Pricing
ThreatCluster is priced as an API. Every account mints a free key: 100 credits a day over the last 7 days, no card. Paid plans raise the daily allowance and include the platform built around the data.
Plans
100 free credits is about 100 record lookups or 20 searches, every day. The public feeds and IOC blocklist need no key or account at all.
| Plan | Price | API allowance | Rate | Includes |
|---|---|---|---|---|
| Free | $0 | 100 credits a day, last 7 days, 25 rows a request | 30 a minute | Every read endpoint: incidents, IOCs, entities, vulnerabilities and dark web. Open reading of every cluster and entity page, plus a personalised feed. Evaluation and personal use. |
| Starter | $19.99 a month | 1,000 credits a day, 90 days of history, 50 rows a request | 120 a minute | Commercial use. Everything in Free, plus custom feeds and alert rules over the API, and the full analyst platform: full timelines, attack flows, dark web and personal alerts. |
| Growth | $99 a month | 5,000 credits a day, full history, 100 rows a request | 240 a minute | Everything in Starter, plus the complete archive back to launch — the whole corpus, not a rolling window. For teams building on the API rather than querying it occasionally. |
| Business | $399 a month | No daily budget, unlimited rows, per-key overrides | 600 a minute | Everything in Growth, plus managed customers (per-client feeds, alerts and branded digests), org sharing and company / domain monitoring. |
The Starter trial needs no card and drops back to Free after 7 days; nothing is charged automatically. Managed customers are enabled per account: tell us how many clients you run and we'll switch it on, priced by the number of clients; the multi-customer surface is on the service providers page. Business is set up over a short call.
Credit packs, for anything past the daily allowance
| Pack | Price | Credits | Roughly |
|---|---|---|---|
| Starter | $10 | 2,000 | 2,000 record lookups, 400 searches or 200 dark-web enrichments |
| Bulk | $50 | 12,000 | 12,000 record lookups, 2,400 searches or 1,200 dark-web enrichments |
One-off, never expire, spent only after the day's allowance, on any plan. Past about 4,000 credits a month, Starter is the better buy.
What a request costs
| Credits | Requests |
|---|---|
| 1 | Records and lists: incidents, entities, vulnerabilities, dark-web lists, stats |
| 3 | Bulk and fan-out: the IOC feed and export, STIX bundles, dark-web keyword hits and trends |
| 5 | Search, one query across the whole corpus |
| 10 | A dark-web victim enrichment record: screenshots, extracted data, negotiation state |
A request that finds nothing costs nothing: empty searches and 404 lookups refund their credits. Every response carries X-Request-Cost and your remaining balance.
The platform, in full
Every plan includes the web platform around the API: the live feed, cluster and entity pages, dark-web console and alerting. This is the complete map of what each plan unlocks.
| Capability | Free | Starter | Growth | Business |
|---|---|---|---|---|
| Intelligence | ||||
| Smart analysis (summary, impact, technical, response) | Read-only on free cluster | ✓ | ✓ | ✓ |
| Threat scoring (0–100, four sub-scores) | ✓ | ✓ | ✓ | ✓ |
| Attack flows (CTID Attack Flow v3) | — | ✓ | ✓ | ✓ |
| Full cluster / event timeline | First 3 events | ✓ | ✓ | ✓ |
| Threat graph (entity relationships, STIX) | — | ✓ | ✓ | ✓ |
| D3FEND countermeasures | — | ✓ | ✓ | ✓ |
| CWE extraction | — | ✓ | ✓ | ✓ |
| Public exploit tracking (Sonar) | — | ✓ | ✓ | ✓ |
| Sub-article link enrichment | — | ✓ | ✓ | ✓ |
| X / Twitter intelligence | — | ✓ | ✓ | ✓ |
| Rising threats (Explore) | — | ✓ | ✓ | ✓ |
| Dark web | ||||
| Ransomware leak-site tracking | — | ✓ | ✓ | ✓ |
| Company / domain monitoring | — | — | — | Single org |
| Feeds & alerts | ||||
| Alerting keywords (push to digest, webhooks, alerts) | 5 | Unlimited | Unlimited | Unlimited |
| Saved feeds (named views, RSS exports) | — | 5 | 5 | 10 |
| Entities per saved feed | — | 75 | 75 | 100 |
| Org-shared saved feeds | — | — | — | ✓ |
| Alert rules | — | 5 | 25 | 50 |
| Org-shared alert rules | — | — | — | ✓ |
| Feeds, rules and webhooks over the API (create, list, update, delete, test) | — | ✓ | ✓ | ✓ |
| Webhooks | — | 3 | 10 | 25 |
| Org-shared webhooks | — | — | — | ✓ |
| Personalised threat digest | ✓ (5 keywords) | ✓ | ✓ | ✓ (plus one per managed customer) |
| RSS feed | 50 items | 50 items | 50 items | 50 items |
