About Deep Security Agent pricing and billing on AWS Marketplace

Deep Security Agent pricing

Pricing per hour of protection varies by instance size if you buy Deep Security as a Service with the AWS Marketplace payment options:

  • AWS billing subscription
  • credit card subscription
  • prepaid credit

or Azure Marketplace Deep Security (BYOL).

Instance size Examples Cost per hour (in USD) per instance
Medium or smaller

Amazon EC2: C1, M1, M3, T1, T2

Amazon WorkSpaces

Azure: 1 core


Amazon EC2: C3, C4, M1, M3, M4, R3, T2

Azure: 2 cores

Extra-large and greater

Amazon EC2: C1, C3, C4, CC2, CG1, CR1, D2, G2, HI1, HS1, I2, M1, M2, M3, M4, R3

Azure: 4 or more cores

Data Center

All computers in Deep Security Manager that are not from a cloud connector


If you use prepaid credit, Trend Micro notifies you when an estimated 30 days of credit remain. The estimate is based on current usage. If credits run out before you renew, then existing protection remains, but you won't be able to activate Deep Security Agent on new computers, and existing agents will not receive updates.

What Deep Security considers as a protection hour

Cost is based on hours during which your computers are protected by Deep Security Agent. Partial hours are billed as a full hour.

To check the current number of billed protection hours, see Check Deep Security as a Service billing and usage in AWS Marketplace.

Example: Hours billed via AWS Marketplace

You can see how this is calculated in the usage scenarios below:

Pricing and usage chart

When Deep Security considers a computer protected

How Deep Security counts hours of protection varies by how the computer was added to the manager:

  • Via cloud connector: Counts hours when the instance is powered on, including when the Deep Security Agent status is "Offline".
  • Not via cloud connector Counts hours except when the Deep Security Agent status is "Offline".

If an agent's status is "Offline", then protection continues with its last known configuration. Other features such as centralized reporting, however, require connectivity with the manager. To troubleshoot, see "Offline" agent. Alternatively, if the computer is decommissioned and will be permanently offline, you should de-activate its agent on the manager.