Mimecast Incydr, Aware and Engage licensing covers the three product lines that Mimecast added to its email security business under a “human risk management” positioning. Incydr is the insider risk and data exfiltration product of Code42, whose acquisition Mimecast announced on 2024-07-24.[1] Aware is an AI collaboration security platform, acquired as announced on 2024-08-14.[2] It now underpins the Governance, Compliance and Insight (GCI) Suite.[14] Engage is Mimecast’s security awareness and behavior management product.[16] All three are Services under the Mimecast Service Agreement, and the Service Schedule has product-specific terms for each.[11]
Editions
Incydr
The Mimecast Plans page lists three Incydr plans: Professional, Enterprise and Gov. Each is sold by quote.[3] The knowledge base describes the plan contents:[4]
| Feature | Professional | Enterprise | Gov F2 |
|---|---|---|---|
| Endpoints | Windows, Mac, Linux | Windows, Mac, Linux | Windows, Mac, Linux |
| Cloud storage connectors | One included; more can be added | One included; more can be added | One included; more can be added |
| Salesforce and email connectors | Add-on | Add-on | Add-on |
| Event data retention | 30 days (90, 180, 365 purchasable) | 90 days (180, 365 purchasable) | 90 days (180, 365 purchasable) |
| Automatic cases archival | 90 days | 180 days | 180 days |
| Incydr API | Base access (full access purchasable) | Full access | Full access |
| Instructor, content inspection, all file activity | Add-ons | Add-ons | Add-ons |
Gov F2 is the FedRAMP-authorized version of Incydr Enterprise.[4] Earlier plans, named Incydr Basic, Incydr Advanced and Incydr Gov F1, are still documented for existing customers.[17] The Plans page adds that add-ons can extend historical data retention to up to 3 years.[3] Catalog proof: Incydr event data retention depends on plan and can be upgraded.
Governance, Compliance and Insight Suite (Aware)
The GCI Suite captures, retains, supervises and investigates communications data across email, collaboration and AI platforms. Its functionality depends on whether the Core, Pro or Max tier was bought.[14] Components named in the Service Description include Search & Discover, Signal (collaboration monitoring), Supervision for email, Spotlight analytics and Case Management.[14] The Pro plan adds always-on monitoring of sentiment, trending topics and toxic behaviour.[14] Aware Search & Discover, Signal, Spotlight and Data Management have their own SLA with a 99.9% monthly availability commitment.[15]
Engage
The Security Behavior Management Suite has two tiers, Engage Core and Engage Pro. They are licensed individually or together according to the Order Form.[16] Both include the awareness training library, phishing simulation, the Human Risk Command Center and the Human Risk API. Pro adds the AI Phishing Template Generator, behavioural Nudges and Individual Scorecards.[16]
Metrics
| Product | Catalog metric | How it is measured |
|---|---|---|
| Incydr | Incydr annual user license | Granted annually from the date of purchase. All active users require one.[5] |
| Incydr | Incydr data connector license | The License Plan screen shows the types of data connector licensed and the count of user drives monitored.[6] |
| GCI Suite | GCI fair use allowance on licensed seats | Monthly per-user limits for email, chat, AI prompts and files.[14] |
| Engage | Permitted User | The Service Agreement default. The Service Schedule defines no other quantity for Engage.[11] |
Counting / floors
Incydr user licences
Annual and not co-termed. User licences are granted annually, and the period starts on the date of purchase. Licences added later expire on a different date from the original licences.[5] Catalog proof: Incydr user licences are annual and co-term only if bought together.
Who consumes a licence. All active users require an annual user licence.[5] The rules differ by agent:
- Insider risk agent. Consumption is the number of users with an active device using insider risk management features.[6]
- Backup agent. An active user associated with one or more archives consumes a licence. So does a deactivated user whose archive is in cold storage.[5] If the backup agent is installed per user on a device, each user on that device needs a separate licence.[5]
- No licence consumed. The local administrator account, evaluation users, and deactivated users whose archives have expired or been purged.[5]
Catalog proof: Every active Incydr user consumes an annual user licence.
Cold storage. Deactivating a user does not free the licence immediately. Backup archives go into cold storage and keep consuming user licences until they are purged or expire. A purged user’s licence becomes available within 24 hours, and purged data cannot be recovered.[7]
Evaluation users. New users added before licences are bought consume evaluation user accounts. These can back up and restore without an annual licence for up to 30 days from account creation.[5]
Expiry. When a licence expires, the user’s devices are no longer monitored. Analysts can still administer users and devices but cannot investigate new events. If all licences expire, no devices or data connections are monitored and no new users can be added. Incydr then deactivates the account and retains data according to its retention policy.[5] Catalog proof: Expired Incydr licences stop monitoring; if all expire the account is deactivated.
