ContraForce pricing for MSPs and MSSPs
Reviewed by ContraForce team
Pay for the work,
not for analyst seats.
ContraForce Cloud is a monthly plan plus a flat rate per incident your Security Delivery Agents process. Unlimited agents on every plan, month-to-month, and no infrastructure to stand up.
ContraForce Cloud plans
- Monthly
- Yearly Save 15%
Starter
Stand up governed security delivery on your first handful of customers.
$249 per month
4 workspaces included
Billed monthly, cancel any time
PLATFORM CORE
- Incident pipeline, inbox, bulk triage, dashboards, log search
- Defender XDR and Sentinel workspaces, CrowdStrike, SentinelOne
- Security Delivery Agents, gamebooks, SOP knowledge base
- Entra ID SSO, audit logs, API and webhooks, Cost Management Center
Growth
Run a book of customers with ticketing, SLAs, and fleet-wide operations.
$1,499 per month
30 workspaces included
Billed monthly, cancel any time
EVERYTHING IN STARTER, PLUS
- Ticketing and ITSM: Autotask, ServiceNow, Jira and more
- Client reporting
- SLA management
- Bulk operations across workspaces
- AI query assistant
- SCIM user provisioning
- Business support available to purchase
Scale
Productize delivery under your own brand with committed investigation rates.
$3,999 per month
85 workspaces included
Billed monthly, cancel any time
EVERYTHING IN GROWTH, PLUS
- Content Management Center
- White-label
- Business priority support included
- Eligible for committed investigation rates
Enterprise
Contractual SLAs, committed rates, and a named team behind your delivery.
Custom
Custom workspace allowance
Quoted to your requirements
EVERYTHING IN SCALE, PLUS
- Audit export to your SIEM (Sentinel data connector)
- Contractual SLAs
- Enterprise support, 1-hour Sev-1, TAM and QBRs
- Dedicated CSM
- Committed investigation rates included
One flat rate per incident processed by a Security Delivery Agent. Every incident, every time. No token math, no compute surprises, no surge billing. You can quote your service knowing exactly what delivery costs.
Works with
- Microsoft
- CrowdStrike
- SentinelOne
Every plan starts with a 14-day trial
250 investigations or 14 days, whichever comes first · No workspace limit · No credit card required
ENTERPRISE AND CUSTOM PRICING
Partner economics
Pricing that protects the margin you build.
Flat unit prices mean you know your platform cost per customer before you quote them. What you charge for the service is entirely yours.
A unit cost you can quote.
A flat monthly plan and a flat rate per incident processed by a Security Delivery Agent. Your cost of delivery is known before you sign the customer, so your quote can be too.
Your rate card is yours.
ContraForce bills you, never your customers. What you charge for managed detection and response, and the margin you keep on it, is entirely your call.
Scale is rewarded, not penalized.
Annual billing locks a lower rate, and stepping up a tier is a billing change, not a migration. The unit-cost curve bends in your favor as your client base grows.
Want your margin model on paper?
Bring your client count and rate card, and we’ll build your unit economics with you on a 30-minute call.
ContraForce runs a federated architecture: agents query your customers’ security data where it already lives, so it never leaves their tenant.
No log retention. Ever.
- SOC 2 Type II
- MISA Member
- Microsoft Pegasus
- G2 rating 4.8 / 5
Add security delivery to your line card.
Start with a 14-day trial: 250 investigations or 14 days, whichever comes first, with no workspace limit.
No credit card. Connect one workspace: scoped Entra ID application consent, no endpoint agents, no log forwarding.
Common pricing questions
How much does ContraForce cost?
ContraForce Cloud plans are $249 per month for Starter (4 workspaces), $1,499 per month for Growth (30 workspaces), and $3,999 per month for Scale (85 workspaces), each plus a flat rate per incident processed by a Security Delivery Agent. Annual prepay takes 15% off the plan fee. Enterprise is quoted to your requirements, with a custom workspace allowance.
What exactly counts as a billable incident?
One Security Delivery Agent run: the complete agent-led investigation and response workflow for a single security incident. Incidents processed by a Security Delivery Agent bill at a flat rate per run, pay as you go: no bundles, no included runs, no overage tiers. We walk through the full rate card with you directly.
Which plan should I choose?
Start with the 14-day trial, watch your real incident volume, then pick the tier that matches it. Plans are month-to-month, so choosing the smaller tier first costs you nothing: moving up later is a billing change, not a migration.
What happens when I outgrow my plan?
You can add workspaces to your current plan or step up to the next one, whichever works better for your practice. Plans are month-to-month, so moving up is a billing change, not a migration. Your pay-as-you-go per-incident rate doesn’t change as you grow.
What does Enterprise pricing look like?
Enterprise is for organizations that need more than Scale: a custom workspace allowance, committed investigation rates included, contractual SLAs, Enterprise support with a TAM and QBRs, and a dedicated CSM. Contact sales@contraforce.com for an Enterprise quote.
Does ContraForce have a free trial?
Yes. ContraForce offers a free trial on ContraForce Cloud that runs for 14 days or 250 investigations, whichever comes first, with no workspace limit. No credit card is required to start, and no demo or sales call is required first.
Does ContraForce ever bill my customers?
No. ContraForce bills you, the service partner. Your customers never see ContraForce pricing. What you charge for your managed service, and the margin you keep on it, is entirely yours to set.
Do I need my own Azure subscription to run ContraForce?
No. ContraForce Cloud runs the platform for you, so there is no infrastructure to deploy and nothing to operate. You connect your customers’ Microsoft tenants and Security Delivery Agents start working their incidents. Microsoft still bills your customers for their own Sentinel and Defender licensing, as it does today.
Which EDR and SIEM stacks are supported?
XDR: Microsoft Defender, CrowdStrike, and SentinelOne. SIEM: Microsoft Sentinel. Every security integration is available on every plan, and ticketing and ITSM integrations with Autotask, ServiceNow, and Jira are included from Growth.
How do I control AI analysis costs per tenant?
ContraForce bills a flat rate for each incident a Security Delivery Agent processes, so cost follows volume directly. You control the volume: choose which incident statuses and severities trigger automatic agent runs, and run agents in investigation-only mode wherever you do not want response actions.