Thoughts on the new ThreatConnect Cloud-Native Edition pricing tiers?

It really is a bold shift! I'm also trying to wrap my head around the pricing model for our small team. You mentioned ROI first impressions - has anyone shared how they're actually tracking those billable analyst hours? Are you just trusting the vendor's usage dashboard, or do you need to build your own reconciliation layer? That seems like extra overhead that could eat into the savings.

The idea of paying for bursts during incidents is what drew me in too, but the comments about cold-start and idle session billing are making me nervous. It feels like you'd need to build really tight processes to spin sessions up and down instantly to make the math work, which is tough during an actual incident.