| MISP feed | 10 events | 50 events | 50 events | 50 events |
| Managed customers | ||||
| Multi-customer scoping (enabled per account, talk to us) | — | — | — | ✓ |
| Customer records (name, domain, contact, logo, notes) | — | — | — | ✓ |
| Customer-scoped feeds, alert rules and webhook routing | — | — | — | ✓ |
| Branded scheduled digests per customer | — | — | — | ✓ |
| AI assistant | ||||
| Ask AI per cluster / day | — | 3 | 3 | 10 |
| Cluster AI global search / day | — | 10 | 10 | 100 |
| Inline source citations | — | ✓ | ✓ | ✓ |
| Collections | ||||
| Collections | 1 | 5 | 5 | 25 |
| Items per collection | 10 | 100 | 100 | 100 |
| Team sharing with roles | — | — | — | ✓ |
| IOC exports | ||||
| TXT / CSV / JSON | — | ✓ | ✓ | ✓ |
| STIX 2.1 bundles (TLP-marked) | — | ✓ | ✓ | ✓ |
| Bulk IOC export (confidence / type / time filters) | — | ✓ | ✓ | ✓ |
| Integrations | ||||
| REST API | 100 credits/day, 7-day window, 25-row lists | 1,000 credits/day, 120 req/min, full history | 1,000 credits/day, 120 req/min, full history | 600 req/min, no daily budget, per-key overrides |
| tc CLI | ✓ | ✓ | ✓ | ✓ |
| API scopes | Read-only, trimmed rows (threats, IOCs, entities, CVEs, dark web) | Full rows + feeds/alerts (9 scopes) | Full rows + feeds/alerts (9 scopes) | Full (all scopes) |
| Org-level API keys (custom scopes) | — | — | — | ✓ |
| Agent tools (tc CLI + agent bearer tokens) | — | — | — | ✓ |
| AI-assisted feed creation | — | — | — | ✓ |
| Agent tool surface | — | — | — | ✓ |
| SIEM ingestion (Splunk, Sentinel, Elastic, OpenSearch) | — | — | — | ✓ |
| SOAR / ticketing (webhook routing) | — | ✓ | ✓ | ✓ |
Free for education, non-profits and foundations
We grew up reading the same open writeups as everyone else. If you are a university, a registered non-profit, or a cybersecurity foundation (CERTs, ISACs, threat-sharing communities, infosec charities), Starter is free.
Reach out via the contact form from your institutional address with a one-line description of what you are working on. We turn it around in a couple of days.
FAQ
What does the free key include?
Every read scope over the last 7 days with 100 credits a day: incidents, IOCs, entities, vulnerabilities and dark web. Records are trimmed to the short summary, 3 timeline events and 25 rows per list.
Most calls cost 1 credit. The heavier ones cost more: unified search is 5, STIX bundles and bulk indicator pulls are 3, and a fully enriched leak-site victim record is 10. The budget resets daily.
Is the web platform a separate price?
No. One plan covers both. The same account that holds your API key sets your limits in the web platform: reading clusters and entities is open on every plan, Starter adds full cluster timelines, attack flows, the threat graph and dark web, Growth adds the full archive, Business adds org sharing and company / domain monitoring. The matrix above is the full map.
Can I try Starter first?
Yes. Start a 7-day trial with no card. If you do not add a payment method by day 7 you drop back to Free; nothing is charged automatically.
How do credit packs work?
Packs are one-off purchases that never expire. Credits are spent only after the day's allowance runs out, on any plan including Free. An empty search or a 404 lookup refunds its credits, and every response carries X-Request-Cost and your remaining balance.
Past about 4,000 credits a month, Starter at $19.99 works out cheaper than packs.
How do I get Business?
Business is $399 a month and we set it up with you over a short call to sort the account, seats and contract. Managed customers are switched on per account after that call and priced by the number of clients you run. It does not need a procurement gauntlet; we keep it under an hour.
Do you offer annual billing?
Starter and Growth are monthly. Business is an annual contract by default, with quarterly options if that fits your finance calendar better.
Can I redistribute the data?
The free feeds are TLP:CLEAR, redistribute with attribution. Keyed responses are for your own tooling. Embedding them in a product you sell needs a Business agreement.
Can I cancel?
Plans are monthly with no minimum term. Cancel from settings and the key keeps working until the end of the period. The free key never expires.
Get started
The whole surface is in the spec: 70+ endpoints over incidents, IOCs, entities, vulnerabilities and the dark web. Mint a free key and make the first call in a minute.