Agentic NDR uses a subscription billing model. Charges fall into three categories: a monthly subscription fee (which includes base resources), optional add-on fees for usage beyond the included quotas, and additional VPC traffic mirroring fees when you direct private network traffic to Agentic NDR.
To purchase Agentic NDR, go to the Cloud Firewall purchase page. If you already have a Cloud Firewall subscription, click Upgrade on the right side of the Cloud Firewall Overview page to add the full Agentic NDR service. For a list of supported regions, see Supported regions.
Subscription fees
The base subscription is USD 1,500/month and includes:
200 Mbps of bandwidth
2 Agentic NDR instances
30 GB of attack packet storage capacity
Each Agentic NDR instance covers connectivity for both the Internet and private networks. One instance is required per region that contains connected assets. With multi-account management enabled, each instance under a different account incurs a separate instance fee.
Add-on fees
Purchase add-ons when your usage exceeds what the base subscription includes.
| Billing item | Price | Details |
|---|---|---|
| Additional instance | USD 360/instance/month | For instances beyond the 2 included in the base subscription |
| Additional bandwidth | USD 7/Mbps/month | Purchased in 10 Mbps increments. The total bandwidth quota is shared across inbound and outbound traffic from both the Internet and private networks. |
| Full-traffic storage capacity | USD 115/TB/month | Stores complete, raw network traffic. Minimum purchase is 1 TB, in 1 TB increments. Billed by Agentic NDR. Once the included 30 GB of attack packet storage is exhausted, this capacity continues storing attack packets. |
| Elastic traffic processing capacity | USD 0.06/GB | Processing capacity for traffic that exceeds your purchased bandwidth. See Elastic traffic processing capacity below. |
| Log storage capacity | USD 80/TB/month | Shares log storage space with Cloud Firewall. Purchased in 1 TB increments. Billed by Cloud Firewall. |
Storage purchase recommendations:
For 50 Mbps of Internet bandwidth with a 14-day full-traffic retention period, purchase 4 TB of full-traffic storage. To reduce storage costs, configure custom packet filtering rules.
For an Agentic NDR service with 200 Mbps of bandwidth, purchase 2 TB/month of log storage capacity. To reduce storage costs, configure custom log filtering rules.
Elastic traffic processing capacity
The behavior of elastic traffic processing capacity depends on your Cloud Firewall billing method:
Billing Method 2.0: Enabled by default and cannot be disabled. Capped at 10 Gbps. To request a higher limit, contact your account manager or solutions architect. For details, see Pay-as-you-go elastic traffic for subscription plans.
Billing Method 1.0: Manually enable or disable this feature. Its status synchronizes with the Burstable Protected Traffic switch in Cloud Firewall. For details, see Billing Method 1.0 and upgrade guide.
Additional billing for private network traffic
When you direct traffic from assets in a private network to Agentic NDR, VPC traffic mirroring incurs additional charges. VPC meters and bills these charges, which are then added to your account bill.
How charges are calculated
Traffic mirror fee = Instance fee + Data processing feeInstance fee = Number of traffic mirror sources with active sessions × Active session duration (hours) × USD 0.014/count/hour
Data processing fee = Total mirrored data (GB) × USD 0.007/GB
| Billable item | Unit price |
|---|---|
| Instance fee | USD 0.014/count/hour |
| Data processing fee | USD 0.007/GB |
Each connected elastic network interface (ENI) counts as a separate billable instance.
After you direct private network traffic to Agentic NDR, an hourly instance fee applies to each connected ENI, with partial hours billed as full hours.
The data processing fee is waived until March 31, 2026.
Example: estimating monthly VPC traffic mirroring costs
Suppose you have 2 ENIs connected for a full month (720 hours) and mirror 500 GB of data:
| Fee type | Calculation | Amount |
|---|---|---|
| Instance fee | 2 ENIs × 720 hours × USD 0.014 | USD 20.16 |
| Data processing fee | 500 GB × USD 0.007 | USD 3.50 |
| Total | USD 23.66 |
Adjust the ENI count, active hours, and data volume to estimate costs for your environment.