Any enabled user account in a domain you scan, including service and admin accounts. Disabled accounts, computers and managed service accounts don't count. Neither do trust accounts, groups, contacts or student accounts. You pay one price for the total across every domain and forest you own. The calculator has a one-line PowerShell command that gets your count.

Standard is $10 per enabled account a year for the first 1,000 accounts, $8 for the next 4,000 and $6 up to 25,000. It has a $3,000 minimum and 5 users. View-only users and Remediators are free. Each rate only covers the accounts in its step. So 2,500 accounts is $10,000 for the first 1,000 plus $12,000 for the next 1,500, or $22,000 a year.

Enterprise is Standard's price plus 20%, so $12, $9.60 and $7.20 at the same steps. It has a $15,000 minimum and unlimited users. SSO and IP allowlisting are included. Custom work is quoted by project.

A 3-year agreement takes 5% off every year and locks your rate, though we still recount each year. Prepay all three years for 10% off. Over 25,000 accounts, we quote a volume price. The calculator above does this math for any count.

It's the full core assessment for one domain. Free runs every check except the hybrid identity ones and shows each finding with hacker insight and remediation steps. It keeps your latest scan only.

Standard adds the hybrid identity checks, which look at what Entra Connect leaves in AD. It also adds account risk scores, scheduled scans, remediation tracking and scan history across every domain you own.

Not for Standard. Request Standard quote opens our contact form with your estimate filled in. We reply with a quote and invoice within one business day. Enterprise starts with a short call so we can scope it to your needs.

Nothing changes until your next subscription year starts. We count when you buy and again each year. Disable the stale accounts we flag and they come off your next count.

On a 3-year agreement your growth is billed at your locked rate. The bill never drops below year one's.

The volume steps are already in the price. A 3-year agreement takes 5% off every year and locks your rate. Prepay all three years and it's 10% off. Over 25,000 accounts we quote a volume price. Other than that, the price on this page is the price.

Yes, if it's comparable. Send it to us before you buy. If it qualifies, we'll reply with a lower price within one business day. A quote qualifies when it meets all five of these:

• It's in writing. It's a quote or order form made out to your organization by the vendor or one of its authorized resellers.
• It's current. It's dated in the last 30 days and hasn't expired.
• It's a paid product that does what ours does. It scans Active Directory for security issues and tells you how to fix them. Anyone can buy it today. Free and open-source tools don't count. Neither do free tiers, trials or consulting work like a pentest.
• It covers the same ground. It's for the same accounts and domains over the same term.
• It's a regular price. One-time promotions don't count. Neither do bundles that don't price the AD product on its own.

We may check the quote with the vendor. We decide whether it's comparable and tell you why if it isn't. We beat one quote per agreement. Our other discounts don't apply on top of a beat price. We can change or end this offer at any time. A beat price we've sent you stays good for 30 days, even if we change the offer.

Card, check or ACH, billed annually. We can invoice you on net 30 terms and we have a W-9 ready for vendor setup. We add sales tax where your state requires it.

You can also buy through SHI or another reseller at the same list price. Need monthly billing? Talk to us.

Yes. Tell us at least 30 days before your renewal date and your plan won't renew. We don't refund time you've already paid for. A 3-year agreement runs its full term. The full terms are in our Plan Entitlement Schedule.

We multiply your count by PingCastle Enterprise's published starting rate of $30 per identity a year. We took that from pingcastle.com/purchase on Nov 4, 2026. It's their floor and real PingCastle prices come from a quote. PingCastle Enterprise also includes an Entra ID health check report, which we don't offer.

Only AD metadata leaves your network. Password hashes, Kerberos tickets and your NTDS.dit never do. It's stored in Microsoft Azure, East US 2, encrypted in transit and at rest. Anyone can get our SOC 2 report under NDA.

Free keeps your latest scan. Standard and Enterprise keep your history while you subscribe. You can delete it from your account any time. Closed accounts are cleared within 30 days. Details are on our security page, in our Privacy Policy and in the EULA.

The scan is read-only. It doesn't change Active Directory objects, pull credentials or install anything on your domain controllers. It does read a lot of AD in a short time, which some security tools flag. Give whoever watches your alerts a heads-up first.

No. Our hybrid identity checks look at what Entra Connect leaves in your on-prem AD, like the sync account and AZUREADSSOACC$. We never connect to your tenant.

