, which reduces infrastructure work but moves data handling and feed selection into the vendor's terms. One-time costs are onboarding, integration into your SIEM, firewalls and SOAR, and the data model and sharing rules you configure in the vendor's tool. Recurring costs are the subscription, any feed or seat add-ons, your analyst curation time, and vendor-driven change.
- Subscription terms: check the price basis (seats, feeds, indicators or data volume), the renewal and price-increase clauses, and the exit terms.
- Integration work: connections to your SIEM, firewalls and SOAR are often one-time, but each must be retested when either side changes.
- Data handling: confirm where indicators and any personal data are stored and processed, and who may access them.
- Sharing: check whether the vendor supports the sharing communities you need, and whether those communities accept the platform.
- Hidden recurring work: curation, false positive aging and vendor review still fall on your staff.
Request a written breakdown of all subscription components and the cost of leaving the platform, so the comparison with a self-hosted option is complete.
What moves the threat intelligence platform cost up or down
The software licence is rarely the largest line in a self-hosted threat intelligence programme. Most of the cost comes from how much data the platform holds, how many sources feed it, who it shares with, which features need a paid edition, the infrastructure it runs on, and the analyst time needed to keep indicators useful.
Indicator and source volume
The number of indicators, events and feeds sets the size of the search backend, the storage and the worker capacity. A community that ingests a few commercial and open feeds has very different hardware needs from one that correlates bulk telemetry for years. Ask a partner to estimate indicator counts per day, retention periods and peak ingest before comparing any quote, because these inputs drive the infrastructure line more than any other single choice.
Connectors and enrichment feeds
Every connector, import job and enrichment service adds build work, runtime load and maintenance. Paid feeds carry recurring licence fees that the provider sets, so they should be listed line by line in the quote. Each connector also needs an owner who handles upstream API changes and credential rotation. Ask who builds and tests connectors, who pays for each feed, and whether the quote includes ongoing maintenance.
Sharing communities and synchronization
Joining trusted communities and synchronizing with partner instances adds onboarding work, governance rules and sharing-group configuration. Each sync link needs monitoring, certificate handling and review of what is published outward. Hub-style deployments that serve members cost more in administration than single-organization instances. Confirm how many communities and sync partners are in scope, and who approves outbound distribution.
Enterprise features versus Community
OpenCTI Community Edition is licensed under Apache License 2.0, while Enterprise Edition features fall under a separate proprietary licence with its own subscription terms. Before comparing against a commercial product, list the features you need, such as particular connectors, support tiers or LTS entitlements, and confirm with Filigran which edition provides each one. OpenCTI LTS releases also require a specific LTS license key, so include that in the cost model.
Hosting footprint and operations
OpenCTI depends on Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage, and each service needs backups, patching, monitoring and capacity planning. The documented minimums are a platform with 2 cores and at least 8 GB RAM, and a search node with 2 cores, 8 GB RAM and 16 GB SSD. Production sizing will be higher. Ask for a bill of materials covering compute, storage, backup and the staff time to run each service.
Analyst curation time
Intelligence is only worth its cost when analysts age out stale indicators, remove false positives, tune scoring and turn reports into detection content. This labour often exceeds software and hosting spend, and it recurs for as long as the programme runs. Decide which team owns curation, how many hours per week it can give, and whether a partner will run curation under a retainer. Quotes that exclude curation understate the true cost.
Why OpenCTI infrastructure costs more than the MISP footprint
The main infrastructure difference between the two platforms is the number of moving parts. An OpenCTI deployment is a chain of services: the platform (UI and GraphQL API), Python workers that consume RabbitMQ messages for asynchronous writes, connectors for import, enrichment, export and stream consumption, Elasticsearch or OpenSearch (8.0 or OpenSearch 2.9 or later), Redis 7.1 or later, RabbitMQ 3.11 or later, and S3-compatible storage such as MinIO. Each of these needs its own hosting, patching, backup, monitoring and capacity planning, and each is a component your operations team must be able to restore.
The documented sizing starts at 2 cores and at least 8 GB RAM for the platform, and 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch. The guidance also recommends at least one platform node for every 3 workers, so worker count and connector count drive the platform tier as well as the search tier. MISP, by contrast, runs on PHP with CakePHP, MySQL or MariaDB and Redis, a stack most Linux operations teams already run, and MISP 2.5 has a provided installer for Ubuntu 24.04 along with Docker images and Ansible roles. The sizing figures above are minimums from the documentation, not a estimate for your environment. Ask the vendor or partner to size against your expected indicator volume, enrichment rate, retention period and number of concurrent analysts, and to show the worked calculation.
