Editions
One Skans appliance secures one site on one license. You're metered by managed endpoints — every device Skans gives an identity to: cameras, controllers, PLCs, switches, the server itself — not by seats, sockets, or agents.
Community Edition is free forever — $0, no credit card, production-ready up to 25 endpoints. Paid editions add depth as a site grows; each includes everything in the one before it.
Every capability, and exactly where it lands. Each edition includes everything in the one before it. Community is free forever — no credit card, production-ready.
| Capability | CommunityFree forever | Essential$499 / yr | Professional$999 / yr | Business$2,999 / yr | EnterpriseContact |
|---|---|---|---|---|---|
| Identity & root of trust | |||||
| Enclave root of trust (on-prem CA) | ✓ | ✓ | ✓ | ✓ | ✓ |
| X.509 identity for every device | ✓ | ✓ | ✓ | ✓ | ✓ |
| Full per-vendor cert-push driver pack | ✓ | ✓ | ✓ | ✓ | ✓ |
| Credential vault | ✓ | ✓ | ✓ | ✓ | ✓ |
| Hardware-backed operator login (PIV / FIDO2) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Devices | |||||
| Managed endpoints per site | 25 | 100 | 500 | 1,000 | 1,000+ |
| Device discovery & inventory | ✓ | ✓ | ✓ | ✓ | ✓ |
| Multi-protocol discovery (ONVIF · scan · industrial) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Capability-tier classification (A / B / C) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Endpoint agent — Windows · Linux · macOS | ✓ | ✓ | ✓ | ✓ | ✓ |
| Network access control | |||||
| NAC visibility | ✓ | ✓ | ✓ | ✓ | ✓ |
| 802.1X EAP-TLS admission | — | — | ✓ | ✓ | ✓ |
| Dynamic VLANs + MAB for limited gear | — | — | ✓ | ✓ | ✓ |
| Legacy segmentation + security gateway | — | — | ✓ | ✓ | ✓ |
| Patch, firmware & backup | |||||
| Patch management + enforcement | — | ✓ | ✓ | ✓ | ✓ |
| Vetted, hash-verified firmware repository | — | ✓ | ✓ | ✓ | ✓ |
| Off-source encrypted backup + DR restore | — | ✓ | ✓ | ✓ | ✓ |
| Configuration & secret vaulting | — | ✓ | ✓ | ✓ | ✓ |
| Monitoring & threat intel | |||||
| Continuous monitoring (correlated findings) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Security feeds (CVE, KEV, EPSS, ATT&CK + ICS, Sigma) + malware defs | ✓ | ✓ | ✓ | ✓ | ✓ |
| Alerting rules, routing & notifications | — | ✓ | ✓ | ✓ | ✓ |
| Vulnerability management (matching + prioritisation) | — | — | ✓ | ✓ | ✓ |
| Log & topology fusion | — | — | ✓ | ✓ | ✓ |
| Compliance | |||||
| NIST 800-171 / CMMC control mapping | — | — | ✓ | ✓ | ✓ |
| ISO 27001 crosswalk (93 Annex A controls) | — | — | ✓ | ✓ | ✓ |
| Signed evidence-pack export | — | — | ✓ | ✓ | ✓ |
| Audit log & change approvals | — | — | ✓ | ✓ | ✓ |
| OT / ICS depth | |||||
| OT/ICS driver depth (S7-1500 · Desigo · BACnet/SC) | — | — | — | ✓ | ✓ |
| OPC UA GDS Push certificate management | — | — | — | ✓ | ✓ |
| Industrial protocol gateways | — | — | — | ✓ | ✓ |
| Scale, availability & governance | |||||
| Distributed Core + Edge (per-site) | — | — | — | — | ✓ |
| High availability | — | — | — | — | ✓ |
| Optional online Skans Update Service (security + product content) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Offline SUS sneakernet bundle + offline licensing | — | — | — | — | ✓ |
| SSO / OIDC single sign-on | — | — | — | — | ✓ |
| Advanced RBAC & full audit | — | — | — | — | ✓ |
| Support | |||||
| Support | Community | Business-hours | Priority | Dedicated | |
| Uptime SLA | — | — | — | — | ✓ |
Community is free forever (≤ 25 endpoints). Paid prices are annual, in USD, per site. Multi-site estates license each site — distributed Core + Edge deployments license each Edge. Talk to us about site packs and volume.
Managed endpoints counts devices under active Skans management — identity, certificates, policy, or monitoring. The endpoint agents running on those devices are never metered separately.
Skans Update Service: optional online pull of signed security feeds, malware defs, driver packs and product/agent content is available on every edition (operator opt-in; download-only). The offline sneakernet bundle and offline licensing path are Enterprise.