# Packages > Four threat intelligence packages, Basic to Complete, with every module except AI also licensed alone. Annual licence per installation, unlimited analysts. Source: https://wahukeza.com/pricing Packages ## Four packages. Every module also on its own. An annual licence per installation or tenant, with unlimited analysts. Choose a package, or license the modules you need; on-prem, as a tenant we operate, or both. Pricing follows a short scoping workshop. [Book a scoping workshop](https://wahukeza.com/contact?intent=workshop) [Request a quote](https://wahukeza.com/contact?intent=quote) ## Basic Your own intelligence picture, and blocklists for the protection you already have. external decoys 2external decoys internal decoys 3internal decoys - Core Threat Intelligence: 40+ sources, one scored graph, enforcement feeds and SIEM export - Cases and incidents, regulatory evidence and audit - Deception Fabric with internal decoys and canary tokens [Request a quote for Basic](https://wahukeza.com/contact?intent=quote) ## Standard Everything in Basic, more sensors, and protection for customers and staff. external decoys 5external decoys internal decoys 5internal decoys - Everything in Basic - Brand & fraud protection: lookalikes, fake apps, takedowns, customer scam reports - Phishing Reporting: the Outlook add-in and a reporting mailbox [Request a quote for Standard](https://wahukeza.com/contact?intent=quote) ## Advanced Standard plus the outside-in view, automation, enterprise identity and AI analysis. external decoys 5external decoys internal decoys 5internal decoys - Everything in Standard - Attack Surface Management - Automated Playbooks - Enterprise Identity: OIDC SSO, SCIM 2.0, custom permission sets - AI Threat Analysis [Request a quote for Advanced](https://wahukeza.com/contact?intent=quote) ## Complete The whole platform. Endpoint and Android device counts are agreed per quote. external decoys 5external decoys internal decoys 5internal decoys - Everything in Advanced - Advanced AI Intelligence - Endpoint Intelligence and Endpoint Response - Mobile Endpoint Protection and Mobile Notifications - Adversary Emulation [Request a quote for Complete](https://wahukeza.com/contact?intent=quote) Every module except the two AI modules can be licensed on its own: start with Brand Protection, or add Attack Surface Management to Standard. A package is a convenient bundle, not a gate. What is in which package ## The module matrix. These are the modules your licence file lists. Counts are sensors included; more can be added as metered units. Modules included in the Basic, Standard, Advanced and Complete packages, and whether each can be licensed on its own. | Module | Basic | Standard | Advanced | Complete | On its own | | --- | --- | --- | --- | --- | --- | | [Core Threat Intelligence](https://wahukeza.com/platform/intelligence) | Included | Included | Included | Included | Yes | | [Deception Fabric: external sensors](https://wahukeza.com/platform/sensors) | 2 sensors | 5 sensors | 5 sensors | 5 sensors | Yes | | [Deception Fabric: internal sensors](https://wahukeza.com/platform/sensors#internal) | 3 sensors | 5 sensors | 5 sensors | 5 sensors | Yes | | [Brand Protection](https://wahukeza.com/platform/brand-protection) | Not included | Included | Included | Included | Yes | | [Phishing Reporting](https://wahukeza.com/platform/phishing) | Not included | Included | Included | Included | Yes | | [Attack Surface Management](https://wahukeza.com/platform/attack-surface) | Not included | Not included | Included | Included | Yes | | [Automated Playbooks](https://wahukeza.com/platform/workflow#playbooks) | Not included | Not included | Included | Included | Yes | | [Enterprise Identity (SSO, SCIM)](https://wahukeza.com/platform/deploy#identity) | Not included | Not included | Included | Included | Yes | | [AI Threat Analysis](https://wahukeza.com/platform/intelligence#ai) | Not included | Not included | Included | Included | with a package | | [Advanced AI Intelligence](https://wahukeza.com/platform/intelligence#ai) | Not included | Not included | Not included | Included | with a package | | [Endpoint Intelligence](https://wahukeza.com/platform/endpoint-intelligence) | Not included | Not included | Not included | Included | Yes | | [Endpoint Response](https://wahukeza.com/platform/endpoint-intelligence#response) | Not included | Not included | Not included | Included | Yes | | [Adversary Emulation](https://wahukeza.com/platform/emulation) | Not included | Not included | Not included | Included | Yes | | [Mobile Endpoint Protection](https://wahukeza.com/platform/mobile) | Not included | Not included | Not included | Included | Yes | | [Mobile Notifications](https://wahukeza.com/platform/mobile#notifications) | Not included | Not included | Not included | Included | Yes | Regulatory evidence and audit (DORA and NIS2 classification and clocks, drafted notifications, the management-body report and the auditor evidence pack) is part of Core Threat Intelligence. Endpoint and Android device counts in Complete are agreed per quote. In every package ## The things that should never be an upgrade. Security basics and the audit trail are the same in Basic as in Complete. - Unlimited analysts No per-user or per-seat charge. Roles Admin, Analyst and ReadOnly, plus Operator on multi-tenant installations. - MFA and four permission sets TOTP multi-factor sign-in and four built-in permission sets. Custom sets, SSO and SCIM are the Enterprise Identity module. - API keys Scoped, expiring and revocable, with rate limiting. Machine-only scopes are isolated from analyst keys. - Hash-chained audit log SHA-256 chain with signed daily anchors and a verifier. Never an upgrade. - Signed releases Images, SBOMs and the Helm chart signed with the project’s own key; CycloneDX SBOMs and scan reports with every release. - Edge-appliance management In every edition, bounded by a device count, not a paid add-on. What is metered ## Units, named up front. Only these units are licensed by count. Analysts never are. - Sensorsabove those included in the package - Phishing Reporting mailboxesin blocks - EndpointsEndpoint Intelligence and Endpoint Response - Android devicesMobile Endpoint Protection - Attack-surface seeds and assetsdefault limits 25 seeds and 2,000 assets - Traffic sourcesAvailability & DDoS detection Outside the four packages ## Licensed separately. [Availability & DDoS detection](https://wahukeza.com/platform/availability): Detection and alarm from your own routers, hosts and the deception fabric. Never mitigation. A separately licensed module, metered by traffic source.