Pricing
Published prices.
Every framework included.
Four plans, priced by what you need rather than by counting routers. Every plan covers all 27 compliance frameworks with no per-framework fees. Device allowances are generous and the overage rate is published, so your bill never surprises you.
Starter
One site or a small fleet. Monitoring and compliance scoring, self-serve.
No onboarding fee — self-serve setup
- Included on every plan:
- All 27 compliance frameworks, no per-framework fees
- 60-second up/down and latency monitoring, down/recovery alerts, alert log
- SNMP v2c/v3 telemetry and a Device 360 page per device
- Weekly drift detection and config snapshots with diffs
- Per-framework evidence PDFs with control citations
- Security advisories matched to your devices (PSIRT, CISA KEV)
- EOL / EOS tracking
- Email support — 48 h response
Team
The mid-size network with an audit on the calendar.
+ $750 one-time onboarding
- Everything in Starter, plus:
- Daily drift scans and baseline locking (SOC 2 CC8.1)
- Live compliance dashboard and audit calendar with readiness projection
- Audit package — evidence PDFs, exceptions register, hashed manifest
- Evidence of operation over an audit period (Type II report)
- Read-only examiner links, scoped per framework
- Remediation tasks and evidence request (PBC) tracker
- Email support — 24 h response
Pro
Full automation stack with remediation, firewall analysis and integrations.
+ $1,500 one-time onboarding
- Everything in Team, plus:
- Automated remediation scripts and one-click push to devices
- Firewall policy analysis — ACL audit, unused rules, hit-count delta
- ServiceNow e-bonding and webhook integrations
- Multi-site collectors with heartbeat alerts, 30-day telemetry history
- Network map, topology and dependency-aware alerting
- Scheduled report delivery and weekly executive summary
- Up to 10 custom automation workflows per year
- Priority support — 24 h response
Enterprise
Large or regulated estates. White-label, remote console, AI-assisted remediation.
+ $2,500 one-time onboarding
- Everything in Pro, plus:
- White-label branding — your logo, colours and domain on the portal and PDFs
- Remote console — recorded browser terminal to any device via the collector
- AI-generated remediation scripts, drift narratives and risk assessments
- SIEM / log platform integration, syslog and trap ingestion
- Cloud security-group controls (AWS, Azure NSG, GCP firewall)
- Unlimited custom automation workflows
- Dedicated success engineer · 24/7 support with 2 h SLA
A managed device is any router, switch, firewall, access point or load balancer we scan and monitor. Each plan includes a device allowance and can stretch to a ceiling at $10 per device per month (Starter to 50, Team to 150, Pro to 500); past the ceiling you move up a plan. We tell you before any overage bills. Every plan covers Cisco IOS / IOS-XE / NX-OS / ASA, Fortinet, Palo Alto, Juniper, Arista, Aruba, Check Point, Meraki, Linux and Windows hosts.
For MSPs
Per-tenant pricing. Your brand, your margin.
One platform fee, then a wholesale price per client tenant that mirrors the direct plans. Your clients see your logo and your domain; you set the price you charge them and keep everything above the wholesale rate. No revenue share, no reporting.
Platform fee
Multi-tenant mode, white-label and the partner portal.
+ $2,500 one-time onboarding (per MSP, not per tenant)
- Everything in the tenant's plan, plus:
- Switch between client tenants in one click; per-client evidence packages
- White-label — your logo, colours and domain on the portal and every PDF
- Partner portal with co-branded sales material
- 10% off the tenant portion from your 10th tenant, 20% from your 25th
- Dedicated MSP success engineer · 24 h priority support, 24/7 for tenant outages
| Client tenant | Features | Direct price | Your price |
|---|---|---|---|
| Up to 25 devices | Team | $500 | $200/mo |
| Up to 75 devices | Team | $1,250 | $450/mo |
| Up to 200 devices | Pro | $2,500 | $1,200/mo |
| Up to 1,000 devices | Enterprise | $7,500 | $3,500/mo |
| Above 1,000 devices | Enterprise | custom | custom |
Example: ten small clients cost $1,500 + 10 × $200 × 0.9 = $3,300/mo, or $330 per client. Charge them $500 and you keep 34%; charge $900 and you keep 63%. A single 200-device client through the programme costs more than buying Pro direct, so the savings start at your second client. Enterprise tenants get the Enterprise feature set; the 24/7 SLA and success engineer are yours to provide to your client.
Cost comparison
Less than one compliance hire, and less than two tools.
A mid-level network compliance engineer runs $90,000–$120,000 a year in salary alone. A monitoring tool plus a compliance tool, bought separately, lands most mid-market teams between $40,000 and $70,000 a year, and neither of them turns a switch configuration into audit evidence.
Pro covers up to 200 devices, runs continuously, and produces the evidence on demand for $30,000 a year. Every framework is included at every tier; we don't charge per framework.
In-house compliance engineer
$90k–$120k/yr
- Manual evidence pulls before every audit
- One framework at a time
- No monitoring, no automation
- PTO, turnover, onboarding lag
Coleman Integrated — Pro
$30k/yr
- Evidence packages on demand, period evidence for Type II
- All 27 frameworks at once
- Monitoring and remediation included
- Scales with your fleet, not your headcount
Which plan
See your numbers
Set your device count to see the plan it lands in, the annual cost, and the saving against an in-house hire.
Recommended plan
Pro
Annual cost
$30,000/yr
vs. in-house hire
$75,000 saved
Compared to a mid-level compliance engineer at $105k/yr (salary midpoint, excluding benefits and tooling). Onboarding fee not included.
