Vedric is quoted per deployment after a short scoping call. There is no public price list.
Each deployment is quoted after a 30-minute scoping call. Three things set the price.
The number of Windows endpoints the agent protects.
SaaS, VPC-Isolated or On-Premises. Where the data lives, who holds the keys and how audit retention works differ between them.
The response arrangement, from next-business-day support to a named engineering contact.
For security teams that want the fastest path to coverage, on Vedric's managed cloud.
For regulated environments where data residency and key custody are part of scoping.
For defense, intelligence, critical infrastructure, and any environment where detection data cannot leave your perimeter.
VPC-Isolated and On-Premises shapes are co-designed with security teams during scoping rather than offered as off-the-shelf SKUs. If your environment requires either, we map it out on the scoping call.
30 minutes. We map your threat model, deployment shape, endpoint count, and constraints. You get a yes or no on whether Vedric is a fit, and an outline of the pilot.
A written deployment proposal covering architecture, collectors, retention, SSO, and key handling. Your security and compliance teams review it. We revise it until it is right.
A scoped rollout to a subset of your endpoints. The agent installs, baselines settle, and detection begins. Your team gets a named contact and a regular check-in cadence agreed during scoping.
A phased rollout to your full endpoint fleet. Alerting thresholds, peer clusters, and response policies are tuned against pilot data.
Periodic coverage reviews. New collectors as they ship. Gap analysis against your evolving threat model.
No. Every deployment is quoted after a short scoping call, based on endpoint count, deployment option and support. Customers are invoiced.
It depends on the deployment shape. SaaS: Vedric's managed cloud. VPC: your VPC. On-premises: your datacenter. The deployment options above list this for each shape.
Collected: primarily behavioral metadata across host, identity, and network layers, plus a bounded, best-effort-redacted PowerShell script preview when host logging is enabled. Never collected: file payloads, keystrokes, screenshots, email bodies, document bodies, or browser page content. The refusal list and script exception are enforced in agent code.
Windows 10, Windows 11, and Windows Server 2016 and later today. Linux and macOS are on the roadmap. Current timelines are shared under NDA during scoping.
Yes. Enterprise SAML 2.0 SSO is supported with any compliant IdP, including Okta, Entra ID, and Google Workspace. SCIM-based automated user provisioning is on the roadmap. Today, users are provisioned at first sign-in via JIT.
It buffers locally and catches up when connectivity returns. The server marks an endpoint offline after a quiet window. That alone is not a security signal.
AI triage sits behind a fail-closed control layer, and per-tenant AI spend is tracked and reported. If the AI layer is unavailable for any reason, such as an outage, an operator toggle, or an admin disabling it for your organization, baseline behavioral detection keeps running without it. Detection does not depend on it.
The three deployment shapes compared on the points security and procurement teams ask about most. Specifics are confirmed in scoping.
On mobile the columns stack. Read each shape from top to bottom.
A 30-minute scoping call with an engineer. We cover your endpoint count, deployment option and support needs, and you get a quote for your deployment.