Security Center Agentic SOC is upgrading its billing model to more accurately reflect resource consumption and provide flexible budget management. The new model shifts from billing primarily based on log ingestion volume to comprehensive billing based on three dimensions: intelligent operations volume (Credits), managed instance count, and log ingestion volume. Three billing modes are available after the upgrade: pay-as-you-go, upfront, and upfront with overflow to pay-as-you-go.
Effective time
From July 30, 2026 to August 30, 2026, Agentic SOC will gradually switch to the new billing model according to the product-side migration strategy. The specific switchover time is subject to console notifications or internal messages. New users will gradually adopt the new billing model according to product release and migration schedules. Existing users are not affected within the validity period of their current orders.
Important notice
After switching to the new Agentic SOC billing model, it may not be possible to revert to the legacy billing model.
Before making new purchases, renewals, configuration changes, or upgrades, confirm entitlements, unit prices, and estimated costs through the console purchase page, activation page, or cost estimation tool.
Actual costs are subject to the purchase page, metering results, and bills in Billing Center. If you have questions, submit a ticket through Alibaba Cloud Management Console.
Changes
The new Agentic SOC provides three billing modes. Intelligent operations volume is measured in Credits. Intelligent security operations such as AI investigation, alert analysis, historical tracing, and automated response and remediation all consume Credits.
Pay-as-you-go
After activating Agentic SOC pay-as-you-go billing, the system separately meters and generates postpaid bills based on the actual usage of intelligent operations volume, managed instance count, and log ingestion volume.
Billing item | Billing rule |
Intelligent operations volume | Billed in near-real-time based on actual Credits consumed, at USD 0.00225/Credit. |
Managed instance count | Billed based on the number of target instances to which remediation actions are dispatched in security operations response, at USD 2.25/seat/month, counted by calendar month. |
Log ingestion volume | Log ingestion volume entitlement is calculated based on daily Credits consumption. The portion exceeding the entitlement is billed using tiered pricing. |
Credits-to-log-ingestion conversion rule: Credits are accumulated by calendar day. Every 24,000 Credits consumed converts to 1 GB/day log ingestion volume entitlement. Before daily billing for log ingestion volume, the converted entitlement for the day is deducted first. The portion exceeding the entitlement is billed using the following tiered pricing:
Daily log ingestion volume exceeding entitlement | Tiered pricing |
1-10 GB/day | USD 2.2/GB |
11-50 GB/day | USD 1.6/GB |
51-100 GB/day | USD 1.4/GB |
101+ GB/day | USD 1.2/GB |
Tiered fees are accumulated separately for each tier. For example, if 60 GB exceeds the entitlement after deduction, the fee is calculated as follows: 10 GB × USD 2.2/GB + 40 GB × USD 1.6/GB + 10 GB × USD 1.4/GB = USD 100.
Upfront
Upfront billing is suitable for scenarios where usage is predictable and you want to lock in budget in advance. You can configure intelligent operations packages and managed instance packages through the same order, with monthly or annual payment. The annual price is calculated as monthly price multiplied by 12.
Package | Monthly price | Annual price | Entitlement |
Intelligent operations package | USD 1,800/month | USD 21,600/year | Each package provides 600,000 Credits and 50 GB/day log ingestion volume entitlement. |
Managed instance package | USD 15/month | USD 180/year | Each package provides 10 managed instance seats, i.e., USD 1.5/seat/month. |
Upfront entitlements are deducted first within the validity period. Credits and log ingestion volume entitlements from multiple intelligent operations packages are stacked by package count. For example, purchasing 2 intelligent operations packages provides 1,200,000 Credits and 100 GB/day log ingestion volume entitlement.
Users with active upfront subscriptions can upgrade or downgrade through the console. After downgrading, the Quantity cannot be lower than the minimum number of packages required by actual current usage. The specific adjustable quantity and payable or refundable amount are subject to what is displayed on the action page and in Billing Center.
Upfront with overflow to pay-as-you-go
Upfront customers can enable Elastic Protection to authorize overflow postpaid billing. The system prioritizes deducting upfront entitlements. After entitlements are exhausted, the excess portion continues to be used and billed according to pay-as-you-go rules.
Overflow item | Overflow handling |
Intelligent operations volume | After Credits are exhausted, the excess is billed at USD 0.00225/Credit on a postpaid basis. |
Managed instance count | After exceeding the upfront seat entitlement, billed at USD 2.25/seat/month on a postpaid basis. |
Log ingestion volume | Upfront intelligent operations package log ingestion volume entitlement is deducted first. The excess is billed using log ingestion volume tiered pricing. |
Elastic Protection is disabled by default. If not enabled, new excess consumption is blocked after upfront entitlements are exhausted, and you will be guided to purchase new upfront packages or enable Elastic Protection. Disabling Elastic Protection does not affect postpaid bills generated before disabling.
Billing mode selection recommendations
The following comparison can help you choose the appropriate billing mode:
Dimension | Pay-as-you-go | Upfront | Upfront with overflow to pay-as-you-go |
Scenarios | High usage fluctuation, pay for actual usage | Stable usage, lock in budget in advance | Balance budget control and business continuity |
Payment method | Postpaid on demand | Monthly or annual prepayment | Upfront + overflow postpaid |
Business continuity | Always available | New consumption blocked after entitlement exhaustion | Always available |
Specific recommendations:
If your usage is relatively stable and you want to lock in budget in advance, choose upfront billing and purchase the appropriate number of packages based on estimated intelligent operations volume, log ingestion volume, and managed instance count.
If your usage fluctuates significantly or you want to pay for actual usage, choose pay-as-you-go.
If you want to prioritize using upfront entitlements while avoiding business interruption after entitlement exhaustion, purchase upfront packages and enable Elastic Protection. After enabling, excess portions are billed according to pay-as-you-go rules.
If your use case primarily involves AI investigation, alert analysis, historical tracing, and automated response and remediation, focus on intelligent operations volume Credits and managed instance count.
If your use case primarily involves large-scale log ingestion, focus on the log ingestion volume entitlement converted from Credits and the tiered pricing for the portion exceeding the entitlement.
Existing user entitlements and migration
Users who have purchased Agentic SOC subscription services can continue using the original billing model within the validity period of their current orders.
Users who have activated Agentic SOC pay-as-you-go services can continue using the original billing model within the validity period of their current orders.
When existing users subsequently renew, reconfigure, upgrade, or actively switch to the new Agentic SOC, the new billing model may apply, subject to the rules displayed on the action page.
Existing Agentic SOC (legacy) or Security Operations Agent (legacy) users will not be automatically switched with this upgrade. When migration conditions are met, the console will display the capabilities and billing rules of the new Agentic SOC, and the upgrade will be completed after user confirmation.
The new Agentic SOC is mutually exclusive with existing upfront or existing postpaid capabilities. The specific purchase or upgrade entry points are subject to what is actually displayed in the console.
Log storage capacity has been independently separated from the Agentic SOC product as a Security Center cross-cutting capability with separate activation and billing. Log storage is not counted toward Agentic SOC Credits entitlements.