Forescout licensing is the set of terms under which Forescout Technologies, Inc. licenses the Forescout 4D Platform, its collection of products for discovering, classifying, controlling and monitoring devices across IT, IoT, operational technology (OT) and medical networks. The platform includes on-premises Software such as eyeSight, eyeControl, eyeInspect, eyeRecover and the eyeExtend integrations, and Cloud Services such as eyeScope, eyeFocus, eyeSegment, eyeSentry, eyeExtend Cloud and eyeAlert.[1]
Two documents carry the licence. The End User License Agreement (EULA), dated 2023-03-21, grants the usage rights and covers fees, verification, warranties and termination.[2] The Product License Guide states “the license or right to use acquired by Customer” for each Product, with its SKU, licence type and meter. The current guide is headed April 2026.[1] Forescout’s legal page also publishes the Support Services Policy, the End-of-Life Policy, the Cloud Services Description and agreements for evaluation and not-for-resale use.[3]
The EULA grants “a non-exclusive, non-transferable” licence to use the Software and right to use the Cloud Services, “as acquired from a Forescout Partner, for your direct benefit and internal use during the Term”.[2] Fees and payment terms sit between the customer and the Forescout Partner, so the EULA assumes a partner sale. Catalog proof: EULA grant is non-transferable and for internal use during the Term.
Editions
Forescout publishes no price list. The Product License Guide groups what is sold into Solution Bundles, Cloud Services, Software, Product-Related Services and Support Services.[1]
| Offering | Licence type and meter (April 2026 guide) | Deeper article |
|---|---|---|
| Network Security Basic, Security Core, Security Automation & Control, OT Security Core | Term-Based License, per 1,000 Endpoints | Solution Bundles and Cloud Services |
| Security Cyber Exposure, Core Plus, Automation & Control Plus, Cyber Assurance, Zero Trust Assurance, Cyber Risk & Compliance | Subscription per 1,000 Endpoints, by cloud hosting location | same |
| Fly Away Kit Assessment (IT and OT) | Term-Based License per Unit | same |
| eyeAlert, eyeAlert Pro and upgrades | Subscription per 1,000 Endpoints with an EPS cap | same |
| Secure Remote Access | Term-Based License per 1,000 Endpoints | same |
| Assist, Reporting and Sentinel Services | Subscription per 1,000 Endpoints or Flat Fee | same |
| Hardware Support, Gold, Platinum, Diamond, Adoption, Resident Engineer | Subscription per Unit, Flat Fee or per 1,000 Endpoints | EULA, support and end of life |
| Legacy eyeSight, eyeControl, eyeRecover, eyeExtend, eyeInspect, eyeSegment | Perpetual, term-based or subscription per 100 endpoints, or per sensor | Flexx, Per-Appliance and legacy licensing |
The individual modules (eyeSight, eyeControl, eyeExtend Ecosystem and so on) appear in the current guide as components of bundles, not as separate SKUs. Secure Remote Access and eyeAlert can be bought alone or added to a bundle.[1] The previous guide, dated 2024-06-18, still sold most modules separately per 100 endpoints, some of them as perpetual licences.[6]
Metrics
The main metric is the Endpoint. The guide defines it as “any physical or virtual addressable device”, including computers, servers, phones, switches, routers, PLCs, containers and virtual machine images that connect to the Customer Environment.[1] The Endpoint Count is “the maximum number of unique Endpoints to be monitored by the Product, as specified in the Entitlement”.[1] The Entitlement, in turn, is defined in the EULA as “the specific metrics, duration, and quantity of Products you commit to acquire from a Forescout Partner”.[2]
Other meters are narrower:
| Metric | Catalog row | Used for |
|---|---|---|
| Unit, “a single quantity regarded as a whole” | Unit | Fly Away Kit, Hardware Support Services |
| Flat Fee, “a single fixed fee per Customer Environment” | Flat Fee | Sentinel Services, Gold/Platinum/Diamond, Adoption, Resident Engineer |
| 0.6 Events per Second per Endpoint per month | Aggregate EPS Cap | eyeAlert |
| Device Count, by MAC or IP address | Device Count | Legacy module licences |
| Sensor sized by assets | eyeInspect Sensor | Legacy eyeInspect Option 2 |
Sources for the table: the 2026 guide for the first three rows and the 2024 guide for the last two.[1][6]
Counting / floors
Licensed per 1,000 Endpoints (guide of April 2026). “The Forescout Products, including the Solution Bundles, are licensed per 1,000 Endpoints” as a Term-Based License or a Subscription.[1] Catalog proof: Forescout Products are licensed per 1,000 Endpoints.
