Pricing
The observatory stays free.
Everything you see at darkfield.orizon.one — dossiers, Pulse, Atlas, Tools — is and will remain free. Upgrade only when you need automation: continuous monitoring, alerts, API access, exports.
Observer
The public observatory. No account required.
- Full dossier access (38k+ victims, 470+ operators)
- Daily Pulse, Atlas, Research articles
- Universal lookup (domain, wallet, email, CVE)
- Pwned Passwords check (13B records, k-anonymous)
- Anonymous API: 100 req/h per IP
- Asset monitoring
- Real-time alerts
- CSV / JSON export
Pro
For independent researchers, journalists, and individual analysts.
- Everything in Observer
- API: 50,000 requests / month
- 50 monitored assets (domains, wallets, emails)
- Real-time alerts (email + webhook · Slack/Discord/Teams/generic)
- Deep-scan + forensic analysis on demand
- CSV / JSON export of any page
- Saved searches with email digest
- 100 Cyber Tokens / month included
Cancel anytime. Extra usage billed in Cyber Tokens via Orizon.
Team
For SOC teams, MSSPs, and small security functions.
- Everything in Pro
- API: 500,000 requests / month
- 250 monitored assets
- Up to 10 team seats
- Shared watchlists across the team
- Quarterly AI-written sector briefing
- 1,000 Cyber Tokens / month included
- Priority email support (24h response)
Enterprise
For organisations replacing SpyCloud, Flare or KELA at 10× lower cost.
- Everything in Team
- API: 30M+ requests / month (1k req/min sustained)
- 10,000 monitored assets
- Unlimited team seats + RBAC
- Dedicated Customer Success Manager
- SLA 99.9% with credit-back policy
- Custom integrations + on-prem option
- 10,000 Cyber Tokens / month included
- Priority slot for stealer-log corpus integration
Contact us for procurement, security review, or volume discounts.
How we compare
Published or commonly reported annual list prices for dark-web intelligence and credential-monitoring vendors. Darkfield covers the ransomware + onion + telegram + breach-catalog corpus that smaller teams need at a fraction of the cost.
| Vendor | ~ Annual | Notes |
|---|---|---|
| Darkfield Pro | €228 | this page |
| Darkfield Team | €948 | this page |
| Darkfield Enterprise | €5,988 | this page |
| Have I Been Pwned Pro | $3,288 | stealer logs + bulk domain |
| Snusbase / DeHashed | $60-$200 | lookup only, no monitoring |
| IntelX | $3,000+ | phonebook + breaches |
| SOCRadar Pro | $94,800 | $7,900/mo published |
| Flare | $20,000+ | custom quote, starting |
| ZeroFox | €70,000+ | EASM + dark web |
| SpyCloud | $50,000+ | enterprise, est. |
| KELA / Group-IB / Intel 471 | $75,000-$250,000+ | enterprise quote |
| Recorded Future / Flashpoint | $100,000+ | enterprise quote |
Prices verified from public listings (HIBP, SOCRadar, Flare, Snusbase, DeHashed, IntelX, ZeroFox) or commonly reported ballparks for enterprise-quote vendors. We don't claim feature parity with $100k+ analyst-led platforms — we claim 80% of what most teams actually use at 1-10% of the cost.
How billing works
All Darkfield subscriptions are handled by Orizon via Cyber Tokens — a single virtual currency you can use across every Orizon product (Darkfield, RECON, Fireline, Aware). Your monthly plan includes a token allowance; if you go over, extra usage is billed at the current token rate. Cancel any time, no annual lock-in below Enterprise.
Why isn't everything paywalled?
Darkfield exists because the dark-web threat ecosystem is opaque enough already. Locking the data behind a paywall would defeat the point. We monetise the automation layeron top — monitoring, alerts, exports — not the data itself.
How are you 10× cheaper than the big platforms?
We share the underlying Orizon infrastructure (SSO, billing, data lake) with our sister products. No expensive standalone sales motion, no on-prem trial appliances, no analyst-team overhead. You get the corpus at marginal cost. Stealer-log ingestion is on the roadmap — already covered via HaveIBeenPwned for password reuse checks at no extra charge.
What about academia / journalism?
Verified investigative journalists and accredited research institutions get Pro at no cost. Email [email protected] from a verifiable institutional address.