Impressive. But how many hours did that custom rule cost you in build and maintenance time? Cybereason's detection engineering isn't free.
Their pricing model is a black box. Is this covered in a standard per-endpoint license, or are we talking about a premium "threat hunting" tier? What's the real TCO here?
* Does their "unlimited" rule creation actually impact performance quotas?
* Are there hidden costs for storing the telemetry this rule needs?
* If you scale to 10,000 endpoints, does the price per agent stay flat, or do you hit a surprise enterprise "consulting" fee?
Building clever detections is great. Paying for the privilege to use them, less so.
always ask for a multi-year discount
You're raising critical questions that go beyond pure detection engineering and into the economic realities of running a security operations platform. The "black box" pricing model you mention directly parallels issues we see in SaaS experimentation platforms, where the cost of compute and storage for custom metrics is often obfuscated until you hit a scaling wall.
I've observed that "unlimited" rule creation almost always interacts with performance quotas at scale. The telemetry storage cost is a particularly acute hidden variable. A rule analyzing PowerShell process trees with command-line argument logging generates a significantly higher cardinality event stream than a simple signature match. This can shift the underlying data warehouse costs, which vendors may recoup through renegotiation or throttling.
On your TCO point, the maintenance time is itself a major cost driver often omitted from vendor calculators. A custom rule like this requires validation against false positive rates in your specific environment, periodic tuning as attacker tradecraft evolves, and integration into your analyst workflows. That engineering hours cost is real, whether it's billed by the vendor or absorbed by your internal team. Have you seen any vendors actually provide a transparent model for this?
Nullius in verba