Threat Intelligence

Entity-Based Pricing vs. Per-Seat Licensing: Why It Matters

Why entity-based pricing for threat intelligence platforms scales better than per-seat licensing — and what it means for security budgets.

Adam Mikrut · CEO & Founder · · 2 min read

The pricing model of your threat intelligence platform shapes how your team actually uses it. Not how they intend to use it. How they actually use it, day to day, under real budget pressure.

Per-seat licensing — the dominant model in enterprise security software — creates a structural conflict between coverage and cost. Entity-based pricing eliminates that conflict entirely.

The Per-Seat Problem

When a platform charges per user, every new analyst on the account increases cost. This creates predictable organizational behavior: teams limit access to control spend.

The CISO gets a login. Maybe two senior analysts. Everyone else works from forwarded screenshots and exported PDFs. The field security team in Dallas gets a verbal briefing about what the platform found. The executive protection specialist in London submits a request and waits for someone with a login to run the search.

The platform technically provides threat intelligence. In practice, it serves as a one-person tool with poor organizational adoption.

For managed security service providers and security consulting firms, per-seat pricing is even more destructive. Adding a new client means adding analysts dedicated to that client — which means per-client cost scales linearly with team size. There’s no economy of scale. The bigger your book of business grows, the more each new client costs to service.

This is why security firms running per-seat platforms hit a growth ceiling. The math breaks.

How Entity-Based Pricing Works

Entity-based pricing charges for what you monitor, not who monitors it.

An “entity” is a person, brand, domain, location, or asset that the platform watches for threats. If your organization monitors 50 entities — 20 executives, 10 brand names, 15 domains, and 5 facility locations — that defines your pricing tier.

All team members access the same platform, the same alerts, the same intelligence, the same investigation tools. Adding a new analyst costs nothing. Giving the field team in Dallas their own dashboard costs nothing. Letting the London EP specialist run their own searches costs nothing.

The platform’s value increases with adoption. The opposite of per-seat, where the platform’s cost increases with adoption.

What This Looks Like in Practice

Scenario 1: Corporate security team

A Fortune 1000 corporate security team monitors 50 entities — C-suite executives, board members, key facilities, and their primary brand names. They have 8 people who need access: the CISO, three analysts, two regional security directors, an executive protection lead, and an outside counsel who reviews threat reports.

Per-seat model: 8 seats × vendor rate = significant licensing cost. When the team hires a ninth person, the budget increases. When they want to give the HR director access to workplace violence alerts, that’s seat number 10.

Entity-based model: 50 entities at a fixed tier. All 8 users included. When the team hires a ninth person, nothing changes. When HR needs access to specific alert categories, add them. No budget negotiation required.

Scenario 2: Security consulting firm

A security firm manages threat intelligence for 12 corporate clients, each with 10-30 monitored entities. They staff 3 analysts per shift, rotating across client accounts.

Per-seat model: Analyst headcount × vendor rate. Every new client requires either stretching existing analysts (reducing quality) or hiring new ones (increasing cost). The pricing model punishes growth.

Entity-based model: Total monitored entities across all clients defines the tier. Analysts rotate across accounts without per-seat friction. Adding a 13th client means adding their entities — the analyst team stays the same size. The firm’s margin improves with scale instead of deteriorating.

Scenario 3: Family office

A family office monitors 4 principals and their immediate family members — 15 entities total. Two staff members need access, plus an outside security consultant.

Per-seat model: 3 seats for 15 entities. When the security consultant’s engagement ends and a new firm takes over, that’s a license transfer process.

Entity-based model: 15 entities. Everyone who needs access has it. Consultant transitions are seamless because they’re not tied to named-user licenses.

The Hidden Costs of Per-Seat Licensing

Beyond the sticker price, per-seat licensing generates hidden organizational costs:

Shadow workarounds. When teams limit access to save budget, they build manual workflows to distribute intelligence — email forwards, Slack summaries, PowerPoint exports. Each workaround adds latency between detection and response.

Incomplete coverage. Budget-constrained teams monitor fewer entities than they should. The VP of Operations who travels internationally doesn’t get executive protection monitoring because adding a seat for the travel risk team wasn’t in the budget.

Audit and compliance gaps. When intelligence flows through informal channels instead of the platform’s audit trail, the organization loses the ability to document who knew what, when. In a post-incident review, this matters.

Renewal surprises. Per-seat pricing invites scope creep on the vendor’s side. “You’ve added 4 users since last year — here’s your updated rate.” Entity-based pricing is predictable because your monitoring scope doesn’t change as fast as your team roster.

What About “Unlimited Users” Claims?

Some enterprise platforms advertise “unlimited users” but hide the cost in other dimensions — per-integration fees for SIEM connections, premium tiers for API access, professional services requirements, or opaque enterprise pricing that requires a sales call to discover.

Transparent pricing does not require publishing an oversized matrix that forces buyers to interpret capacity on their own. It means giving buyers a clear starting point, explaining what drives price, and showing an estimate before requiring a sales conversation.

DigitalStakeout’s Pricing Model

Scout pricing starts at $750 per month under a 12-month agreement. A guided builder recommends capacity based on monitored entities, expected unique online mentions, service-provider client environments, billing preference, and optional services.

Every Scout subscription includes the complete risk-classification, monitoring, investigation, alerting, dark web, API, and integration foundation. Capacity changes with the risk surface being monitored; core capabilities are not separated into hidden modules.

The cost delta between DigitalStakeout and enterprise competitors at similar coverage levels is typically 5–20x. Not because we cut corners on capability — because we don’t charge you extra for letting your team use the product.


See how entity-based pricing works with your monitoring scope. Build a pricing estimate or book a demo.

AM

CEO & Founder, DigitalStakeout

Over two decades building security tools and intelligence systems. Co-founded a cybersecurity consultancy in 2004, founded DigitalStakeout in 2010. Technical founder who still architects and ships product.

All posts by Adam →

DigitalStakeout classifies signals across 21 classification domains with 1,400+ risk scenarios — automatically, in real time.