Yes. Breach Point's practitioners can plan the work and do it with your team, billed hourly in 30-minute increments. Your plan takes up to 40% off the $250 base rate, so it's $212.50 an hour on Standard and $150 an hour on Enterprise. More on our services page.

Auditor is for one-off work. Each assessment is $350 and covers one client domain for 60 days with as many rescans as you need. MSSP is for clients you look after all year. You pay per enabled account for each client from our partner rate card. It adds scheduled scans and full history on every domain the client owns.

You can use both from the same partner account. Assess a prospect, then move them to MSSP when they sign on for ongoing work. Switch during the 60 days and the $350 comes off their first MSSP year.

One client domain for 60 days, starting with its first scan. Scan it as often as you like in that window. When it closes, the reports stay in your account and a new scan needs a new assessment.

You can assess the same domain twice a year. A domain you need to scan more often than that is an MSSP client.

We count the enabled accounts across all of the client's domains from a scan when you add them, then again each year. Growth in between is free. The rate card shows the minimum for each client.

They depend on how many accounts you manage across all your clients. We send the rate card when you get in touch and walk you through it on a short call. Partners with the same volume and agreement length pay the same standard rates.

Yes, if it's comparable. Send it to us before you buy. If it qualifies, we'll reply with a lower price within one business day. A quote qualifies when it meets all five of these:

• It's in writing. It's a quote or order form made out to your firm by the vendor or one of its authorized resellers.
• It's current. It's dated in the last 30 days and hasn't expired.
• It's a paid product that does what ours does. It scans Active Directory for security issues and tells you how to fix them. Anyone can buy it today. Free and open-source tools don't count. Neither do free tiers or trials.
• It covers the same ground. It's for the same clients and domains. A yearly quote also needs the same agreement length. Its license has to cover paid work on client networks.
• It's a regular price. One-time promotions don't count. Neither do bundles that don't price the AD product on its own.

We may check the quote with the vendor. We decide whether it's comparable and tell you why if it isn't. We beat one quote per agreement. Our other discounts don't apply on top of a beat price. We can change or end this offer at any time. A beat price we've sent you stays good for 30 days, even if we change the offer.

Not on Auditor. Buy one assessment at a time if that's all you need. A 50-account domain and a 50,000-account domain both cost $350 to assess.

MSSP has no minimum number of clients, so you can start with one. Its price follows each client's size. Clients over 25,000 accounts get a quote.

There's no refund for the rest of your year. You can put a new client in its place for the rest of your year. If the new one is bigger, you pay the difference for the rest of the year.

Your logo on every report and a client portal they can log into. You can export a customer edition without the remediation steps. Its Remediation Status section shows what's open and overdue without your team's names.

Yes. Every client domain needs written authorization from the client, as set out in the EULA.

Auditor and MSSP cover client domains only. Run your own AD on the Free plan, or on Standard if you want history and every domain. Resellers get Standard free on their own AD. Every partner and reseller gets a demo account for showing prospects.

Yes. MSSP includes SSO and IP allowlisting, the same as Enterprise. On Auditor they're quoted options. Either plan can add API work or an air-gapped install, which we scope with you and price into your plan. On a 3-year MSSP agreement the one-time deployment is waived.

MSSP rates already drop as you manage more accounts. A 3-year agreement takes another 5% off every year and locks your rate. Your yearly bill can't drop below year one's, even if clients leave. Prepay all three years and it's 10% off. Assessments are $350 each at any size.

Card, check or ACH. We can invoice you on net 30 terms. Need a W-9 for vendor setup? We have one ready. We add sales tax where your state requires it.

Yes. Tell us at least 30 days before your renewal date and your MSSP plan won't renew. We don't refund time you've already paid for. Assessments you've bought stay usable until they expire.

Only AD metadata leaves the client's network. Password hashes, Kerberos tickets and the NTDS.dit never do. It's stored in Microsoft Azure, East US 2, encrypted in transit and at rest. You can delete it from your account any time. Need everything to stay on site? Auditor and MSSP can add an air-gapped or self-hosted install. Details are on our security page.

We multiply your assessment count by $1,000, the published starting rate for PingCastle for Service Providers. We took that from pingcastle.com/purchase on Nov 4, 2026. Netwrix's docs say each PingCastle license runs two weeks. Real PingCastle prices come from a quote.