About billing and pricing

There are two billing types available for using the Deep Security AMI from AWS Marketplace as your Deep Security Manager:

  • Bring-your-own license (BYOL)
  • Pay as you Go billing

Bring-your-own license (BYOL)

You are billed based on a license that you pre-purchase from Trend Micro. For BYOL pricing, please contact the Deep Security Support team.

Pay as you Go billing

Your Amazon Web Services (AWS) account is billed monthly, based on the number of hours your computers are protected with Deep Security. These are known as 'protection-hours'.

The pricing for Pay as you Go is shown in the table below.

The rates below only apply if you added the computers using an account connector (in Deep Security Manager, go to Computers > Add Account). If you added computers directly (Computers > Add Computer), the protection-hours are billed at the highest rate (Data Center) regardless of the computer's size.

Computer size Examples Cost per hour (in USD) per instance
Medium or smaller

Amazon EC2: C1, M1, M3, T1, T2

Amazon WorkSpaces

Azure: 1 core

Google: 1 core

 $0.01
Large

Amazon EC2: C3, C4, M1, M3, M4, R3, T2

Azure: 2 cores

Google: 2-3 cores

 $0.03
Extra-large and greater

Amazon EC2: C1, C3, C4, CC2, CG1, CR1, D2, G2, HI1, HS1, I2, M1, M2, M3, M4, R3

Azure: 4 or more cores

Google: 4 or more cores

 $0.06
Data Center

All computers in Deep Security Manager that are not from a cloud connector

 $0.06

What Deep Security considers as a protection-hour

This section applies only to Pay as you Go billing.

Cost is based on hours during which your computers are protected by Deep Security Agent. Partial protection within a clock-hour boundary is considered a full hour. In the example below, you can see how this is calculated in the usage scenarios below.

Pricing and usage chart

When protection-hours start and stop

How Deep Security counts protection-hours varies by how the computer was added to the manager:

  • If added through Computers > Add Account: Protection-hours start when the instance is powered on, and include hours when the Deep Security Agent status is "Offline". Protection-hours stop when the instance is powered off, deleted, or the agent is uninstalled.
  • If added through Computers > Add Computer: Same as above, but excludes hours when the Deep Security Agent status is "Offline".

Even if an agent's status is "Offline", protection continues with the agent's last known configuration. Other features such as centralized reporting, however, require connectivity with the manager. To troubleshoot, see "Offline" agent. Alternatively, if the computer is decommissioned and will be permanently offline, you should de-activate its agent on the manager.