Arctic Wolf licensing is the set of terms under which Arctic Wolf Networks, Inc. sells its security operations services and software. The portfolio covers managed detection and response (MDR), vulnerability management, security awareness training, endpoint protection, mobile threat defense, attack surface management, threat intelligence and incident response retainers. One master contract, the General Terms and Conditions, governs every Product ordered on an Order Form. The General Terms were formerly called the Solutions Agreement.[2] Each product line adds its own Supplemental Product Terms, and the current set applies to subscriptions and purchases made after 2025-08-15.[1] Arctic Wolf grants a personal, revocable, non-exclusive, non-transferable licence to install, access and use the Products on the Order Form.[2] Products other than Professional Services are licensed on a subscription basis and are not sold.[2] For the general models, see subscription and consumption licensing and concurrent and device licensing.
Editions
Arctic Wolf does not publish a price list for its managed services. Its Product List groups the Products into three categories for partners.[5]
| Category | Products named in the Product List | Main licensing unit |
|---|---|---|
| Security Operations Products | Aurora Managed Detection and Response, Aurora Vulnerability Management, Aurora Security Awareness and Training, Aurora MDR Connect (MSP only)[5] | Order Form metric; Users for awareness training[2][8] |
| Product Only Products | Threat Intelligence, Aurora Incident360 Retainer, Aurora Attack Surface Management[5] | Order Form tier; endpoint count for retainers[11] |
| Aurora Endpoint Security Products | Aurora Endpoint Defense, Aurora Managed Endpoint Defense, Aurora Protect, Aurora Mobile Threat Defense[5] | Endpoints and licences on the Order Form[6] |
MDR, AVM and ASAT can be licensed on their own or as part of a Security Operations Bundle.[3] There are three Bundles. Core contains MDR with Data Explorer Lite. Plus adds AVM. Total adds an ASAT tier and the JumpStart Retainer.[4] Each Bundle is sold with a Concierge Security Tier (Silver, Gold or Platinum).[4] The legal page lists Aurora Endpoint Security as “formerly Cylance” and Aurora Attack Surface Management as formerly Sevco Exposure Management.[1]
Product-level detail is in Arctic Wolf MDR, bundles and Security Operations Warranty, Arctic Wolf Aurora Endpoint Security licensing and Arctic Wolf security awareness and training licensing.
Metrics
The General Terms do not fix a single metric. They limit use to “license counts, including by server, user, endpoint, or such other licensing metric designated in the applicable Order Form”.[2] The Order Form is therefore the document that states the unit and the quantity. Catalog: Order Form licensing metric; rule Use is limited to the licence counts and metric on the Order Form.
| Arctic Wolf term | Catalog row | Where it is defined |
|---|---|---|
| Endpoint | Endpoint | Wireless devices, desktops, computer systems and any other endpoints with which the Solution operates.[7] |
| User | User (Security Awareness) | Employees, agents, subcontractors and consultants permitted to access or view the training, up to the number bought.[8] |
| Device (MSP) | Device | Any connected device that uses the Aurora endpoint Solutions, including non-persistent deployments and virtual machines.[15] |
| Sensor and Scanner | Sensor, Scanner | Physical or virtual Equipment included in MDR and AVM subscriptions.[3][13] |
| Data ingestion | Data ingestion | MDR and AVM include “Unlimited data ingestion”.[3][13] |
| IR Services hour | IR Services hour | Hourly incident response under an Incident360 Retainer, at USD 325 per hour with a 25-hour minimum.[16] |
In the Unified Portal, Arctic Wolf separates a subscription from a licence. A subscription is a purchased service. A licence is “the capacity or quantity of assets covered by that service”.[10] The Subscriptions page lists licence details such as protected users, sensors, scanners or log collectors, and shows usage against the entitlement.[10] Catalog: Licence usage is shown in the Unified Portal; increases are requested by ticket.
