Free to detect. Paid to contain.
Run PandoCore on as many nodes as you like, for nothing, and it will tell you when a workload starts behaving differently. You pay when you want it to act on that by itself.
Free
Detects and alerts. Never contains.
- Unlimited protected nodes
- 1 cluster
- Detection and alerting
- Not included: Autonomous isolation
- Not included: External integrations
- 7-day event history in the portal
- Auto-issued on signup, no card and no call
Growth
Adds autonomous isolation
- Up to 150 protected nodes
- Unlimited clusters
- Detection and alerting
- Autonomous isolation on novel behaviour, with alerting as the floor
- SIEM (Splunk, Elastic, Datadog, syslog) and Slack integrations
- 90-day event history
- Issued against an invoice
Enterprise
For regulated and multi-cluster fleets
- No node limit
- Unlimited clusters
- Detection and alerting
- Autonomous isolation on novel behaviour, with alerting as the floor
- SIEM (Splunk, Elastic, Datadog, syslog) and Slack integrations
- 13-month event history
- Issued against an invoice
How billing works
Billing is based on the second-highest weekly protected-node count recorded in a calendar month, not the single monthly peak, and weeks with no heartbeat count as zero, so your worst week is free and one spike never inflates your bill. Billed monthly, no proration. Only protected nodes are billed. Usage is measured via a weekly heartbeat from each protected node, with no reconciliation required. Need a different plan? Contact us and we'll move you over.
Growth is issued by hand against an invoice, so there is no billing toggle to flip. Talk to us and we will set it up.
Every tier installs the same way: see Getting Started and Operating Modes.
Every plan includes
Each workload learns its own normal. No rules to write.
A DaemonSet watches the workloads on each node. Nothing is injected into your pods.
Real-time node inventory, usage tracking, and billing estimates.
Deploy alongside existing workloads. No SDK, no instrumentation.
Ed25519-signed license with node entitlements and expiry.
Multi-namespace CRD-based configuration, declarative and versionable.
Node inventory and detection events from your licensed clusters roll up into a single portal view. Unlimited clusters on Growth and up.
Hands-on deployment help from the team that built the sensor, on every plan.
Ready to get started?
Sign up in under a minute. Your Free license is issued automatically, with no review step and no card, so your dashboard is ready and you can install the node sensor on your cluster straight away.