05 / FAQ
The five questions
every buyer asks first.
Same answers our pilot teams heard in the first call. Plain-English, grounded in the pricing math and the same constants used across the site — no invented claims.
Buyer objections
Pricing, false positives, lock-in, coverage, handoff.
Pricing
How much does Crowmark cost?
Per-seat transparent pricing — Bronze at $49 per seat per month ($500/seat/year), Silver at $99 per seat per month ($1,000/seat/year), and Gold at $199 per seat per month ($2,000/seat/year). Annual billing saves approximately 15% on all three tiers. Billing tracks humans covered, not the laptops or cloud accounts watched, so adding a contractor costs the same as adding a hire. The full breakdown of integration caps, brief cadence, response SLAs, and the human handoff for each tier lives on the pricing page.
False positives
Won't AI-driven monitoring just page us with garbage?
Low-confidence items are auto-contained on your behalf — IOC egress is quarantined, tokens get revoked, and malicious destinations get blocked at the edge — instead of being punted to the on-call seat. The 07:00 weekday morning brief then curates everything that actually needs a human decision: items already handled at the edge, the rare sign-off approvals, and a five-minute remediation list. False-positive volume is treated as an operational cost we absorb, not one we hand to your team. The longer walkthrough of the watch, auto-contain, triage, and brief loop is in the explainer.
Lock-in
Will we be stuck if it does not work out?
Bronze and Silver run month-to-month with cancel any month, no annual commit required. Gold is month-to-month with cancel any month: a 30-day auto-contained tail keeps your integrations working after the subscription ends so the hand-off to your next tool, a staffed SOC, or an in-house rotation is clean. You own the data — the alerts you generated, the items that got auto-contained, the brief archive on its 90-day retention window — and you can export it as a CSV or in any of our standard integrate formats, so porting away is a one-day operation. The handoff design, including what auto-contain keeps running and what stops, is laid out in the explainer.
Coverage
What integrations do you actually watch?
Five telemetry families: cloud (AWS, Azure, GCP), identity (Okta, Entra, Google Workspace), endpoint (CrowdStrike, Defender, SentinelOne), continuous dark-web monitoring, and live CVE feeds scored against your running stack. Crucially, every collector runs in read-only mode — we pull audit logs and event streams, never write back into your cloud or identity tenant. Bronze caps at 12 sources, Silver at 25, Gold is unlimited. Slack, PagerDuty, and ticketing systems are routing channels, not sources — they escalate, they do not generate alerts. See the side-by-side comparison for how this coverage maps against UnderDefense.
Handoff
When does a human actually get paged?
Bronze is email-only, best-effort — no contractual response window. Silver promises a 4-hour acknowledgement with 30 minutes on critical incidents, and escalates in Slack to a named on-call engineer. Gold tightens that to a 1-hour acknowledgement and 15 minutes on critical, with a dedicated analyst and a quarterly purple-team review. Tier math is in plain numbers on the pricing page, alongside the integration caps, the brief cadence, and the per-tier handoff row — same numbers as above, no fine print.
Still on the fence?
Always-on AI SOC for teams too lean to staff one.