Packages
Four packages. Every module also on its own.
An annual licence per installation or tenant, with unlimited analysts. Choose a package, or license the modules you need; on-prem, as a tenant we operate, or both. Pricing follows a short scoping workshop.
Basic
Your own intelligence picture, and blocklists for the protection you already have.
- external decoys
- 2external decoys
- internal decoys
- 3internal decoys
- Core Threat Intelligence: 40+ sources, one scored graph, enforcement feeds and SIEM export
- Cases and incidents, regulatory evidence and audit
- Deception Fabric with internal decoys and canary tokens
Standard
Everything in Basic, more sensors, and protection for customers and staff.
- external decoys
- 5external decoys
- internal decoys
- 5internal decoys
- Everything in Basic
- Brand & fraud protection: lookalikes, fake apps, takedowns, customer scam reports
- Phishing Reporting: the Outlook add-in and a reporting mailbox
Advanced
Standard plus the outside-in view, automation, enterprise identity and AI analysis.
- external decoys
- 5external decoys
- internal decoys
- 5internal decoys
- Everything in Standard
- Attack Surface Management
- Automated Playbooks
- Enterprise Identity: OIDC SSO, SCIM 2.0, custom permission sets
- AI Threat Analysis
Complete
The whole platform. Endpoint and Android device counts are agreed per quote.
- external decoys
- 5external decoys
- internal decoys
- 5internal decoys
- Everything in Advanced
- Advanced AI Intelligence
- Endpoint Intelligence and Endpoint Response
- Mobile Endpoint Protection and Mobile Notifications
- Adversary Emulation
Every module except the two AI modules can be licensed on its own: start with Brand Protection, or add Attack Surface Management to Standard. A package is a convenient bundle, not a gate.
What is in which package
The module matrix.
These are the modules your licence file lists. Counts are sensors included; more can be added as metered units.
| Module | Basic | Standard | Advanced | Complete | On its own |
|---|---|---|---|---|---|
| Core Threat Intelligence | Included | Included | Included | Included | Yes |
| Deception Fabric: external sensors | 2 sensors | 5 sensors | 5 sensors | 5 sensors | Yes |
| Deception Fabric: internal sensors | 3 sensors | 5 sensors | 5 sensors | 5 sensors | Yes |
| Brand Protection | Not included | Included | Included | Included | Yes |
| Phishing Reporting | Not included | Included | Included | Included | Yes |
| Attack Surface Management | Not included | Not included | Included | Included | Yes |
| Automated Playbooks | Not included | Not included | Included | Included | Yes |
| Enterprise Identity (SSO, SCIM) | Not included | Not included | Included | Included | Yes |
| AI Threat Analysis | Not included | Not included | Included | Included | with a package |
| Advanced AI Intelligence | Not included | Not included | Not included | Included | with a package |
| Endpoint Intelligence | Not included | Not included | Not included | Included | Yes |
| Endpoint Response | Not included | Not included | Not included | Included | Yes |
| Adversary Emulation | Not included | Not included | Not included | Included | Yes |
| Mobile Endpoint Protection | Not included | Not included | Not included | Included | Yes |
| Mobile Notifications | Not included | Not included | Not included | Included | Yes |
Regulatory evidence and audit (DORA and NIS2 classification and clocks, drafted notifications, the management-body report and the auditor evidence pack) is part of Core Threat Intelligence. Endpoint and Android device counts in Complete are agreed per quote.
In every package
The things that should never be an upgrade.
Security basics and the audit trail are the same in Basic as in Complete.
Unlimited analysts
No per-user or per-seat charge. Roles Admin, Analyst and ReadOnly, plus Operator on multi-tenant installations.
MFA and four permission sets
TOTP multi-factor sign-in and four built-in permission sets. Custom sets, SSO and SCIM are the Enterprise Identity module.
API keys
Scoped, expiring and revocable, with rate limiting. Machine-only scopes are isolated from analyst keys.
Hash-chained audit log
SHA-256 chain with signed daily anchors and a verifier. Never an upgrade.
Signed releases
Images, SBOMs and the Helm chart signed with the project’s own key; CycloneDX SBOMs and scan reports with every release.
Edge-appliance management
In every edition, bounded by a device count, not a paid add-on.
What is metered
Units, named up front.
Only these units are licensed by count. Analysts never are.
- Sensorsabove those included in the package
- Phishing Reporting mailboxesin blocks
- EndpointsEndpoint Intelligence and Endpoint Response
- Android devicesMobile Endpoint Protection
- Attack-surface seeds and assetsdefault limits 25 seeds and 2,000 assets
- Traffic sourcesAvailability & DDoS detection
Outside the four packages
Licensed separately.