Full feature comparison
| Starter | Team | Pro | Enterprise | |
|---|---|---|---|---|
| Devices and platforms | ||||
| Devices included | 25 | 75 | 200 | 1,000 |
| Stretch at $10/device/mo up to | 50 | 150 | 500 | banded above 1,000 |
| Cisco IOS / IOS-XE / NX-OS / ASA · Fortinet · Palo Alto · Juniper · Arista · Aruba · Check Point · Meraki | ✓ | ✓ | ✓ | ✓ |
| Linux and Windows hosts (CIS benchmarks) | ✓ | ✓ | ✓ | ✓ |
| Cloud security groups (AWS, Azure NSG, GCP firewall) | — | — | — | ✓ |
| Compliance evidence | ||||
| All 27 frameworks, no per-framework fees | ✓ | ✓ | ✓ | ✓ |
| Per-framework evidence PDFs with control names, citations and config snippets | ✓ | ✓ | ✓ | ✓ |
| Drift detection cadence | Weekly | Daily | Daily | Continuous |
| Baseline locking (SOC 2 CC8.1) | — | ✓ | ✓ | ✓ |
| Live compliance dashboard and audit calendar | — | ✓ | ✓ | ✓ |
| Audit package — evidence PDFs, redacted configs, exceptions register, hashed manifest | — | ✓ | ✓ | ✓ |
| Evidence of operation over an audit period (Type II report) | — | ✓ | ✓ | ✓ |
| Exceptions with expiry and approver; evidence request (PBC) tracker | — | ✓ | ✓ | ✓ |
| Read-only examiner links, scoped per framework | — | ✓ | ✓ | ✓ |
| White-label branding on portal and PDFs | — | — | — | ✓ |
| Monitoring | ||||
| 60-second up/down and latency, down/recovery alerts, alert log | ✓ | ✓ | ✓ | ✓ |
| SNMP v2c/v3 telemetry, Device 360 page per device, hardware health | ✓ | ✓ | ✓ | ✓ |
| Telemetry history | 7 days | 30 days | 30 days | 90 days |
| Network map, topology and dependency-aware alerting | — | — | ✓ | ✓ |
| Alert routing, maintenance windows, escalation; Slack, Teams, PagerDuty, webhooks | — | ✓ | ✓ | ✓ |
| Syslog / trap ingestion, NetFlow and sFlow top talkers | — | — | ✓ | ✓ |
| Remote console — recorded browser terminal via the collector | — | — | — | ✓ |
| Security advisories and automation | ||||
| PSIRT / CVE matching to device and version, CISA KEV and ransomware flags | ✓ | ✓ | ✓ | ✓ |
| EOL / EOS tracking | ✓ | ✓ | ✓ | ✓ |
| Automated remediation scripts and one-click push to devices | — | — | ✓ | ✓ |
| Firewall policy analysis — ACL audit, unused rules, hit-count delta | — | — | ✓ | ✓ |
| ServiceNow e-bonding and webhook integrations | — | — | ✓ | ✓ |
| Custom automation workflows | — | — | 10 / yr | Unlimited |
| AI-generated remediation, drift narratives and risk assessments | — | — | — | ✓ |
| SIEM / log platform integration | — | — | — | ✓ |
| Support | ||||
| Support response | 48 h e-mail | 24 h e-mail | 24 h priority | 24/7 · 2 h SLA |
| Dedicated success engineer | — | — | — | ✓ |
Common questions
What counts as a managed device?
Any network device we scan and monitor: routers, switches, firewalls, access points and load balancers, plus Linux and Windows hosts you choose to benchmark. Printers, phones and IoT endpoints we discover but don't manage do not count.
What happens if I go over my device allowance?
Devices beyond the allowance are billed at $10 per device per month on your next invoice, up to each plan's ceiling: 50 on Starter, 75 to 150 on Team, up to 500 on Pro. Past the ceiling you move to the next plan, which is cheaper at that point anyway. We tell you before any overage bills and nothing stops scanning.
Are any frameworks extra?
No. All 27 frameworks are included on every plan, and you can enable as many as you're held to. Compliance-automation tools commonly charge around $5,000 a year per additional framework; we don't.
What's included in onboarding?
Collector install, device discovery and inventory, credential profiles in your Key Vault, framework scoping and a kickoff review. Most environments are onboarded within two weeks. Starter is self-serve with documentation and no onboarding fee.
Can I start small and upgrade later?
Yes. Upgrades take effect at the next billing cycle and there's no additional onboarding fee; you pay the difference in onboarding only if you move from Starter to a plan that includes it.
I'm an MSP — how does the per-tenant model work?
You pay the $1,500 platform fee plus a wholesale price per client tenant based on its size, listed above. Volume breaks apply from your 10th and 25th tenants. You set the price your clients pay and keep the margin; there is no revenue share and nothing to report. From two clients onward it costs less than buying the direct plans.
How does annual billing work?
Annual plans are billed upfront for 12 months at a discount: 10% off Starter and Team, 15% off Pro, Enterprise and the MSP platform fee. Onboarding fees apply once regardless of billing term.
We're preparing for a SOC 2 Type II audit — which plan?
Team or above. Type II needs evidence that controls operated over the audit period, not just on scan day; Team includes the period evidence report, the exceptions register and read-only examiner links your auditor will ask for. Pro adds remediation and integrations if you also want to fix what the audit finds.
Do you offer project work outside of plans?
Yes, for scoped engagements such as one-time audits, network redesigns, segmentation projects or automation builds. Describe the project through the contact form and we'll respond within one business day.