Skip to main content
Darkfield

Pricing

Simple, honest pricing.

Pricing scales with monitored assets, not seats. The same dark-web corpus the €100,000+ vendors ship — priced an order of magnitude lower. Cancel any time below Enterprise.

Observer

Anyone, no account

The public observatory. Read-only.

€0Always free
No sign-up required.
  • Full dossier access (470+ operators · 38k+ victims)
  • Daily Pulse, Atlas and Research articles
  • Universal lookup (domain, wallet, email, CVE)
  • Free API key: 50 requests / day
  • No Cyber Tokens — deep scans need Pro or above
Most popular

Pro

Researchers · journalists · solo analysts

Asset monitoring + alerts for one person.

€19/ month
  • Everything in Observer
  • API: 300 requests / day
  • 10 Monitored Assets
  • 100 Cyber Tokens / month (deep scan = 10)
  • Real-time alerts · email + webhook · Slack / Discord / Teams
  • CSV / JSON export of any page
  • Saved searches with email digest

Team

Security teams · MSSPs · small security functions

Shared watchlists across the team.

€79/ month
  • Everything in Pro
  • API: 1,000 requests / day
  • 50 Monitored Assets
  • 1,000 Cyber Tokens / month (deep scan = 10)
  • Up to 10 team seats
  • Shared watchlists across the team
  • Quarterly AI-written sector briefing

Enterprise

CISOs · threat intel teams · large security organisations

Production-scale corpus, SLA, custom integrations.

€499/ month
Talk to us
  • Everything in Team
  • API: 7,000 requests / day
  • 200 Monitored Assets
  • 10,000 Cyber Tokens / month (deep scan = 10)
  • Up to 100 team seats (custom above)
  • SLA + dedicated support
  • Custom integrations on request

All paid plans are billed through Orizon SSO. VAT charged where applicable. Annual = 2 months free (~17% off). Switch plans anytime; upgrades are prorated. Billable tools (deep scan, forensic analysis) spend Cyber Tokens from the monthly grant above — never an overage charge.

Comparison

How we compare.

Published or commonly reported annual list prices for dark-web intelligence and credential-monitoring vendors. Darkfield ships the same corpus categories at €190–€4,990/year vs €20k–€250k+ for the legacy stack.

Darkfield Observer€0

Read-only public corpus

No card required

Darkfield Pro€190

10 monitored assets

this page

Darkfield Team€790

50 monitored assets

this page

Darkfield Enterprise€4,990

200 monitored assets

this page

Have I Been Pwned Pro$3,288

Stealer logs + bulk domain

Credentials only

~$2.4k saved vs Team

Snusbase / DeHashed$60–$200

Lookup only

No monitoring

IntelX$3,000+

Phonebook + breaches

Lookup-centric

~$2.1k saved vs Team

SOCRadar Pro$94,800

Dark web + brand

$7,900/mo published

~$94k saved vs Team

Flare$20,000+

Dark web + leak sites

Custom quote, starting

~$19k saved vs Team

ZeroFox€70,000+

EASM + dark web

EASM via Orizon RECON

~€69k saved vs Team

SpyCloud$50,000+

Credentials + identity

Enterprise estimated

~$49k saved vs Team

KELA / Group-IB / Intel 471$75,000–$250,000+

Full TI suite

Enterprise quote

~$149k+ saved vs Team

Recorded Future / Flashpoint$100,000+

Full TI + analyst access

Enterprise quote

~$99k saved vs Team

Source: vendor public pricing pages where published; otherwise commonly reported list prices in analyst summaries (Gartner, Forrester) and security-team RFPs from 2024–2026. Savings calculated vs Darkfield Team (€790/yr), converted at €1 = $1.08 for rows listed in dollars. Coverage column reflects what each tool is marketed for, not feature parity.

Need EASM + IASM too?

Darkfield is dark-web only on purpose. External + internal attack- surface management lives in RECON — same Orizon family, same SSO. Pair the two for ZeroFox-grade coverage at a fraction of the price.

Explore RECON

Frequently asked

Common questions.

What's an Asset?

Anything Darkfield monitors continuously for new mentions — a company domain, a corporate email pattern, a crypto wallet, a brand name. Each Asset on your plan is checked against every new leak-site post, Telegram message, breach drop and blacklist update we ingest.

How does the API quota work?

A daily cap, resets at 00:00 UTC. Soft cap by default — we never auto-bill overage. If you hit your quota we email you and you can upgrade. Observer = 50/day, Pro = 300/day, Team = 1,000/day, Enterprise = 7,000/day (custom volumes on request).

What are Cyber Tokens, and how many do I get?

Cyber Tokens are the Orizon-wide currency for the tools that cost real compute: a deep dark-web scan spends 10, a forensic analysis 25. Each plan grants a monthly balance — Observer 0, Pro 100, Team 1,000, Enterprise 10,000 — so Pro covers 10 deep scans a month. With an empty balance a billable tool declines instead of charging you; top up from the Billing tab in Orizon SSO. Everything on the public observatory stays free and costs no tokens.

Can I switch plans mid-cycle?

Yes. Upgrades take effect immediately and are prorated; downgrades take effect at the start of your next billing period. All managed through your Orizon SSO Billing tab.

How does annual billing work?

Toggle Annual above and pay for 10 months — 2 months free, roughly 17% off the monthly rate. That is €190/year for Pro, €790 for Team, €4,990 for Enterprise. Billed once a year via Orizon SSO. Same plan benefits, no other changes.

Is there a free trial of Pro?

Observer is free forever and covers the public corpus. Pro adds asset monitoring and alerts — if you need a 14-day trial of those features for evaluation, email  .

How does this compare to SpyCloud / Flare / KELA?

We cover the same source categories (ransomware leak sites, credential dumps, Telegram, Tor) at €190–€4,990/year vs €20k–€250k+. We do not yet ship the analyst-services layer those vendors bundle — if you need human-written briefings on demand, Enterprise includes a quarterly one.

Ready when you are

Start watching the dark web in 30 seconds.

Sign in with Orizon SSO and pick a plan. Free Observer access, no card required.

Get started