NEW200+ connectorsnow onboarded — pipe any security source into OCSF effortlessly.Read the announcement
Consulting
About us
Book a demoStart now
Pricing

Pay for the pipeline you run.
Nothing you don’t.

One simple model: a fixed base fee for the components you switch on, plus a flat rate per terabyte you ingest. No per-seat tax, no surprise overages.

>30% cheaperthan our leading competitorat 20 TB / month
Get a quote Start now
How pricing works

Two parts. That’s it.

Base platform fee

The components you switch on

A fixed monthly fee determined by which platform modules you enable — pipeline builder, normalisation, enrichment, replay and more.

+
Ingest

Per terabyte, per month

A flat rate for every terabyte of data you ingest.

=
Your monthly price

Predictable, transparent, and entirely driven by what you actually run.

Figures are confirmed on your quote — scoped to your sources and volume.

Build your base

Your base fee follows your components.

Start with a package or compose your own. Every edition adds the same flat per-terabyte ingest rate on top.

Core

Get clean OCSF data flowing and cut the obvious noise.

Pipeline builder
OCSF normalisation
Filter
Dual-write & migration
Enrichment
Replay
Sandbox
MOST POPULAR

Pipeline

The full pipeline — enrich, replay and test before you ship.

Pipeline builder
OCSF normalisation
Filter
Dual-write & migration
Enrichment
Replay
Sandbox

Enterprise

Everything, plus the controls and support large teams need.

Everything in Pipeline
SSO / SAML & RBAC
Dedicated support
Onboarding & SLA
The comparison

Materially cheaper at the volume you actually run.

At 20 TB / month of ingest — a typical mid-market footprint — Derwent Labs comes in well under our leading competitor.

>30%cheaper, at 20 TB / month
Est. monthly cost · 20 TB / month
Leading competitor
Derwent Labs
Pricing FAQ

Questions about pricing.

Derwent Labs pricing is based on two parts: a fixed monthly base fee determined by which pipeline components you enable, plus a flat per-terabyte ingest rate. There are no per-seat or per-connector charges. Contact us for a quote scoped to your sources and expected data volume.
What is OCSF? — the schema Derwent Labs normalises toSIEM cost reduction — cut ingest 60–80%
The backbone for security telemetry

One schema.
Every tool.

Normalise every byte of your security telemetry to OCSF. Stop maintaining parsers. Stop rewriting detections. Start shipping signal.