[Provider licensing](https://wahukeza.com/partners): The multi-tenant console, MSSP roll-ups and instance-to-instance exchange: by arrangement, through the partner programme. Hardware and services ## Quoted alongside the licence. Optional. Sensors also run as containers on hardware you already have. - Wahukeza HW Sensor A Raspberry Pi-based sensor kit, delivered ready to wear a persona. - Wahukeza Firewall Appliance NanoPi R4S enforcing the blocklist with nftables, with an SSH/Telnet hive on board. - Probe runner The cti-probe agent for consented active attack-surface checks, run by us as a service, or by you on your own network. - Standard implementation Kickoff to handover: install or tenant, sensors, brand protection and the first integrations. - Additional integrations Further firewalls, DNS, SIEM, ticketing or identity providers beyond the standard set. - Training For analysts and administrators, by the day. Delivery ## Where it runs is your choice. The same licence and the same modules whichever model you pick. - On-prem Docker Compose on a VM, or Kubernetes with the Helm chart for high availability. The licence is a signed file verified offline; nothing calls home. - A tenant on Wahukeza-operated instances Your own database per tenant. Trony Network acts as processor under the DPA. - Both Combine the models and change them later. Data exports in open formats: STIX 2.1, CSV and JSON. Not included in licences - Commercial source licences (VirusTotal, Shodan, AbuseIPDB, Censys) which you hold with the vendor - External AI provider costs, if you choose a hosted provider - SIEM and Microsoft 365 licences - Malware-analysis servers How buying works ## Workshop, mix, quote. Three steps, and the first one is a conversation about your estate, not a sales call. 1. 01 ### Scoping workshop Two hours, on-site or online: your estate, sensor locations, brands and channels, the integrations you need and the delivery model that suits you. 2. 02 ### Package or module mix One of the four packages, or the individual modules you need, with the metered units sized to your estate. 3. 03 ### Quote and implementation plan A final quote and a written implementation plan, with who does what and when. Implementation ## From kickoff to handover. 1. 01 ### Kickoff A kickoff call and a technical questionnaire about your network, identity and tooling. 2. 02 ### Platform set-up An on-prem install in your environment, or your tenant on Wahukeza-operated instances. 3. 03 ### Sensors and brands Decoys placed outside and inside the network; brands, domains and channels under watch. 4. 04 ### Integrations Firewall and DNS blocklists, SIEM, ticketing, and SSO/SCIM where licensed. 5. 05 ### Training and handover Your analysts and administrators trained on your own data; a clean handover. What we need from you ## Four things, before kickoff. - A VM or Kubernetes cluster (on-prem only) - Sensor locations: in the DMZ or behind NAT, and internal - Administrator contacts for the firewall, SIEM, Microsoft 365 and identity provider - The list of brands, domains and channels to protect Questions ## The ones procurement asks. How is it priced? Every package is an annual licence per installation or tenant, with unlimited analysts. The things that move a quote (sensors, mailboxes, endpoints, Android devices, delivery model) are specific to you, so pricing follows a short scoping workshop and arrives as a written quote with an implementation plan. Is there a hosted option? Yes. Take a tenant on Wahukeza-operated instances with its own database, with Trony Network as processor under the DPA, or run it on-prem, or combine the two. You can change the model later and export your data in STIX 2.1, CSV and JSON. Do I need the AI modules? No. AI is chosen at install: a local model (any OpenAI-compatible server: vLLM, Ollama, llama.cpp), Anthropic with your own key, or off. With AI off, everything except AI summaries and classification works, and Ask returns retrieval-only answers with citations. The two AI modules come only with a package: AI Threat Analysis with Advanced and Complete, Advanced AI Intelligence with Complete; every other module can be licensed on its own. What counts as a tenant? One isolated database with its own jobs, users, keys and reports (typically one organisation, or one client of a provider). Provider licensing for multi-tenant consoles is by arrangement. What is licensed per unit? Sensors above those included, Phishing Reporting mailboxes in blocks, endpoints, Android devices, attack-surface seeds and assets, and traffic sources for Availability. Everything else is per installation or tenant. What happens if the licence expires? The platform degrades to the Community edition. Expiry never takes the platform offline, and the licence file is verified offline; there is no call-home to fail. What does on-prem need to run? PostgreSQL 16, Redis and a container host or a Kubernetes namespace. Docker Compose and a Helm chart ship with every release, with a one-shot migration runner, signed images with SBOMs and the documentation bundle for offline use. ## Start with a scoping workshop. Two hours, on-site or online. You leave with a package or module mix; the quote and the implementation plan follow. [Book a scoping workshop](https://wahukeza.com/contact?intent=workshop) [Request a quote](https://wahukeza.com/contact?intent=quote)