Discover risk for free.
Run the read-only Scanner against a repository. Review concrete findings and choose a candidate workload.
Run ScannerPricing + evaluation
Start by proving
one control.
Current CerbiShield Marketplace pricing is based on governed-event volume. Discover risk for free, prove one real workload in Azure, then size a recurring deployment by the logs you actually govern. Start with a control gap, an evaluation window, and agreed evidence.
Choose your governed volume.
CerbiShield in your Azure tenant. Monthly governed-event volume, not per-seat pricing. Azure infrastructure costs are separate from the Cerbi license. Confirm the effective price and terms in Microsoft Marketplace before purchasing.
| Plan | Current price | Governed volume | Best fit | Action |
|---|---|---|---|---|
| Trial | $014 days | Up to 5M governed events / 14 days | Prove deployment and one representative governance workflow in your Azure tenant. | Start trial |
| One | $49/ month$99/month from February 1, 2027 UTC | Up to 100M governed events / month | Smaller production estates that need centralized policy, evidence, and operational visibility. | View Marketplace |
| Pro | $149/ month$299/month from February 1, 2027 UTC | Up to 1B governed events / month | Growing platform and security teams expanding governance across more application logging paths. | View Marketplace |
| Pro++ | $299/ month$999/month from February 1, 2027 UTC | Up to 10B governed events / month | Higher-volume logging governance with optional Pro++ controls and evidence for supported AI-related logs. | View Marketplace |
Current US monthly prices: Trial $0, One $49, Pro $149, Pro++ $299. From February 1, 2027 UTC: One $99, Pro $299, Pro++ $999; Trial stays $0. New purchases use the price effective at purchase. Existing subscriptions retain their price through the current billing term; the price effective at renewal then applies. Confirm your market's price and terms in Microsoft Marketplace. Azure infrastructure costs are separate.
AI Logging Governance
Optional in Pro++ through plan configuration. Off in Trial, One, and Pro. Metadata-first visibility across connected AI paths; raw prompts and responses are not stored by default. Separate from the Cerbi AI assistant.
Explore the current scopeBeyond 10B events?
Review peak volume, policy complexity, destinations, regional requirements, and resilience targets. Custom capacity is not a self-service Marketplace plan. Confirm final terms in Microsoft Marketplace or an approved private offer.
Discuss custom capacityPlan comparison
What each plan includes.
Shared controls are shown across every eligible plan. Enforcement actions depend on the chosen runtime or OTLP path. Free Scanner and CI scanning are separate from these deployed runtime entitlements.
| Capability | Trial | One | Pro | Pro++ |
|---|---|---|---|---|
| Identity & Access | ||||
| Customer-hosted Azure deployment and tenant boundary | Included | Included | Included | Included |
| Policy & Enforcement | ||||
| Governance profiles and policy validation | Included | Included | Included | Included |
| Policy target deployment and rollout | Included | Not in plan | Included | Included |
| Evidence & Operations | ||||
| Recorded governance outcomes and basic reporting | Included | Included | Included | Included |
| Governance analytics access | Included | Not in plan | Included | Included |
| Capacity & Optional Capabilities | ||||
| Governed-event allowance | 5M / 14 days | 100M / month | 1B / month | 10B / month |
| AI Logging Governance | Off | Off | Off | Optional |
Dashboard user sign-in and workload token authorization are separate controls. Their plan-level entitlements, along with workload assignments, exception workflows, advanced audit access, and specific sensitive-field actions, still need reconciliation before they can receive plan checkmarks.
Evaluation
Start with
one workload.
Choose the smallest evaluation that can prove the control you need.
Take the control
through its lifecycle.
- 01
Deploy CerbiShield
Use the Marketplace deployment so the governance control and evidence plane lives inside your Azure tenant.
- 02
Open the control plane
Verify Dashboard access, role context, service health, and the environment Cerbi will govern.
- 03
Choose one workload
Register a governed application, authorize its Entra workload principal, and choose one runtime or OTLP path.
- 04
Define one control
Create or select the governance policy you want to test: redact, drop, block, or otherwise constrain representative telemetry.
- 05
Select the enforcement boundary
Use CerbiStream for a selected application integration or Gateway for an existing OTLP path where that better matches the estate.
- 06
Verify and review evidence
Confirm the governed downstream result, rollout state, violation behavior, health, audit context, and evidence record.
Before procurement
asks.
Do I have to replace my logging or observability stack?
No. Cerbi is designed to govern selected application logs before it continues to existing destinations. Splunk, Datadog, Azure Monitor, Elastic, OpenTelemetry, SIEM, APM, and existing dashboards can remain in place.
Does Cerbi require every workload to use the same enforcement model?
No. CerbiStream and Cerbi Gateway are alternative or complementary enforcement boundaries. A team can use in-process enforcement for selected workloads and a Gateway boundary where existing OTLP log paths make that the better fit.
Is AI Logging Governance the same as the Cerbi AI assistant?
No. The Cerbi AI assistant helps teams operate Cerbi by assisting with rule writing, suggestions, explanations, and onboarding. AI Logging Governance is a separate Pro++ deployment capability for connected AI telemetry metadata, scanner findings, runtime log observations, storage posture, and redacted evidence. It is disabled by default and does not store raw prompts or responses by default.
Does Cerbi govern every AI model, agent, and tool action today?
No. The current Pro++ scope is AI Logging Governance for explicitly connected sources: AI telemetry metadata, scanner findings, runtime log observations, storage posture, policy outcomes, and redacted evidence. This does not authorize agent actions, control model behavior, or provide universal AI estate coverage. See /ai-governance for the current scope.
Does customer raw telemetry have to pass through Cerbi-hosted SaaS infrastructure?
That is not the core product architecture. CerbiShield and Gateway are customer-hosted in Azure, and the customer telemetry path stays within the customer's environment and existing downstream architecture.
What is the easiest way to start without deploying the platform?
Run the free Cerbi Scanner against a repository. It is the low-friction discovery path for deciding whether there is enough real logging risk to justify a bounded CerbiShield evaluation. Scanner remains useful independently.
What is the 14-day trial meant to prove?
The useful goal is not merely that the Dashboard loads. It should prove deployment, policy activation, one selected enforcement path, the downstream result, and the governance evidence around that control.
How is paid usage licensed?
The Marketplace plans shown above are the current monthly governed-event options. Confirm the effective price and terms in Microsoft Marketplace before purchasing. Azure infrastructure costs are separate.