Your clients’ logs.
Your margin.
SIET detects attacks by how the structure of an estate changes, with no detection rules and no signatures, and decides which events your SIEM ever has to index. For an MSSP that is not a feature list. It is cost of goods sold.
One licence, deployed across every estate you monitor.
You carry the bill, so you keep the saving.
The saving lands on your margin, not a client budget
For an enterprise, indexing cost is a line somebody defends once a year. For you it is cost of goods sold on every client you serve. At ten clients averaging 150 GB/day that is over a million pounds a year of index spend sitting against your margin.
Detection engineering stops scaling with client count
Every rule written for one estate has to be reviewed against the next. SIET derives what is normal for each estate separately, so onboarding a client does not mean porting a rule library to it.
One licence, every estate you monitor
Priced on aggregate ingest across everything you monitor, not per client. Your cost per client falls as you grow, rather than rising with each one you add.
It sits alongside what you run today
No rip and replace. SIET deploys as a layer in front of the SIEM you already operate, and during warm-up your existing detection content keeps running untouched.
Measured, on a benchmark you can check.
Tested against CICIDS2017, published by the Canadian Institute for Cybersecurity. The baseline is warmed on two benign days and frozen, then every attack day is replayed independently against that same state. A benign control day runs on every replay, and its output is the false positive figure.
100%
Attacks detected
every attack in the dataset
<1 min
Median time to detect
most inside the first minute
3
Cases on a benign day
not thousands of alerts
99.4%
Never reaches the index
benign operating day
Every figure comes from a public dataset, so none of it has to be taken on trust. The full evidence record, including the methodology and how it was measured, is on the SIET page.
Deliberately simple.
There is no partner programme with tiers and badges. There is a licence, a deployment, and a measurement.
You buy a licence, you do not resell
No reseller agreement, no margin split, no deal registration, no channel conflict. You are a customer whose deployment happens to span many estates.
Priced on aggregate ingest
Across all monitored estates combined. Re-baselined at renewal rather than trued up mid-term, so adding a client does not produce an invoice.
Deployment support is ours
We get it running. First-line stays with you, because your analysts hold the client relationship. Second-line escalation comes to us.
We need the measurement
Permission to publish the reduction achieved, anonymised if you prefer, plus your pre-SIET indexed volume so the saving is measured rather than estimated. That is the trade for early pricing.
Early partners are priced accordingly. Terms agreed now are held for the life of the relationship, and they are not the terms this will carry later.
Twenty minutes, and bring your numbers.
The questions on the form are the ones that decide whether this is worth either of our time. If you would rather answer them on a call than in a box, leave them blank and say so in the message.
What we will want to know: which SIEM you run, roughly what you actually pay per GB rather than list, and your aggregate daily ingest across the estates you monitor. That last one sets the pricing, so it is the number worth having to hand.