Ask a security automation vendor two questions before you buy. What does it cost? And what happens the day you stop paying? For most of this market, the first has no published answer and the second has an answer nobody wants to say out loud.
Splunk SOAR is priced per analyst seat, and there is no list price anywhere -- every figure circulating publicly is a third-party estimate. That is not unusual; it is the category norm. Quote-only pricing is a sales tactic with a real cost to the buyer: you cannot budget for what you cannot see, and the number you eventually get depends on how good your procurement team is at a game the vendor plays every day.
The second question is worse. When an automation platform's licence lapses, the orchestration stops. The playbooks that were closing your tickets and containing your hosts are the hostage in every renewal negotiation, and both sides know it. The renewal price reflects it -- Splunk's own published standard uplift is +9% a year, and that is the published part.
Our answers, in writing
BabySOARus costs $12,000 a year per Splunk deployment. A deployment is a search head or a whole search head cluster; users and executions are unlimited; the price is on the website. As far as we can tell, that makes it one of a handful of published prices in the entire category. We would rather compete on a number you can budget against than on a quote you have to negotiate blind.
When you stop paying, your searches keep running. Specifically: detections still execute, your data stays where it is, saved functions and their history remain readable and editable, and nothing is deleted or locked. What degrades is outbound network access from your code -- enrichment calls to external APIs, response actions against vendor endpoints. A row that needed the network gets an error on that row; the search itself completes.
We call this degrade-not-disable, and it is not a policy we could quietly change later: section 6.3 of the licence agreement commits us not to make expiry behaviour more restrictive for a term you have already bought. Your detection estate is not a hostage. If our renewal offer is not worth it, you walk away with a working search environment and we lose the customer, which is the correct incentive structure for both of us.
The engineering under the promise
A commercial promise is only as good as the code that implements it, so here is the implementation. Licence verification is an offline Ed25519 signature check against a file you import; the product never phones home, because there is no home to phone -- no telemetry, no usage reporting, no licence server in the loop. That is also what makes air-gapped deployments work, and it means our licensing infrastructure being down can never degrade your Monday morning.
Enforcement fails open, deliberately. If the daemon cannot determine licence state -- a transient storage error, a hiccup mid-restart -- nothing degrades, because a customer must never be punished for our infrastructure's bad moment. Degradation happens only on a positively known bad state: a licence that has genuinely expired, or a trial that has genuinely ended.
And when it does happen, it happens legibly. A banner says what changed and when; the licence page says what is restricted and what is not; a degraded enrichment call returns a structured error on the rows that needed it rather than failing the whole search. The one thing worse than degraded functionality is degraded functionality that looks like a mysterious outage.
The trial works the same way
Every install runs the full product for 90 days. Not a feature-gated preview -- the whole thing, every library detection, the editor, outbound network access. There is no signup, because a trial that starts with a lead-capture form is a trial that starts by telling you what the vendor actually wants. We never learn you are evaluating unless you email us.
When the 90 days end, the trial degrades exactly the way an expired licence does -- searches keep running, network access from your code is denied -- and a licence imported at any point restores everything. The fourteen-days-left warning appears in the product itself, which is the only channel we have, and the only one we need.
Why be this legible?
Because the buyer is a security team, and security teams verify claims for a living. Every promise above is checkable: the price is public, the expiry behaviour is in a contract you read before buying, the no-telemetry claim survives a packet capture, and the licence check survives an air-gap. A vendor whose commercial terms only survive not being read closely has told you something about their product too.
The category treats opacity as leverage. We think it is a bug, and a fixable one.