Counting / floors
Data volume is not metered. The MDR and AVM Platform components include unlimited data ingestion. MDR also includes one vSensor 100 series and 90 days of log retention unless a different retention period is bought.[3] A licence manager therefore counts the Order Form units (for example endpoints, users or sensors) rather than gigabytes. Catalog: MDR includes unlimited data ingestion, one vSensor 100 and 90-day log retention.
Overuse and audit. During the Agreement and for one year after it, Arctic Wolf may request records to verify licence counts. It may also ask an executive officer to certify compliance in writing. Licences found in excess are invoiced with fees prorated to the end of the current term.[2] Catalog: Audit during the term and one year after; excess licences invoiced pro rata. The Unified Portal invites customers to raise a ticket when actual assets and reported usage differ.[10]
Floors. The General Terms set no minimum quantity. Minimums appear only in specific offers. The online security awareness prices cover 30 to 100 users.[9] Incident360 Retainers are sized by the endpoint count on the Order Form. A Covered Incident cannot be used if the actual endpoint count is materially higher than ordered.[11] Catalog: Covered Incident is lost if actual endpoints materially exceed the Order Form.
Virtualization & partitioning
Arctic Wolf has no processor or partitioning rules. Virtual machines matter in two ways. Sensors and scanners can be virtual appliances (vSensor, vScanner) and count as Equipment.[3][13] For Aurora endpoint products, the MSP terms count virtual machines and non-persistent deployments as Devices.[15] Arctic Wolf’s VDI guidance explains how to avoid duplicate device registrations when non-persistent VMs are built from a gold image.[17] See Arctic Wolf Aurora Endpoint Security licensing and virtualization and partitioning.
Cloud / BYOL
The managed services run on Arctic Wolf’s platform, which is hosted by third-party providers. Customer data is stored in the data-centre location named on the Order Form for MDR and AVM.[3] Arctic Wolf publishes no bring-your-own-licence rules. Cloud Detection and Response for AWS, Azure and other supported IaaS and SaaS environments is a separately licensed MDR feature. It is listed on the Order Form when bought.[14] See Arctic Wolf MDR, bundles and Security Operations Warranty.
Programs
- Security Operations Bundles (Core, Plus, Total) and the Concierge Security Tier package MDR with other products and a service level.[4]
- Security Operations Warranty. The Bundle and the term length set the warranty amount. The customer has to enroll separately.[4][2]
- Incident360 Retainer. JumpStart, Incident360 and Incident360 Plus retainers for incident response.[11]
- MSP and MSP Plus partner delivery. Authorized partners deliver Products to End Users under Product Delivery Requirements.[12] See Arctic Wolf General Terms and partner terms.
- Trial Access lasts 30 days for AVM and several other products. Beta Products are for evaluation only.[13][2]
- Online Managed Security Awareness subscription. Security awareness training can be bought on arcticwolf.com under separate Website Terms.[8]
Contract terms
The General Terms renew any Subscription Term automatically for the same length as the initial term, capped at 12 months, at the then-current terms and price. Either party must give at least 60 days’ notice before expiry to opt out of renewal or to reduce scope.[2] Fees are non-cancelable and non-refundable.[2] The licence is non-transferable. Assignment, including by change of control, needs Arctic Wolf’s prior written consent.[2] Arctic Wolf may update its terms. A customer that rejects a change within 30 days keeps the earlier terms until the end of its current term.[2] Catalog: Automatic renewal for the same period, at most 12 months, with 60 days' notice to opt out or reduce; Terms may change; customer can reject within 30 days until the term ends. Details are in Arctic Wolf General Terms and partner terms.
Out of scope
This article does not cover hardware specifications of sensors and scanners, service levels and response times, data protection terms (the Data Processing Addendum and Business Associate Addendum), Arctic Wolf’s OEM licensing of its engines, or the vxIntel and Arctic Circle community terms. Prices for MDR, AVM, endpoint products and retainers are not public and are set on each Order Form.