Frequently Asked Questions.
Everything you need to know about SecurityBox — what it does, how it deploys, and what it costs.
General.
SecurityBox is an AI-native analyst delivered as software. A lightweight sensor watches your network, continuously tests your defenses, assesses your cloud, and the platform delivers evidence-backed conclusions with recommended actions, in plain English. The goal is answers instead of alerts — an analyst that finishes the work your tools start.
A SIEM produces event correlation, rule matches, and alert volumes that require skilled analysts to interpret. SecurityBox produces prioritized investigative objects, context-rich case artifacts, and actionable recommendations. The difference is operational: a SIEM creates work for your team, SecurityBox eliminates it.
Not necessarily. The purpose of a SIEM is to aggregate security information from multiple sources and produce actionable alerting and detections — and SecurityBox does exactly that. It ingests signals from network traffic, Active Directory, cloud services, identity providers, and EDR, correlates them, and produces prioritized findings with actionable recommendations. The difference is that a SIEM hands your team raw alerts to triage, while SecurityBox delivers finished, prioritized findings with clear guidance. That said, if you already have a SIEM or need one for regulatory reasons, all SecurityBox detections and alerts can be forwarded to it. For compliance purposes, cases and risk reports are retained for the duration of your service agreement, and retention beyond that can be set to whatever your regulatory obligations require.
SecurityBox serves organizations of all sizes that need measurable risk reduction. Small businesses benefit from the fully managed model that requires no in-house security expertise. Managed service providers use SecurityBox to deliver continuous risk assessment to clients. Organizations in regulated industries rely on the continuous compliance documentation and board-ready reporting.
Deployment.
No. SecurityBox is software — we never ship hardware. On-premise deployments run as a small virtual machine on your existing hypervisor: you provide the VM and a switch port mirror, and we handle everything else. If you have no office or no virtualization, we host your SecurityBox instance for you at the same price. No appliances, no capex, no shipping, no hardware maintenance.
Anywhere. It's one product with two deployment options: on your network, which adds full network traffic analysis via port mirror, or hosted by us in the cloud — any system, anywhere, can be assessed, including Microsoft 365, Azure, identities, and remote endpoints. Same software, same subscription, same price.
The sensor VM has two network interfaces. The management interface connects to a standard user VLAN — this is how it communicates, receives updates, and sends assessment data. The monitoring interface connects to a port mirror (SPAN port) on your firewall or edge switch — this captures bidirectional network traffic for analysis.
The on-premise sensor deploys in hours — not weeks. Cloud-hosted deployments require nothing on your side at all; we provision the instance and begin assessment immediately. Baseline risk posture is established quickly, and you begin seeing measurable risk trends within the first week.
No. SecurityBox is an agentless platform — there is nothing to install on your workstations, servers, or devices. It assesses risk by ingesting signals from your existing infrastructure: network traffic, Active Directory, cloud services, and identity providers. The only exception is SentinelOne XDR, an optional add-on that installs a lightweight endpoint agent. SentinelOne adds autonomous host protection and deeper telemetry collection, which is especially valuable for remote and work-from-home environments where there is no corporate network to monitor.
SentinelOne XDR is strongly recommended for work-from-home environments. Without a corporate network, SentinelOne provides the endpoint-level telemetry that SecurityBox needs to build complete per-host risk profiles for remote users. It also adds industry-leading autonomous endpoint protection. It is an optional add-on.
The Deliverable.
Every host under management carries a continuously updated risk score — a single confidence-rated number from clean to critical. The score reflects behavioral anomalies, baseline deviations, and correlated signals. It tells you exactly where each host stands without requiring technical interpretation.
SecurityBox produces weekly risk trend reports, per-host risk summaries, executive risk posture overviews, and detailed case artifacts for investigated findings. Reports are designed for both technical teams and business leadership.
SecurityBox follows a three-phase approach: baseline your current risk posture, reduce critical and high-severity conditions through prioritized recommendations, and sustain low-risk conditions through continuous behavioral assessment. Weekly trend reports show measurable progress.
In a fully managed engagement, our team handles continuous risk assessment, investigation, and recommendations. Your team receives prioritized findings and acts on clear guidance. In a co-managed engagement, your security team works alongside ours with direct visibility into risk states and investigations.
Pricing.
By company size. Find the band that matches your employee count and that flat monthly price is your price — the full platform, everything included. Each band also carries a monitored-device ceiling; if your device count is unusually high for your headcount (a data center, for example), the device column determines your band instead. Whichever is greater applies.
Because it's the one number you already know. Hosts, identities, and log volumes are things our sensor discovers after deployment — pricing on them means you can't predict your bill. Your headcount is a fact you can price in your head, in seconds, without a calculator.
Any device with an operating system and an IP address that communicates on the network — workstations, laptops, servers, and networking devices. VoIP phones are monitored but not counted against your device ceiling. Most companies never think about the ceiling: it exists for unusual environments like data centers with few staff and many servers.
Nothing mid-term — your price never changes during your commitment. Your band is set at signup and reviewed at renewal. If you've grown, you renew into the band that matches your new size. The sensor already knows your environment, so there are no audits and no surprise true-up invoices.
Yes — every Microsoft 365 or Google Workspace account is monitored for sign-in anomalies, geographic impossibilities, privilege changes, and access pattern deviations. Identity monitoring is included in every plan and doesn't affect your price.
Everything. The AI-native analyst, autonomous NDR, continuous external attack surface testing, cloud and identity assessment, weekly reports, executive summaries, recommended actions, and fully managed operation. No feature gates — you get the full platform from day one, in every band.
Two: month-to-month with no contract, or a 1-year commitment at a lower rate. All plans are billed monthly in USD.
Yes. If you start on a month-to-month plan, you can convert to a 1-year commitment at any time. Your pricing will adjust to the lower committed rate immediately. Many organizations start monthly to validate the platform, then lock in the commitment once they see the results.
SecurityBox doesn't offer a free trial, but every deployment is backed by our 30-Day Guarantee: if we don't produce actionable findings that improve your security posture within 30 days, we refund your first month in full.
All SecurityBox deployments include platform support. For general inquiries, contact us through the contact page or at info@securitybox.io.
Still Have Questions? Let's Talk.
Our team is here to help. Get a personalized walkthrough of SecurityBox and see how it fits your environment.