Plan feature matrix
A capability-by-tier reference. For the narrative version (how to switch plans, what happens when payment fails, BYO sliders), see Plans and pricing.
At a glance
| Capability | Essentials | Advanced | Build Your Own |
|---|---|---|---|
| Monthly price | $149 | $349 | Starts at $400 |
| Yearly price | $1,490 | $3,490 | (monthly only) |
| Data sources | 2 | 4 | up to 50 (slider) |
| Seats | 3 | 10 | up to 50 (slider) |
| Finding retention | 90 days | 180 days | 180 days |
| Concurrent scanners | 1 | 3 | 3 |
| Queue priority | best effort | standard | standard |
Per-feature breakdown
| Feature | Essentials | Advanced | Build Your Own |
|---|---|---|---|
| Retrievy Index (Command Center + per-module scoring) | ✓ | ✓ | ✓ |
| CSPM dashboard (cloud audits via AWS, Azure, GCP, OCI, M365) | ✓ | ✓ | ✓ |
| ISPM dashboard (cloud IAM, Entra ID, Active Directory) | ✓ | ✓ | ✓ |
| SCM dashboards (Active Directory + FortiGate) | ✓ | ✓ | ✓ |
| Hardening Kanban | ✓ | ✓ | ✓ |
| Security Exceptions (Accept Risk + registry) | ✓ | ✓ | ✓ |
| Compliance Hub (CIS, NIST CSF, MITRE ATT&CK) | ✓ | ✓ | ✓ |
| Remediation Projects | ✓ | ✓ | ✓ |
| Drift Alerts and Drift Export (CSV / PDF) | ✓ | ✓ | ✓ |
| Per-project PDF report | ✓ | ✓ | ✓ |
| Executive Report PDF (6-page leadership summary) | – | ✓ | ✓ |
| Technical Report PDF (full findings list, top-200 cap) | – | ✓ | ✓ |
| Single Sign-On (SSO) (Microsoft, Google, Cloudflare) | – | ✓ | ✓ |
| Detailed Audit Trail (per-action audit log) | – | ✓ | ✓ |
| FortiGate X-Ray Dependency Graph (Domino Effect view) | – | ✓ | ✓ |
| Custom roles (RBAC beyond tenant-admin) | ✓ | ✓ | ✓ |
| Per-data-source scope (scoped view permissions) | ✓ | ✓ | ✓ |
| Stripe Customer Portal (invoices, payment method) | ✓ | ✓ | ✓ |
| Programmatic API access (Public API) | – | – | – (not yet enabled on any plan) |
Plan-gated features
These capabilities depend on your plan, regardless of role. The toggles that govern role-level access live on Settings → Roles & Permissions; this table covers only the plan side.
| Feature | Plan that enables it |
|---|---|
| Executive PDF Reports and Technical PDF Reports | Advanced, Build Your Own |
| FortiGate X-Ray Dependency Graph (Domino Effect view) and AD GPO X-Ray (inheritance graph) | Advanced, Build Your Own |
| Single Sign-On (SSO) | Advanced, Build Your Own |
| Detailed Audit Trail | Advanced, Build Your Own |
| Programmatic API access (Public API) | Not yet enabled on any plan |
Every module (CSPM, ISPM, SCM, Compliance, Remediation Projects, Reports, Security Exceptions, and all of Settings) is available on every plan; the toggles inside each module are governed by role, not plan.
Grandfathered pricing
Customers who signed up before the recent price change may still be on Advanced (Grandfathered) at $199 per month. The capabilities are identical to current Advanced; only the price is lower. The grandfathered price stays put until you resize the subscription (any plan change moves you to current pricing).
What happens when you change plans mid-cycle
| Change | Proration | Charge timing |
|---|---|---|
| Flat upgrade (Essentials → Advanced) | Immediate | Charged on the spot for the prorated delta |
| Flat downgrade (Advanced → Essentials) | Immediate | Credited on the next invoice |
| Flat → BYO | Always-invoice | Charged on the spot |
| BYO resize up | Always-invoice | Charged on the spot |
| BYO resize down | Create-prorations (default) | Credited on the next invoice |
| Cancel | End-of-cycle | No additional charge; access continues until cycle end, then 30-day reactivation grace |
What happens when payment fails
| Stripe state | Grace | What you keep |
|---|---|---|
| Past due | 7 days | Read access to dashboards. Scans pause. Writes blocked. |
| Unpaid | After dunning | Read-only data, no sign-in. |
| Canceled | 30 days | Read-only data with Reactivate Subscription button. Workspace falls back to Essentials after 30 days. |
See Plans and pricing for the full failure flow.
Related
- Plans and pricing
- Reports (requires Executive and Technical PDF Reports on Advanced and above)
- Roles and permissions (the Audit Trail group requires Detailed Audit Trail)