When an Endpoint counts. An Endpoint counts against the Endpoint Count once the platform knows it “by either its MAC address, IP address or other unique identifier”. This applies whether the device is on site or off site, whether Forescout detects it through third-party integrations, and whether it falls in the scope of a policy that uses properties or actions from those integrations.[1] The count is therefore driven by discovery, not by installed agents. Integrations that import devices from other systems, such as directory, endpoint or cloud inventories, can raise it. Catalog proof: An Endpoint counts once it is known to the platform; Virtual machines, containers and network gear are Endpoints.
Subscoping. A customer can sometimes buy Endpoints for only part of its environment. This is called subscoping. It is not available for Solution Bundles, Support Services, Product-Related Services or eyeAlert. Where Forescout allows it, the Software may be used only “up to the Endpoint Count as specified in the accepted Order”.[1] Catalog proof: Subscoping is limited and caps use at the ordered Endpoint Count.
Overage. Under the EULA, use beyond the Entitlement is Overage, which “the Forescout Partner may invoice”.[2] For Cloud Services, Forescout may also “institute controls” that limit use to the licensed Endpoint Count.[5] In Flexx deployments the Console and email alerts warn once a day of oversubscription. If the base eyeSight licence becomes invalid, every other licensed product becomes invalid with it.[9] Catalog proof: Overage is invoiced through the Forescout Partner; Cloud Service overage may be invoiced and throttled.
Virtualization & partitioning
Forescout does not count processors, cores or hosts. Its licensing turns instead on where the Software runs. The guide offers two deployment methods: “physical deployment on a Forescout branded Appliance” or Flexible Deployment “as a virtual instance, docker container-based sensors, or on approved third-party hardware”. Customers who choose Flexible Deployment pay additional fees, but every Solution Bundle includes it “at no additional cost”.[1] The Support Services Policy will not support virtual or cloud instances that lack dedicated CPU, memory and storage, or where the flexible deployment right was not bought.[4] Virtual machines and containers that the platform monitors are themselves Endpoints.[1] Catalog proof: Flexible Deployment carries additional fees; Solution Bundles include Flexible Deployment at no additional cost; Virtual instances need dedicated resources and a flexible deployment right to be supported.
Two licence-management modes exist for the on-premises platform. Under Flexx Licensing, endpoint capacity “is calculated per-deployment” and can be distributed across Appliances.[8] Under the older Per-Appliance Licensing, each appliance has a fixed device count that “cannot be reallocated or shared across appliances”.[6] Forescout’s Flexx page describes it as a pool that can be shared “across campus, data center, cloud and OT”.[7] The details are in Forescout Flexx, Per-Appliance and legacy licensing.
Cloud / BYOL
Cloud Services are hosted by Forescout and licensed “on a subscription basis by Endpoint”.[5] Each Cloud SKU names a hosting location: United States, United States FedRAMP, Canada, Germany, United Kingdom, United Arab Emirates, Australia or India. The SKU therefore fixes where customer data is held.[1] No bring-your-own-licence programme for public clouds is published. Customers who run the on-premises Software in their own cloud tenancy do so under Flexible Deployment. The 2024 guide states that virtual appliances “can be deployed on premises or in AWS or Azure”.[6]
Programs
- Solution Bundles. These are fixed combinations of Software, Cloud Services, integrations and Premium Support. A customer that moves up to a richer bundle receives an “Entitlement Credit” for the unused prepaid fee of its current entitlement.[1]
- Term-Based License and Subscription. Both run for the Term. Subscription Usage Rights “will not automatically renew” and need a separate renewal Order.[2]
- Premium Support Services and Enhanced Support Services. “All Customers must purchase Premium Support Services for all acquired Forescout Products and Appliances”. Enhanced Support (Gold, Platinum, Diamond, Adoption and Resident Engineer) is sold on top of it.[4]
- Evaluation Products. Trials end on the earliest of three dates. Products and appliances that are not returned may be invoiced at list price.[2]
- End of life. Software feature releases receive 24 months of Full Support and 12 months of Limited Support. After an EOL notice, no term licence or subscription is sold that runs beyond the Last Day of Support.[10]
Verification. Customers must “maintain accurate records of your use of the Products”. On reasonable notice, “no more than once per 12-month period”, Forescout and its auditors may verify compliance. Any underpaid fees for excess usage must be paid.[2] Catalog proof: Verification at most once per 12 months.
Out of scope
This article does not cover Forescout hardware specifications, appliance sizing for performance, vulnerability research from Forescout Vedere Labs, or partner and MSP programme economics. Forescout’s legal page lists an MSP Support Services Policy, but not the Managed Services Provider Program Agreement that policy depends on.[3] Prices are not published and are set between the customer and the Forescout Partner.[2]