Treat the infrastructure line as recurring, not one-time. Compute, storage growth in the search index, backup retention, RabbitMQ queue depth and worker scaling all change as feeds grow, so the cost you budget at launch will drift. Ask any partner for a written sizing model, a staging load test that uses your real feed mix, and a list of which components will need a separate patch and upgrade window. Confirm your own hosting cost per node in your cloud account or data center rather than relying on a generic figure.
How to build your own threat intelligence platform cost estimate
This sequence turns an open-ended question about MISP or OpenCTI spend into a costed comparison with a fixed-scope partner quote and a commercial SaaS baseline, so you can see which costs are one-time, which recur, and which only your own environment can supply.
Define intelligence consumers and sources
Start by listing who will use the intelligence (SOC analysts, incident responders, fraud teams, vulnerability management, leadership) and which sources feed the platform, such as sharing communities, commercial or open feeds, and internal incident data. Record the number of named users and the expected analyst roles, since these drive access control design and curation load. Done when each consumer has a written use case and each source has an owner and a licence status.
List required feeds and sharing communities
Enumerate every feed and sharing community you intend to join, noting its cost model, licence terms, and whether it is free, paid, or membership-based. Confirm distribution and TLP handling rules with each community before import, because these determine sharing group design. Ask each provider for written pricing, since no feed prices are supplied here. Done when you have a dated register of feeds with confirmed costs and terms.
Size infrastructure from documented minimums
For OpenCTI, start from the vendor's documented minimums: the platform at 2 cores and at least 8 GB RAM, Elasticsearch or OpenSearch at 2 cores, 8 GB RAM and 16 GB SSD, Redis 7.1 or later, RabbitMQ 3.11 or later, and S3-compatible storage such as MinIO, with at least one platform node for every 3 workers. For MISP, plan around its MySQL or MariaDB and Redis dependencies and the vendor's recommended Ubuntu 24.04 platform. Your own indicator volume, retention period and replication requirements will change these numbers, so have your platform engineers and cloud or data center team calculate them. Done when you have a bill of materials priced at your own cloud or hardware rates.
Count connectors and integrations
List each connector and integration the platform needs: import, enrichment, export and stream connectors for OpenCTI, plus MISP export formats for your SIEM, firewalls, Suricata and Zeek sensors, and SOAR. For each, record who builds it, who maintains it after upgrades, and the test effort. Confirm with the vendor and your partner which connectors are supported in the Community Edition and which depend on the Enterprise Edition. Done when every integration has an owner, a build estimate from the partner, and a maintenance owner.
Estimate weekly curation hours
Estimate how many analyst hours each week go to reviewing imported indicators, tagging with taxonomies, aging out false positives, and publishing to sharing groups. Base the estimate on the feed volume from step two and the number of consumers from step one, then validate it with a two to four week pilot on real feeds. Done when you have a weekly hours figure from your own pilot and a clear rule for who owns each curation task.
Decide Community versus Enterprise
For OpenCTI, decide whether the Community Edition under Apache License 2.0 meets your requirements or whether features in the proprietary OpenCTI Enterprise Edition License are needed. For OpenCTI LTS releases, confirm whether you need an LTS license key, since LTS releases require one. MISP is licensed under AGPL-3.0 and has no equivalent paid tier, so compare its operational cost directly. Ask the vendor for written Enterprise pricing and terms. Done when the edition choice is documented with the features that justify it.
Compare with SaaS quotes on the same scope
Request commercial threat intelligence platform quotes using the same feed list, user count, retention period, sharing requirements and integrations from the previous steps. Compare annual subscriptions, feed add-ons, data egress or storage charges, and onboarding fees against your build bill of materials plus internal staff time and partner fees. Check where each option stores data and who can access it. Done when you have a like-for-like table with every figure traced to a written quote or your own calculation.
Request a written fixed-scope partner quote
Send your scope, feed register, integration list, curation estimate and edition decision to one or more implementation partners and ask for a written fixed-scope proposal with deliverables, responsibilities, assumptions and exclusions. Ask how connector upgrades, feed changes and platform patches are priced, and whether support is a separate retainer. DeployOpen scopes and quotes engagements in writing before work starts, and any partner should do the same. Done when you hold a signed-off scope and a quote you can compare against the build and SaaS totals.
