What you can actually buy
Everything below is a separate line item. Nothing here is a bundle of things you did not ask for, and each entry carries a maturity label — live, or engineered but not yet orderable — because the difference matters more than the price does.
Nexus Prism — the platform
Seats into the fusion platform: dashboards, the knowledge graph, API access, and STIX/TAXII export from Gold upward.
From $49 per seat / month. Four tiers, published on the pricing page. Annual prepay is two months free.
Live.
Data feeds
Scheduled delivery as STIX 2.1 over TAXII 2.1 — the format your threat intelligence platform, SIEM or case system already reads natively. No seats needed, nobody has to log into anything, and the objects land in the tool your analysts already have open.
The six pillars
| Pillar | What it carries |
|---|---|
| Financial Intelligence | On-chain provenance from nodes we run, sanctions and export-control screening, entity resolution, typology detection |
| Dark Web & Anonymity Networks | Tor, I2P and Freenet collection, hidden-service reachability and software census, marketplace and forum context |
| Threat & Extremism | Actor profiles, radicalisation indicators, incident correlation, MITRE ATT&CK mapping |
| SIGINT & Infrastructure | RF and telemetry collection, exposed-service census, infrastructure attribution |
| Land & Property | Ownership structures, shell-company resolution, transaction anomalies, cross-jurisdiction holdings |
| Cultural Heritage | Looted-antiquities tracking, provenance chains, art-market flows |
Bundles
| Includes | Monthly | Annual prepay | |
|---|---|---|---|
| Single pillar | Any one of the six | $1,500 | $15,000 |
| Three pillars | Any three, your choice | $3,500 | $35,000 |
| Full fusion | All six, plus Argus | $6,500 | $65,000 |
Annual prepay is two months free, the same as seats. Feeds are invoiced rather than charged to a card — card processing on a five-figure subscription is a cost we would only be passing back to you.
Live.
What this costs elsewhere
Worth stating plainly, because it is the single most surprising thing about this page. Published enterprise threat-intelligence subscriptions start at roughly $30,000 a year and commonly run $50,000 to $300,000; one vendor lists £39,000 to £234,000 per unit per year on a public government procurement framework. Below that market there is a free and small-business lane — MISP, OTX, community editions — costing under $400 a year and requiring you to supply the analysis yourself.
Between those two there is very little. A single pillar here is $15,000 a year prepaid, which is beneath the floor of the commercial market, and the full six-pillar fusion at $65,000 sits where several vendors put their entry tier.
We are not cheaper because there is less in it. We are cheaper because there is one person, no sales organisation, no channel margin, and nodes we run ourselves instead of a resold vendor API.
Argus — satellite early warning
Ground-change detection over Texas from Sentinel-2 imagery, delivered as its own STIX 2.1 / TAXII 2.1 feed. 64,726,872 change objects across 39 GB, with confounders reported rather than suppressed — cloud shadow, seasonal shift and illumination are labelled, not quietly dropped, because a detector that hides its own noise cannot be audited.
$1,500 / month, or included in the full-fusion bundle above.
Read the Argus page · Live.
Bring-Your-Own-Feed
Your data, inside the fusion, without sending it to us and without waiting on our roadmap.
BYOF is a feed-adapter SDK. You write a declarative manifest — classification, caveats, tenant scope, cadence, data pillar, PII class, auth scheme — and an adapter with three methods. Everything you emit passes through an observation sink that stamps classification, provenance and a SHA-256 content hash. The adapter cannot bypass that sink, which is the point: your caveats survive the fusion rather than being reapplied by convention.
It ships with a canonical SDK specification, a quickstart, a data-processing addendum for your counsel, and 17 reference adapters in the SIGINT pillar you can read as worked examples.
Two ways to take it:
| What | Price | |
|---|---|---|
| Self-serve | You write the adapter against the SDK. Manage, test and enable it from the portal | Included from Gold seats up |
| Adapter engineering | We build the adapter against your source and hand you the manifest | $500 / hour, typically scoped as a fixed-price engagement |
Live.
Hermes — hardened mobile deployment
A GrapheneOS deployment done properly, and the training to keep it that way.
This is sold as expertise, not hardware. Anyone can read a flashing guide; almost nobody in a C-suite is going to, and the failure modes are quiet ones — a sideloaded app that re-enables the thing you removed, a profile that leaks across a boundary you thought was sealed, a backup that undoes the whole posture. What you are buying is a build done correctly, a destroy-and-rebuild cycle that has been proven rather than described, and enough training that the device stays hardened after we leave.
From $2,500 per engagement.
Live.
Engagements
Priced per matter, because the work is not a subscription.
| What it is | |
|---|---|
| Themis — Fraud Referral & Filing | Investigation packaged as a referral dossier suitable for filing with a regulator or law-enforcement body |
| Nostos — Asset Trace & Recovery | Tracing assets across chains and jurisdictions, to the point where recovery counsel can act |
| Consulting | $500 / hour |
| Expert witness | $750 / hour |
Engineered, not yet orderable
We would rather name these than let a sales conversation imply they are ready. All three have working reference builds behind them. None of them is a catalogue item you can order today, and the honest description is a scoped engagement with a specification.
- PMK (Professional Master Key) — portable secure workspace. The original 1986 utility this company is named for, rebuilt for a threat model that did not exist then. See the sovereignty page.
- Fortress Home — sovereign network edge. Hardened routing, egress control and a kill switch that fails closed, built on your infrastructure.
- AEGIS — enterprise security architecture. Specification stage.
On-premises and air-gapped
The platform inside your network, or inside a facility with no network at all.
| From | |
|---|---|
| On-premises — signed images inside your perimeter | $45,000 / year plus setup |
| Air-gapped appliance | Quoted per engagement |
| White-label | Quoted per engagement |
Your data stays on hardware you control. That is the default posture of this product rather than an upgrade — there is no version of Nexus Prism that requires your intelligence to sit on our infrastructure.
What we will not sell you
Investigation for hire. We are a research and analysis firm. Texas Occupations Code §1702.101 makes offering unlicensed investigative services a violation, and we would rather say so on the price list than in a footnote after you have asked.
A capability that is not built yet. Everything above carries a maturity label. Where a thing is specified rather than shipped, this page says so.
Certifications we do not hold. We are not FedRAMP authorised, SOC 2 attested or ISO 27001 certified. See the security page for what we do claim and how to check it.