Pricing
One price covers the VORXOC platform, supported security telemetry, AI-led investigation, and 12 months of searchable retention. Add 24/7 Helxon analysts whenever you want humans on the other end.
Pick the band your estate falls into. Every plan includes the platform, supported telemetry, and AI-led investigation, so the only question is whether Helxon analysts run it with you.
Up to 100 endpoints
$650/mo
Self-managed · USD
$6.50 per endpoint / month
$1,300 fully managed
Small teams centralizing security for the first time.
Up to 500 endpoints
$2,850/mo
Self-managed · USD
$5.70 per endpoint / month
$6,500 fully managed
The mid-market default for dependable 24/7 coverage.
Up to 2,500 endpoints
$10,500/mo
Self-managed · USD
$4.20 per endpoint / month
$26,000 fully managed
Multi-site estates with formal security requirements.
2,500+ endpoints
Custom
Self-managed · USD
Volume pricing per endpoint
Managed included fully managed
Regulated, complex, or private deployments.
Prices are USD per month on a 12-month agreement. Endpoint counts cover monitored servers, workstations, and virtual machines. Firewalls, cloud accounts, and identity providers count as integrations, not endpoints.
Most MDR and EDR vendors quote per endpoint, so here is the same math on our flat plans. Rates are calculated at the top of each band, which is the cheapest point in that band.
| Plan | Endpoints | Self-managed | Fully managed |
|---|---|---|---|
| Starter | 100 | $6.50 | $13.00 |
| Growth | 500 | $5.70 | $13.00 |
| Business | 2,500 | $4.20 | $10.40 |
| Enterprise | 2,500+ | Custom | Custom |
Typical MDR provider
$15.00 – $50.00
Per endpoint, per month, before onboarding and log retention add-ons.
Arctic Wolf
$8.00 – $25.00
Per endpoint, per month, commonly bundled into a multi-year agreement.
Traditional SIEM
Volume-based
Billed on gigabytes ingested, so the per-endpoint cost rises as logging improves.
Per-endpoint figures are derived from the plan prices above and are shown for comparison only. VORXOC is not sold per endpoint, so your invoice does not move when you add or retire a machine inside your band. Competitor ranges are published or analyst-reported list rates and typically exclude onboarding fees and log retention add-ons.
Everything marked included ships with every plan at every tier. The rest arrives when you add the fully managed analyst team.
| Capability | Availability |
|---|---|
| Supported security telemetry + 12-month searchable retention | Included |
| AI investigation, case building, and alert prioritization | Included |
| Guided onboarding and supported integrations | Included |
| Detection content, dashboards, and compliance reporting | Included |
| 24/7 human review and escalation by Helxon analysts | Fully managed |
| Guided containment support during an active incident | Fully managed |
| Digital forensics and post-incident reporting | Fully managed |
The platform is identical in both modes. The difference is who watches it at 3am.
Your team operates VORXOC.
You get the full platform, AI-led investigation, and onboarding support. Your analysts own triage decisions and response actions.
Helxon analysts operate it with you.
Everything in self-managed, plus a 24/7 analyst team reviewing cases, escalating real threats, and walking you through containment.
Capabilities are not gated behind higher tiers. Your plan sets the scale you operate at, not the features you get.
Collect from the tools you already run and normalize everything into one schema before detection logic touches it.
Cross-source correlation turns raw alerts into ranked cases with the evidence already attached.
Playbooks act on confirmed incidents inside the boundary your policy defines.
The workspace your team lives in, with the reporting your auditors ask for.
The alternatives are rarely more capable. They are just harder to forecast.
| Capability | Typical SIEM or MDR contract | Helxon VORXOC |
|---|---|---|
| Pricing model | Per-GB ingest or per-user licensing that moves every month | Flat monthly price banded by endpoint count |
| Effective cost per endpoint | $15 to $50 per endpoint, per month, before add-ons | $4.20 to $6.50 self-managed, $10.40 to $13.00 fully managed |
| Telemetry costs | Overage charges push teams to log less than they should | Supported security telemetry included, no routine per-GB overage |
| Alert investigation | Alerts forwarded to your team, or tiered analyst add-ons | Every platform alert investigated by AI before escalation |
| Retention | Often 30-90 days, with archive tiers billed separately | 12 months searchable, included in the plan price |
| Time to value | Multi-month deployment and professional services fees | Typically live in 5 days on supported sources |
Send us your endpoint count and telemetry sources. We will come back with a firm quote, not a discovery call.