Licensing terms that change the bill: AGPL, Apache and OpenCTI Enterprise
The license on each component decides which costs are avoidable and which are not. MISP is licensed under AGPL-3.0, so the software itself carries no license fee, but the AGPL obligations apply if you modify the code and make it available to users over a network, which matters if you customize the interface or build a portal on top of it. Its taxonomies and galaxies are a separate matter: they are licensed under CC0 1.0 Universal or the 2-clause BSD license, so you can reuse them without the copyleft terms of the software. Confirm with your counsel how your planned changes and internal integrations fall under AGPL, and record which data packs you load and under which terms, because the sharing community you join may impose its own rules on reuse.
OpenCTI Community Edition is licensed under Apache License 2.0, which is permissive and does not require you to publish your modifications. The Enterprise Edition is a different product under the proprietary OpenCTI Enterprise Edition License, so any feature you need from it adds a subscription cost and a contractual obligation. Before you compare totals, list every feature in your requirements and check it against the OpenCTI Enterprise Edition documentation. Ask the vendor or your partner to confirm which features you need are Community features and which are Enterprise-only, and whether the subscription includes support, upgrades or the LTS license key.
OpenCTI long-term support releases need a specific LTS license key to run, which is a licensing condition as well as a support decision. After a one-month stabilization period, LTS releases receive only critical bug and security fixes, so feature work will move to newer lines on a schedule you need to plan around. Ask what happens to your deployment if a key is not renewed, and how a key is issued for a self-hosted instance in an air-gapped or restricted network. Also agree in writing who owns the upgrade work, whether it is your team, a DeployOpen retainer or a fixed-scope project, because the license terms set the upgrade cadence and the labor follows from it.
Questions buyers ask about threat intelligence platform cost and effort
Does MISP really have no license cost?
MISP has no software license fee because it is open source under the GNU AGPL version 3, so the cost sits elsewhere. You still pay for the servers or virtual machines that host it, the database and Redis, backups, storage and the time to install, patch and upgrade it. Taxonomies and galaxy data are licensed separately under CC0 1.0 or the 2-clause BSD license, which also carries no fee. Any paid commercial feed you subscribe to has its own terms and price. Confirm with each feed provider what its license allows you to share with members of a sharing community, because those terms, not the MISP license, decide what you may redistribute.
How much does a self-hosted OpenCTI cost in infrastructure?
OpenCTI's Community Edition carries no license fee under Apache License 2.0, but a production deployment needs several components that you run and pay for. The platform, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO each need hosting, and the documented sizing starts at 2 cores and at least 8 GB RAM for the platform and 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch. Workers and connectors add load, and the deployment overview recommends at least one platform node for every 3 workers. Ask your team to size the stack against your indicator volume, retention period and enrichment connectors before you compare cloud or hardware prices.
Can our team deploy a threat intelligence platform without outside help?
A team with Linux, container and database experience can deploy MISP or OpenCTI alone, because both are documented and self-hosted. MISP 2.5 is recommended on Ubuntu 24.04 with the provided installer, and Docker images, Ansible roles, Puppet and RPM packages are also listed. The harder work is operational: connecting feeds, setting sharing groups and distribution levels, writing integrations into the SIEM, firewall and SOAR, and keeping indicators curated. Outside help is most useful when you need those integrations, a review of the sharing rules, or a documented runbook. DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted platforms inside your own environment, under a written, fixed scope.
How long does setup take and what does it need from staff?
Setup time depends on the platform, the number of integrations and how many sharing communities you join, and no supplied figure gives a reliable duration, so ask for a timeline in the written scope. Plan for staff with Linux and container administration, a database and Redis operator, someone who understands STIX and TLP handling, and an analyst who will curate indicators after go-live. Confirm the upgrade path before you start: MISP 2.4 is end of life with security fixes only and the project advises against new 2.4 installations, while OpenCTI LTS releases require a specific license key. Those upgrade rules shape the ongoing staff load as much as the first install does.
What drives the recurring cost of a self-hosted threat intelligence platform?
