NEW200+ connectors now onboarded. Map any security source to OCSF with a single pipeline.Read the announcement
Consulting
About us
Book a demoStart now
Pricing

Pay for the pipeline you run.
Nothing you don’t.

One simple model: a fixed base fee for the components you switch on, plus a flat rate per terabyte you ingest. No per-seat tax, no surprise overages.

>30% cheaperthan our leading competitorat 20 TB / month
Get a quote Start now
How pricing works

Two parts. That’s it.

Base platform fee

The components you switch on

A fixed monthly fee determined by which platform modules you enable: pipeline builder, normalisation, enrichment, replay and more.

+
Ingest

Per terabyte, per month

A flat rate for every terabyte of data you ingest.

=
Your monthly price

Predictable and transparent, driven entirely by what you actually run.

Figures are confirmed on your quote, scoped to your sources and volume.

Build your base

Your base fee follows your components.

Start with a package or compose your own. Every edition adds the same flat per-terabyte ingest rate on top.

Core

Get clean OCSF data flowing and cut the obvious noise.

Pipeline builder
OCSF normalisation
Filter
Dual-write & migration
Enrichment
Replay
Sandbox
MOST POPULAR

Pipeline

The full pipeline: enrich, replay and test before you ship.

Pipeline builder
OCSF normalisation
Filter
Dual-write & migration
Enrichment
Replay
Sandbox

Enterprise

Everything, plus the controls and support large teams need.

Everything in Pipeline
SSO / SAML & RBAC
Dedicated support
Onboarding & SLA
The comparison

Materially cheaper at the volume you actually run.

At 20 TB / month of ingest (a typical mid-market footprint), Derwent Labs comes in well under our leading competitor.

>30%cheaper, at 20 TB / month
Est. monthly cost · 20 TB / month
Leading competitor
Derwent Labs
Pricing FAQ

Questions about pricing.

Derwent Labs pricing is based on two parts: a fixed monthly base fee determined by which pipeline components you enable, plus a flat per-terabyte ingest rate. There are no per-seat or per-connector charges. Contact us for a quote scoped to your sources and expected data volume.
What is OCSF: the schema Derwent Labs normalises toSIEM cost reduction: cut ingest 60–80%
The backbone for security telemetry

One schema.
Every tool.

Normalise every byte of your security telemetry to OCSF, and you can stop maintaining parsers and rewriting detections every time a vendor changes a field.