Availability & DDoS detection
Detection and alarm from your own routers, hosts and the deception fabric. Never mitigation. A separately licensed module, metered by traffic source.
Provider licensing
The multi-tenant console, MSSP roll-ups and instance-to-instance exchange: by arrangement, through the partner programme.
Hardware and services
Quoted alongside the licence.
Optional. Sensors also run as containers on hardware you already have.
Wahukeza HW Sensor
A Raspberry Pi-based sensor kit, delivered ready to wear a persona.
Wahukeza Firewall Appliance
NanoPi R4S enforcing the blocklist with nftables, with an SSH/Telnet hive on board.
Probe runner
The cti-probe agent for consented active attack-surface checks, run by us as a service, or by you on your own network.
Standard implementation
Kickoff to handover: install or tenant, sensors, brand protection and the first integrations.
Additional integrations
Further firewalls, DNS, SIEM, ticketing or identity providers beyond the standard set.
Training
For analysts and administrators, by the day.
Delivery
Where it runs is your choice.
The same licence and the same modules whichever model you pick.
On-prem
Docker Compose on a VM, or Kubernetes with the Helm chart for high availability. The licence is a signed file verified offline; nothing calls home.
A tenant on Wahukeza-operated instances
Your own database per tenant. Trony Network acts as processor under the DPA.
Both
Combine the models and change them later. Data exports in open formats: STIX 2.1, CSV and JSON.
Not included in licences
- Commercial source licences (VirusTotal, Shodan, AbuseIPDB, Censys) which you hold with the vendor
- External AI provider costs, if you choose a hosted provider
- SIEM and Microsoft 365 licences
- Malware-analysis servers
How buying works
Workshop, mix, quote.
Three steps, and the first one is a conversation about your estate, not a sales call.
01
Scoping workshop
Two hours, on-site or online: your estate, sensor locations, brands and channels, the integrations you need and the delivery model that suits you.
02
Package or module mix
One of the four packages, or the individual modules you need, with the metered units sized to your estate.
03
Quote and implementation plan
A final quote and a written implementation plan, with who does what and when.
Implementation
From kickoff to handover.
01
Kickoff
A kickoff call and a technical questionnaire about your network, identity and tooling.
02
Platform set-up
An on-prem install in your environment, or your tenant on Wahukeza-operated instances.
03
Sensors and brands
Decoys placed outside and inside the network; brands, domains and channels under watch.
04
Integrations
Firewall and DNS blocklists, SIEM, ticketing, and SSO/SCIM where licensed.
05
Training and handover
Your analysts and administrators trained on your own data; a clean handover.
What we need from you
Four things, before kickoff.
- A VM or Kubernetes cluster (on-prem only)
- Sensor locations: in the DMZ or behind NAT, and internal
- Administrator contacts for the firewall, SIEM, Microsoft 365 and identity provider
- The list of brands, domains and channels to protect
Questions
The ones procurement asks.
How is it priced?
Every package is an annual licence per installation or tenant, with unlimited analysts. The things that move a quote (sensors, mailboxes, endpoints, Android devices, delivery model) are specific to you, so pricing follows a short scoping workshop and arrives as a written quote with an implementation plan.
Is there a hosted option?
Yes. Take a tenant on Wahukeza-operated instances with its own database, with Trony Network as processor under the DPA, or run it on-prem, or combine the two. You can change the model later and export your data in STIX 2.1, CSV and JSON.
Do I need the AI modules?
No. AI is chosen at install: a local model (any OpenAI-compatible server: vLLM, Ollama, llama.cpp), Anthropic with your own key, or off. With AI off, everything except AI summaries and classification works, and Ask returns retrieval-only answers with citations. The two AI modules come only with a package: AI Threat Analysis with Advanced and Complete, Advanced AI Intelligence with Complete; every other module can be licensed on its own.
What counts as a tenant?
One isolated database with its own jobs, users, keys and reports (typically one organisation, or one client of a provider). Provider licensing for multi-tenant consoles is by arrangement.
What is licensed per unit?
Sensors above those included, Phishing Reporting mailboxes in blocks, endpoints, Android devices, attack-surface seeds and assets, and traffic sources for Availability. Everything else is per installation or tenant.
What happens if the licence expires?
The platform degrades to the Community edition. Expiry never takes the platform offline, and the licence file is verified offline; there is no call-home to fail.
What does on-prem need to run?
PostgreSQL 16, Redis and a container host or a Kubernetes namespace. Docker Compose and a Helm chart ship with every release, with a one-shot migration runner, signed images with SBOMs and the documentation bundle for offline use.
Start with a scoping workshop.
Two hours, on-site or online. You leave with a package or module mix; the quote and the implementation plan follow.