Incydr connectors
One cloud storage connector (Microsoft OneDrive, Google Drive or Box) is included in each plan, and more can be added.[4] The Plans page says one Exfiltration Detector is included for each Incydr license.[3] Each connection also needs a qualifying plan from the connected vendor:[9]
- Salesforce needs Salesforce Shield or Event Monitoring.
- Box needs a Business plan or higher.
- OneDrive needs a Microsoft licence that includes Audit (Standard).
Catalog proof: Incydr includes one cloud connector; more connectors and third-party licences are extra.
GCI fair use
GCI Services are subject to the fair use limits in the Service Description. Usage that materially exceeds them may lead to additional fees or an upgrade to a higher tier.[11] The limits per user per month are:[14]
| Connected platform | Chat | AI prompts | |
|---|---|---|---|
| Microsoft 365 or Google Workspace | 8,000 | 8,000 | 2,000 |
| Tier 1 collaboration (for example Microsoft Teams, Slack Enterprise, Zoom Team Chat, Claude Enterprise, Microsoft Copilot) | n/a | 5,500 | 2,000 |
| Tier 2 collaboration (Viva Engage, Workvivo, Workjam) | n/a | 1,000 | n/a |
The limits are measured as follows:[14]
- Limits are averaged monthly across the subscription term. Usage is measured at platform level and divided by licensed seats.
- A “User” is a licensed seat, whether active or inactive in the period.
- Data from the first 90 days of onboarding or migration is excluded.
Catalog proof: GCI Services are subject to fair use limits that can trigger fees or upgrades.
Virtualization & partitioning
The Incydr agent runs on Windows 11 and later, macOS 14.0 and later, and Linux distributions including Ubuntu and Red Hat Enterprise Linux. It also supports Virtual Desktop Infrastructure.[10] Licensing follows the user rather than the device. For the insider risk agent, a licence is counted per user with an active device.[6] The Service Schedule requires the customer to deploy endpoint agents to the Permitted Users, and warns that failing to do so may affect access to and efficacy of the Services.[11] Catalog proof: Incydr endpoint agents must be deployed to Permitted Users.
Cloud / BYOL
The three products are SaaS and have no bring-your-own-license option. Several GCI capabilities depend on the customer’s other licences. Aware capture of Microsoft Teams requires per-user Microsoft 365 licensing: E5, or E3 or Business Premium with the Purview add-on. Customers on lower tiers cannot enable Teams capture.[14] Microsoft GCC High, ITAR-regulated customers and the Jersey region are not supported for collaboration ingestion.[14]
Programs
- Incydr evaluation. Incydr has its own evaluation agreement. Services are available for 30 days or another agreed period, including extensions, and are provided as is.[12] The Plans page offers a 30-day Proof of Value.[3]
- Incydr service levels. The SLA commits to 99.9% monthly availability of the Incydr web console. It was published under the Code42 name, effective 2023-10-04.[13]
- Incydr backup add-on end of life. End of sale was 2025-12-31, and end of life is 2026-12-31. Support ends at the end-of-life date or at the end of the subscription, whichever is first. Backup data is permanently deleted after end of life.[8] The add-on cannot be renewed for less than one year, and prorated refunds are not available.[8] Catalog proof: Incydr backup add-on reaches end of life on 2026-12-31.
Contract terms
Engage training material. Training materials, video modules, user surveys and assessments are licensed non-exclusively only for the duration of the customer’s Engage subscription.[11] Customer content uploaded to Engage must not infringe third-party rights and must not purport to come from a governmental agency.[11] Catalog proof: Engage training material is licensed only for the subscription.
GCI responsibilities. The customer configures detection rules, alerts and automated remediation workflows.[11] The customer is also solely responsible for implementing, managing and releasing Legal Holds.[14]
Incydr tiers. The Incydr tier is set out on the Order Form. Capabilities that draw on other Mimecast products require a separate Mimecast subscription.[10]
Audits and compliance
No audit clause applies to Incydr, Aware or Engage beyond the Service Agreement, which has none.[11] For Incydr, compliance is visible in the product. The License Plan screen shows the number of endpoint licences purchased and in use, the data connector licences in use, and licence expiration dates.[6] For the GCI Suite, Mimecast will notify the customer when usage materially exceeds the fair use limits. The two parties then discuss remediation in good faith, which may include an upgrade or additional usage fees.[14]
Out of scope
- Prices for all three product lines, which are sold by quote.
- Incydr’s legacy on-premises Code42 deployments and the CrashPlan consumer and small business products.
- Engage tier-specific limits, which the Service Description says are set out in product documentation.