Pricing & licensing
Per module, per unit, bought direct or through the partner that runs your estate. Rates are a conversation; everything else about how it is priced is here.
What a unit is
Reading modules first; a management, protection or analytics module presumes the reading module of its product on the same key, and the portal refuses a key without it.
| Module | Covers | Unit | Presumes |
|---|---|---|---|
| NetScaler | |||
| NetScaler monitoring | polling, health, Analyze, certificates, reports | per HA pair | — |
| NetScaler configuration | changes from Vantage by hand: the object editor, bindings, policies, gateway blocking enforcement, AppFlow setup (the certificate and command workflows are Automation's) | per HA pair | NetScaler monitoring |
| NetScaler identity threat | gateway sign-in protection, and the blocking rules it writes onto the appliances (writing them needs NetScaler configuration) | per HA pair | NetScaler monitoring |
| NetScaler analytics | HDX Insight data, Session performance and Launch analysis | per HA pair | NetScaler monitoring (Windows Infrastructure for the VDA side) |
| Config Compare · Config Import · NetScaler Documentation · AI Enhancement | drift comparison, ns.conf import, documentation export, AI explanations | per installation | — |
| XenServer | |||
| XenServer health | health reports, trends, notifications | per pool | — |
| XenServer console | XenCenter's operations in the browser: VMs, storage, networks, updates | per pool | XenServer health |
| Windows and Hyper-V | |||
| Windows Infrastructure | the agent, inventory, notifications, certificates, endpoint security posture | per server | — |
| Hyper-V console | Hyper-V Manager's pages and actions | per Hyper-V host | Windows Infrastructure |
| Windows Update | scan and install updates across the estate | per server | Windows Infrastructure |
| Windows identity threat | server sign-in protection, with blocking on each server’s own firewall | per server | Windows Infrastructure |
| The whole installation | |||
| Uptime | monitors and the company's status page | per installation | — |
| Syslog | the receiver and the messages view | per installation | — |
| Estate map | the correlated model of the three layers, blast radius, and the MAC vendor lookup held on your own server | per installation | — (it reads whatever else is licensed and names the layers it could not) |
| Automation | every workflow, on demand or scheduled, with its run history and reports: certificate deployment (SSL renewal), ACME renew and deploy, certificate cleanup, SSH command jobs, appliance analysis and scheduled reports. NetScaler configuration is not needed for any of them | per installation | — (each workflow needs the product it works on) |
| Device lockdown | Windows machines enrolled with a site key and kept on a signed lockdown policy: local administrators, installers, USB programs, Defender hardening, application control, and the requests users make to install something | per installation | — (machines reach it through the remote console, which needs a cloud management key) |
Your own estate
- One key, the modules you use, with the capacity written on it: NetScaler pairs, XenServer pools and hosts, Windows servers, Hyper-V hosts. A direct key may leave a capacity open.
- A term with an expiry date on the key; the dashboard says when it is close.
- A free 14-day trial of every module to start with (how it works); a purchased key then turns the same installation on, no reinstall.
Getting a quote. A signed-in customer or partner asks for one on the licensing portal under Quotes: the modules and units, the term, and an estimate at list less the partner tier's discount; DTR answers there and by mail. Not signed up yet: the contact form.
The partner programme
| Tier | Off list | What comes with it |
|---|---|---|
| Registered | 20% | A pool of units per module, bought at the tier's price and issued to your own clients as keys from the licensing portal, each installation on its own record and its key bound to it. An NFR key for your lab: 2 pairs, 1 pool, 10 servers, 2 Hyper-V hosts, one year, drawing on no pool. |
| Silver | 30% | |
| Gold | 40% |
- The pool counts live keys. A revoked key returns its units; a key waiting for an installation still holds them.
- Issued in minutes, from the portal. A client activates from the dashboard with a short code, or you issue against their Installation ID.
- Release channels. A build reaches the dev channel first; accounts you mark early-access see it before everyone.
- Quotes from the portal. Ask under Quotes for your own units or a client's; the estimate carries your tier's discount, DTR confirms the figure.
Updates across a partner's clients
Each installation updates itself: an administrator presses Check for updates on its Settings page, the package downloads with its SHA-256 checked, and Install now applies it through a system task that stops the service, backs up, deploys, restarts and rolls back on failure. Without internet, the same update zip is applied by hand. Nothing checks on a timer: the dashboard contacts the portal only when someone presses the button.
What that means for a partner with thirty clients: the portal stages the build (dev channel first, early access per account, release to everyone when you are satisfied), and Release to everyone pushes it to every installation that reports to the fleet console, at a time you pick or at once; each installation downloads it with the SHA-256 checked and applies it through the same system task, and the installation's page shows when it was pushed and when it applied, in the client's own time zone. An installation that has not opted in updates from its own Settings page as before. The opt-in is the client's: a key the portal issues per installation, with the report and remote scopes chosen by you, pasted into the client's dashboard once.
Not in the product today
- PSA integration (ConnectWise, Autotask, HaloPSA and the like): none. What leaves Vantage today is the PDF reports, a CSV of certificates, and the company's Uptime page. On the roadmap with alerting.
- Multi-tenant views on one instance: one install per client today, managed together from the fleet console; per-site roles on one instance are on the roadmap.
- Alerting to e-mail, Teams or a webhook: not today; the scheduled reports mailed from the fleet console are what goes out.
- The Delivery Controller and DaaS integration, and collectors per location for an estate spread over several sites: both coming.