I've been evaluating extended detection and response platforms for our data stack, and Vision One keeps coming up. While the feature set is impressive—particularly the cross-layer telemetry and automated investigations—I keep hitting the same wall when I run the numbers.
For a mid-market SaaS company like ours, the per-endpoint pricing model simply doesn't scale in a cost-predictable way. Our engineering and data science teams use cloud workstations and containers that spin up and down constantly. The traditional "seat" or endpoint count feels like an outdated proxy for value in this environment. We'd be paying a premium for coverage during peak dev cycles, while much of that compute is ephemeral.
I'm curious if others in similar environments have found workable licensing models with Trend Micro, or if you've moved to alternatives that offer more flexible consumption-based pricing. The security piece is critical, but the cost structure needs to align with how modern tech teams actually operate.
What has your experience been? Are there benchmarking methodologies or specific contract terms that have made Vision One viable for you?
Stay grounded, stay skeptical.
Yeah, the per-endpoint model breaks down completely in elastic environments. We run on GKE with burstable node pools and it's a non-starter.
We ended up sticking with a more modular OSS stack for the ephemeral layer. Falco for runtime security, feeding alerts into our existing Prometheus/Grafana setup. It's not as polished, but the cost is predictable. The real gap is in the automated investigation piece you mentioned. That's where we've had to invest in custom playbooks.
Have you looked at their cloud workload offering? Last I checked it was still usage-based on something like vCPU-hours, which might map better to your cloud workstations. The sales rep tried to steer us back to endpoints anyway though.
Oh, I feel this in my bones. That pricing model was the exact reason we had to walk away from negotiations last year, even though my security lead loved the platform.
The real kicker for us was that even when we explored their cloud workload module, the minimum commit was still anchored to a static endpoint count estimate. It completely defeated the purpose of a flexible, usage-based model for our containerized environments. You're right, it's an outdated proxy.
We ended up going with a competitor that offered pure data-ingestion pricing for the ephemeral stuff, which aligned perfectly with our variable workloads. We kept Vision One's automated investigation piece on our wishlist, though. Have you found any alternatives that come close on that front without the crazy cost unpredictability?
Love the Falco + Prometheus/Grafana combo. We did something similar for our Kubernetes sidecars, and the cost predictability is a lifesaver. One thing we had to watch out for was the noise level from Falco's default rules in our CI/CD namespaces - ended up writing a small admission controller to add labels that Falco uses to filter out dev/test pods.
> The real gap is in the automated investigation piece
This is the exact pain point for us too. Did you guys build your playbooks using something like StackStorm, or did you hook Falco alerts directly into something like a custom workflow in your existing orchestration? We've been stitching together a few scripts with Argo Workflows for automated response, but it's definitely a maintenance burden.
Keep deploying!
You've hit on the exact friction point between traditional licensing and cloud-native operations. The per-endpoint model assumes a relatively static fleet, which just doesn't exist for teams using ephemeral compute.
I pushed hard on their cloud workload module during our renewal, and while they offered a 20% discount on the "committed" endpoint count, the floor was still too high. The cost became unpredictable the moment we scaled a new microservice. We had to treat it like a fixed cost, which defeated the purpose.
We benchmarked by logging all ephemeral container starts over a quarter, then averaged the peak concurrent count. Even using that number as the commit felt like overpaying for coverage we only needed sporadically. Did your sales team offer any kind of true usage-based pilot, or was it all anchored to that static count?
ship early, test often