Recurring cost comes from four areas: infrastructure that runs continuously, paid feeds and their renewals, analyst time for curation and false positive handling, and upgrade and maintenance work. Infrastructure grows with indicator volume, retention and the number of connectors, and storage and search nodes are the largest drivers in OpenCTI. Paid feeds are priced by each provider and usually renew annually, so ask for the renewal terms in writing. If you choose OpenCTI Enterprise Edition, its subscription is a recurring license cost under a separate proprietary license, so confirm with Filigran which features you need and what the subscription includes. Curation time is often the least visible cost and grows with each feed you add.
When is a commercial threat intelligence SaaS cheaper than self-hosting?
A commercial SaaS is more likely to be cheaper when you have few analysts, no spare platform engineers, low indicator volume and no requirement to keep data inside your own network. Self-hosting becomes more attractive when data residency, air-gapped operation, sharing with specific communities or deep customization matter, because those needs are hard to meet with a shared service. Compare both options on the same basis: subscription or license fees, hosting, feeds, staff hours for operations and upgrades, integration work and exit costs. Ask each SaaS vendor for its data processing terms, where indicators are stored, and what happens to your data if you leave.
What should we ask for in a threat intelligence platform quote?
Ask for a written scope listing each deliverable, the platforms and versions in use, the integrations and connectors to configure, and the sharing communities or feeds to onboard. The quote should separate one-time work, such as installation, integration and documentation, from recurring work such as backups, upgrades and support retainers. Ask how the scope handles change requests and which items depend on your infrastructure or on third-party feeds. DeployOpen does not publish a price list, and a quote follows from that written scope. Confirm that the scope excludes any compliance attestation, since independent auditors and certification bodies issue those, not the implementer.
What a partner quote should include before you sign
A quote is only comparable to another quote if both price the same written scope, so ask for that scope before you ask for a number. DeployOpen does not publish a price list. Most engagements are fixed-scope, which means the scope, deliverables and timeline are agreed in writing before work starts, and the quote follows from that document. For a MISP or OpenCTI build, the scope should name the chosen platform and version, the operating system and deployment method, and each dependency it installs. For OpenCTI, that list includes Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO. For MISP, it includes the database and Redis. Ask the partner to state which pieces run in your cloud account, data center or enclave, and which are hosted for you.
The scope should also list every connector, feed import, export and integration, along with the sharing configuration. Ask for the named connectors and feeds, the SIEM, firewall or SOAR targets, and the export formats each will use, such as STIX, Suricata or Zeek. Sharing group and distribution level setup is often underpriced, so ask who defines the rules, who approves them, and whether the partner configures sharing groups down to individual attributes or only at the event level. Then confirm the operational items: backup and restore testing, upgrade procedures, the documentation handed over, and how knowledge transfer to your team is delivered. Ask whether each item is a one-time deliverable or recurs.
Finally, check whether ongoing support is a separate retainer. Retainers cover ongoing support, upgrades and continuous testing, and they recur, so compare them with your own staffing for patching, connector maintenance and analyst curation. Ask the partner to separate one-time fees from recurring ones and to state what happens to the retainer if a major platform release changes connectors or dependencies. Also confirm any OpenCTI Enterprise Edition licensing your design depends on, because that subscription is paid to Filigran and sits outside the partner's fee. Sign only once the scope, deliverables, exclusions and payment terms are all written down.
How DeployOpen scopes and delivers a fixed-scope threat intelligence platform
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a threat intelligence platform cost decision, we start from a written scope that separates license cost from infrastructure, integration and curation effort, so the comparison with commercial subscriptions rests on numbers you have confirmed.
How we scope
- Scope lists which MISP or OpenCTI components, connectors and feeds are included before any work starts.
- We document the infrastructure your chosen platform needs, such as search, cache, queue and object storage services.
- The scope states whether any OpenCTI Enterprise Edition features are assumed, and what license terms that requires.
How we build
- We deploy the platform in your environment and size its dependencies against the vendor's documented requirements.
- Feed and connector integrations are configured, tested and checked for duplicate or stale indicator handling.
- Security testing covers the platform, its APIs and its integrations with the SIEM, firewalls and SOAR tools in scope.
How we hand over
- Handover includes architecture, cost model inputs, configuration records and runbooks for your operations team.
- We document which recurring costs, such as feeds, storage and upgrades, sit with you and how to review them.
- Compliance readiness material shows how the platform's logs and access controls produce evidence for your assessments.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, scoped in writing.
- Upgrade planning follows the vendor's release and life cycle policy, including LTS license requirements where they apply.
- Ask us to confirm support boundaries, response expectations and who maintains each connector before you sign.
