Forescout Solution Bundles and Cloud Services licensing covers how the April 2026 Product License Guide packages the Forescout 4D Platform. A Solution Bundle is “a Forescout solution offering containing a defined combination of the Forescout Products and Services, which may include Software, Cloud Services, Integrations and/or Support Services”.[1] Bundles are licensed “as either a Term-Based License or as a Subscription”. “All Solution Bundles include Flexible Deployment at no additional cost.”[1] Catalog proof: Solution Bundles; Solution Bundles include Flexible Deployment at no additional cost.
Every SKU in the current guide carries a one-year term (1Y) and, except for the Fly Away Kit and Flat Fee services, a block of 1,000 Endpoints. Bundles made only of Software end in -TBL (Term-Based License). Bundles that include Cloud Services end in -SUB plus a hosting-location code.[1] A Term-Based License is “a license to use Software for the duration of the Term which includes Support Services”. A Subscription is “a right to use the Products or Services, for the duration of the Term”.[1]
Editions
Term-Based License bundles
| Bundle | SKU | Components |
|---|---|---|
| Network Security Basic | FS-NETSEC-BASIC-1000-1Y-TBL | eyeSight Basic, eyeControl Basic, eyeRecover, eyeExtend Connect |
| Security Core | FS-CORE-1000-1Y-TBL | eyeInspect, eyeSight, eyeControl, eyeRecover, eyeExtend Connect, eyeExtend Ecosystem Limited |
| Security Automation & Control | FS-AUTO-CTRL-1000-1Y-TBL | as Security Core, with full eyeExtend Ecosystem |
| OT Security Core | FS-OTSEC-CORE-1000-1Y-TBL | eyeInspect |
| Fly Away Kit Assessment | FS-FAK-ASSESSMENT-1-1Y-TBL (OT: FS-FAK-ASSESSMENT-OT-1-1Y-TBL) | eyeInspect, eyeSight, eyeControl, eyeRecover, eyeExtend Connect, eyeExtend Ecosystem (OT kit: eyeInspect) |
Source for the table: Product License Guide sections 3.1, 3.3, 3.5, 3.8 and 3.11.[1]
The Basic components are reduced editions. eyeSight Basic provides “basic discovery, classification and assessment of assets”. eyeControl Basic enforces only RADIUS-based network access, while full eyeControl covers both RADIUS and non-RADIUS enforcement.[1] eyeExtend Ecosystem gives access to all Forescout-built Integration Modules. eyeExtend Ecosystem Limited gives access to “one (1) Integration Module”.[1] The integration entitlement is therefore a real difference between Security Core and Security Automation & Control.
Subscription bundles with Cloud Services
| Bundle | SKU (United States) | Adds to the on-premises set |
|---|---|---|
| Security Cyber Exposure | FS-CYBER-EXPOSURE-1000-1Y-SUB-USA | Cloud only: eyeExtend Cloud, eyeSentry, eyeScope, eyeFocus |
| Security Core Plus | FS-CORE-PLUS-1000-1Y-SUB-USA | Security Core plus eyeExtend Cloud, eyeSentry, eyeScope |
| Security Automation & Control Plus | FS-AUTO-CTRL-PLUS-1000-1Y-SUB-USA | Security Automation & Control plus eyeExtend Cloud, eyeSentry, eyeScope |
| Security Cyber Assurance | FS-CYBER-ASSURANCE-1000-1Y-SUB-USA | Full module set plus eyeSegment and eyeFocus |
| Zero Trust Assurance | FS-ZERO-TRUST-ASSURANCE-1000-1Y-SUB-USA | Core set with eyeExtend Ecosystem Limited, plus Cloud Services and eyeSegment |
| Cyber Risk & Compliance | FS-CYBER-RISK-COMPL-1000-1Y-SUB-USA | Core set with eyeExtend Ecosystem Limited, plus Cloud Services and eyeFocus |
Source for the table: Product License Guide sections 3.2, 3.4, 3.6, 3.7, 3.9 and 3.10.[1]
Each Subscription bundle exists in eight regional variants, one per “Cloud Hosting Location”: USA, FED (United States, FedRAMP), CAN, GER, UK, UAE, AU and IND. The India variant of Automation & Control Plus is printed as FS-AUTO-CTRL-PLUS-1000-1-SUB-IND.[1] The Cloud Services Description lists data hosting in the United States, Canada, the United Kingdom, Germany, the United Arab Emirates and Australia for eyeScope, eyeFocus, eyeSegment and eyeAlert.[2]
Cloud Services and stand-alone products
The guide describes six Cloud Services. eyeExtend Cloud provides integrations between Forescout Cloud and third-party products. eyeSentry is a cloud-managed sensor. eyeScope is the unified console. eyeFocus is exposure assessment. eyeSegment is network segmentation planning. eyeAlert is threat detection on ingested logs.[1] Only eyeAlert and Secure Remote Access (FS-SRA-1000-1Y-TBL) are listed as products that can be bought alone or added to any bundle.[1] The June 2024 guide sold the predecessors separately under other names: Forescout REM (Risk and Exposure Management), Forescout XDR, which that guide says “has been rebranded to Forescout TDR”, and Forescout Assist for XDR.[4]
Metrics
Bundles, Cloud Services, Secure Remote Access, Assist Services and Reporting Services are all metered by Endpoint. The Fly Away Kit is metered by Unit, and Sentinel Services by Flat Fee.[1] eyeAlert has a second, consumption-style limit, the Aggregate EPS Cap: “a maximum allowed aggregate average of 0.6 Events per Second (‘EPS’) per Endpoint per calendar month”.[1] An event here is an Enriched Log, defined as “a log that is indexed in Forescout Cloud after an observable occurrence in a Data Source”.[1]
Counting / floors
Endpoint blocks (April 2026). Endpoint SKUs are sold per 1,000. An Endpoint counts once the platform knows it by MAC address, IP address or another unique identifier, including through third-party integrations.[1] For Cloud Services, Overage may be invoiced by the Forescout Partner, and “Forescout may institute controls to limit Customer’s use of the Cloud Service to the licensed Endpoint Count”.[2] Catalog proof: An Endpoint counts once it is known to the platform; Cloud Service overage may be invoiced and throttled.
