Every AI SOC and agentic SOC pricing model is a claim about who carries the cost of the AI’s work. These questions surface that claim in writing. Bring them to vendor meetings, proposal reviews, and the contract redline. A vendor with a fair model will answer all sixteen without flinching.
Every model counts something. Find out what, before it finds you.
What exactly is the billable unit: investigations, tokens, credits, actions, endpoints, or something else?
If the unit is credits, what is the conversion rate to underlying token or compute costs, and can it change during the term?
What usage thresholds trigger notifications, and at what percentage of allocation do they start?
Show me a sample invoice from a real month. Which lines are fixed and which lines float?
Incidents spike alert volume. Find out who pays for the spike.
If an incident multiplies our alert volume 6x for two weeks, what does that month cost compared to a normal month?
When we exceed our quota or allocation mid-incident, does the AI keep investigating at overage rates, throttle, or stop? Where is that behavior written in the contract?
What are the overage rates, in writing, before we sign?
Your SOC will be bigger next year. Find out what that costs.
If we grow 40% (endpoints, log sources, alert volume), what happens to the bill, and when: immediately, monthly, or at renewal?
Do new log sources or integrations change the price even if headcount doesn’t?
Can we model year-two costs today with a formula you’ll stand behind?
When the AI’s thinking is metered, thoroughness has a price. Ask whose.
Does a deeper investigation cost us more than a shallow one? If yes: what stops depth from becoming a budget decision?
Do you recommend limiting which alert types we ingest to manage cost? What coverage do customers typically exclude?
The model lives in the paperwork, not the pitch.
Is there a platform prerequisite (a specific EDR, SIEM, or data lake subscription) required before this pricing applies?
Are AI or LLM costs passed through in any form: tokens, credits, compute surcharges, or “AI add-on” line items?
If your underlying model costs rise, who absorbs it: you, or us at renewal?
The only question finance actually has.
Can we write one number into next year’s budget for this platform, and will it still be right in twelve months? If the answer needs a paragraph, the answer is no.
One annual subscription. Nothing metered.
D3 Security’s Morpheus agentic SOC platform is priced through an alert volume envelope, right-sized to your SOC. Inside the envelope, nothing counts against you: investigation depth is unlimited, incident spikes are what the headroom is for, and there is no platform prerequisite. If your SOC outgrows its envelope, you step up to the next size you already knew existed.
See it live at D3security.com/morpheus — and leave with a subscription figure your finance team can put in writing.
© 2026 D3 Security. Last reviewed July 2026.
