Buyers often want a rough number before they book a call. For threat hunting tools, the public pages do not give one. This post records what the tools covered in this post did publish about cost when we reviewed them in September 2026, and what to ask to fill the gap.
What do the vendors publish?
No license prices. We checked each vendor's public site for a pricing page, a price per unit or a starting price, and found none for Mars Security, Nebulock, Anvilogic, Cotool, Vega or Artemis Security.
Two cost-related items are public: - Anvilogic publishes a calculator. It estimates data-lake compute and storage costs, and the page states: "Costs savings do not include Anvilogic annual licensing." It helps model the data side of a move to a data lake; it does not tell you what Anvilogic costs. - Mars Security's September 2026 press release says Mars is available on AWS Marketplace, and that its new intel-to-detection capability is available to all customers at no additional cost. That second point tells existing customers the feature is included; it does not state a price.
Pricing transparency is one of our seven criteria, weighted at 10%. The question we ask is whether there is a published price a buyer can model before a sales call. The scoring method has the detail, and the calculator lets you change how much that criterion counts.
What makes up the total cost?
A license is only part of it. When you model a tool, list four parts.
- The license. The vendor's price, on whatever basis it uses. Ask what that basis is before comparing numbers, because a price per data volume and a price per user cannot be compared directly.
- Your own data platform costs. Tools that query data in place send queries to your SIEM, data lake or cloud log store. Where those platforms charge by data scanned or compute used, a continuous hunting program adds to that bill. Ask how the tool limits the data each query reads.
- Retention. Hunts that look back further need data kept longer. If a tool's value depends on 90 days of history and you keep 30, the cost of keeping more belongs in the model.
- People time. Setup, tuning, reviewing results and maintaining rules all take analyst hours. Some vendors make claims here. Mars Security's press release says it requires no additional detection engineering headcount; Cotool's homepage says it helps teams scale detection, response and threat hunting beyond headcount. Treat claims like these as things to measure in a trial, not as savings to put in a budget.
What should you ask on the sales call?
- What is the pricing basis: data volume, number of sources, number of users, number of endpoints, or something else?
- Is there a minimum contract term or annual minimum?
- Which features are included and which cost extra?
- Is the tool available through a cloud marketplace you already buy from?
- What query load will the tool place on each of our data platforms in a typical week?
- What does a proof of concept cost, if anything, and does it run on our own data?
Write the answers into the same table for every vendor, so the numbers can be compared on the same basis.
Why is nothing published?
We do not know each vendor's reasons, and the pages do not say. What we can say is what the absence means for a buyer: cost comparison waits until after first calls, so the rest of the evaluation should be ready by then. Mapping your data first helps; see mapping your data before a shortlist.
How to compare cost fairly without list prices
- Fix the scope: the data sources, the retention window and the hunts you expect to run.
- Ask every vendor to price that same scope.
- Add your own platform and people costs from the list above.
- Compare total cost against what you observed in a proof of concept, not against feature lists.
We will update this post if any vendor in the ranking publishes a price at the next review.
Sources
Related
Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18