Threat hunting tool pricing: what vendors publish

Straight answer

None of the six vendors on this site publishes a license price, as of our review on 27 September 2026. What they do publish varies: documentation, a sandbox, a cost calculator, a connector list, a stated deployment time or a marketplace listing. This note lists what each one offers and the pricing questions worth asking.

No list prices, and why that shapes this site

We checked the public pages of all six vendors in September 2026 and found no license price, per-unit price or plan tier for any of them. That is common for security platforms sold to teams rather than individuals, and it is why our calculator has no seat or plan input: multiplying seats by a guessed price would mean inventing numbers.

What buyers can read before a call still differs a great deal, and that is what our buyer transparency criterion scores. It carries 5% of the weighted figure, the smallest weight, because it tells you how easy a vendor is to check rather than what the product does.

What each vendor publishes

Anvilogic (3 of 5 on buyer transparency): a public calculator that estimates data-lake compute and storage costs. The calculator states that its savings figures do not include Anvilogic's annual licensing. The platform page also describes augment, standalone or combined deployment on top of your storage layer.
Artemis Security (3 of 5): a connector list of 225+ connectors in 17 categories that separates ingested sources from those queried in place, and a stated timeline: connectors live in under an hour, real cases inside 48 hours.
Nebulock (3 of 5): a public documentation site, including its detection engineering docs, and two frameworks on GitHub under the MIT license.
Vega (3 of 5): a public sandbox at sandbox.vega.io, which lets a buyer try the product without a sales call.
Mars Security (2 of 5): no documentation site, but a stated deployment time of hours with no data ingestion, SOC 2 and an AWS Marketplace listing, per its September 2026 press release. The same release says its intel-to-detection capability is available to all customers at no additional cost.
Cotool (1 of 5): no public price, documentation, deployment model or timeline on the pages we reviewed.

Querying in place moves some cost, it does not remove it

The tools on this site that query data where it already lives do not store a second copy of your data, which can avoid storage and pipeline work. The queries still run somewhere: on the compute of the SIEM, data lake or other platform that holds the data. That cost lands on the platform's budget, not the hunting tool's invoice, which is easy to miss when comparing quotes.

Anvilogic's calculator is the only public tool we found that tries to estimate this for a buyer. Whatever tool you consider, ask for the expected query volume and who pays for it.

A marketplace listing changes how you buy

A listing on a cloud marketplace, such as the AWS Marketplace listing Mars Security states, can let a team buy through an existing cloud agreement. Whether that helps depends on your procurement rules. Ask each vendor which buying routes it supports.

Eight pricing questions to ask

What is the pricing unit: data sources, data volume, users, endpoints, or something else?
Which features are in the base price, and which cost extra?
What happens to the price when we add a new data source?
How many queries will the tool run against our platforms, and how can we limit them?
Which of our platforms will see higher compute costs, and can you estimate them?
Is there a minimum term or a minimum contract value?
Can we buy through a cloud marketplace or an existing agreement?
Which of these answers will you confirm in the order form?

Where to go next

Put the answers next to the scores in the side-by-side compare page, and use From demo to decision to bring them into the final choice.

Sources

Editorial assessment · Desk research from public vendor material, last reviewed September 2026

What threat hunting vendors publish before a sales call