No subscoping for bundles. Subscoping is “not available for Solution Bundles, Support Services, Product-Related Services, or Forescout eyeAlert”. A bundle must therefore cover the whole Customer Environment.[1] Catalog proof: Subscoping is limited and caps use at the ordered Endpoint Count.
eyeAlert EPS cap and search terms. If a customer’s “monthly aggregate average EPS per Endpoint exceeds the Aggregate EPS Cap for 3 consecutive months”, Forescout may invoice the Overage under the EULA.[1] EPS upgrade SKUs raise the cap. The guide does not state the size of the uplift. Search terms are fixed per SKU:
| SKU (United States) | Immediate Search Term | Archive Search Term |
|---|---|---|
| FS-ALERT-1000-1Y-SUB-USA | 7 days | 365 days |
| FS-ALERT-PRO-1000-1Y-SUB-USA | 31 days | 365 days |
| FS-ALERT-STORAGE-UPG-1000-1Y-SUB-USA | 0 days | 365 days |
| FS-ALERT-EPS-UPG-1000-1Y-SUB-USA | 7 days | 365 days |
| FS-ALERT-PRO-EPS-UPG-1000-1Y-SUB-USA | 31 days | 365 days |
Source for the table: Product License Guide section 4.6.[1] Logs restored from the archive are searchable for up to 7 days. Customers may buy Enriched Log retention beyond 365 days.[2] Catalog proof: eyeAlert includes 0.6 EPS per Endpoint; sustained excess may be invoiced; eyeAlert search terms are set per SKU.
Fly Away Kit. The kit “is sold per 1 Unit and cannot be transferred or activated on multiple Units simultaneously”. It may monitor a Customer Environment for up to three weeks per Monitoring Period. Its data must be reset before the next period starts, and several periods are allowed during the Term.[1] Catalog proof: Fly Away Kit is one Unit used for three-week Monitoring Periods.
Virtualization & partitioning
Software can run on a Forescout-branded Appliance or under Flexible Deployment, as “a virtual instance, docker container-based sensors, or on approved third-party hardware”. Flexible Deployment costs extra outside bundles and is included in every bundle.[1] The bundle price therefore already covers virtual sensors and virtual Enterprise Managers. Each virtual or cloud instance must still have dedicated CPU, memory and storage, or Forescout is not obliged to support it.[5] Catalog proof: Flexible Deployment carries additional fees; Virtual instances need dedicated resources and a flexible deployment right to be supported.
Cloud / BYOL
Forescout Cloud is “the portion of the Forescout 4D Platform™ which provides the foundation for the delivery of the Forescout Cloud Services”.[1] The Cloud Services Description sets 90-day retention for endpoint data in eyeScope and eyeFocus and for flow data in eyeSegment. Audit logs are kept for 365 days. Customers may copy their data out on seven days’ written notice before the Cloud Service ends.[2] The service level agreements for Cloud Services are “set forth in the Documentation”, and SLA credits are paid through the Forescout Partner.[3]
eyeExtend Cloud entitlements differ by bundle. Integration use cases for “asset discovery and enrichment” come with Cyber Exposure, Cyber Threat & Exposure, Core Plus, Automation & Control Plus, Cyber Assurance, Zero Trust Assurance and Cyber Risk & Compliance. Use cases for risk assessment and “automated action orchestration” come only with Cyber Exposure, Cyber Threat & Exposure, Automation & Control Plus, Cyber Assurance and Cyber Risk & Compliance. eyeAlert enables integrations for threat detection and response.[1] Cyber Threat & Exposure is named in this section but has no SKU table of its own in the guide.
Programs
- Entitlement Credit. When a customer replaces its Current Entitlement with a Solution Bundle that has more capabilities, Forescout credits “any unused portion of the prepaid fee for Customer’s Current Entitlement”. The credit runs from the Delivery Date of the Replacement Entitlement to the end of the current term and is applied to the new purchase.[1] Catalog proof: Upgrading to a richer Solution Bundle earns an Entitlement Credit.
- Product-Related Services. Assist Services (FS-ASSIST-SVCS-1000-1Y-SUB) provide 24/7 monitoring and threat hunting. “An Entitlement for the Forescout eyeAlert Cloud Service is required”. Reporting Services cover the CMRS Reporting Integration Application per Endpoint. Sentinel Services and Sentinel Services Advanced are Flat Fee subscriptions for the Microsoft Sentinel Integration Module.[1] Catalog proof: Assist Services require an eyeAlert Entitlement.
- Integration Applications. Applications that customers build with Forescout’s SDK and APIs “are community built and supported and are not supported by Forescout”, unlike Forescout-built Integration Modules.[1]
Out of scope
This article does not cover support tiers and hardware support SKUs (Forescout EULA, support and end of life), licence files, Deployment IDs and the per-100-endpoint module SKUs of earlier guides (Forescout Flexx, Per-Appliance and legacy licensing), or prices, which are not published.[3]