ThreatDown OneView is the multi-tenant console in which managed service providers (MSPs) run ThreatDown protection for their customers. Each customer is a “site” with its own subscriptions, billing method and endpoints.[4] ThreatDown’s MSP programme advertises monthly usage billing and internal-use software for partners.[10] Most OneView customers use usage-based billing. It does not apply to bundle subscriptions.[8] The standard Software License Agreement does not allow a customer licence to be used to serve third parties, so service providers work under these partner arrangements.[11] For the vendor overview, see Malwarebytes licensing.
Editions
A OneView site has one of three billing set-ups:
| Set-up | How it works |
|---|---|
| Usage billing | Billed on product allocation and deployed endpoints[4] |
| Upfront | Contracted beforehand, charged for a pre-determined number of seats allocated to specific products[4] |
| Bundle | A ThreatDown bundle chosen per site, Paid or 14-day trial, with allocations per device type[5] |
Non-bundle sites choose device types. Workstations cover Windows and macOS. Servers cover Windows and Linux and require workstations to be selected too. Mobile covers Android, ChromeOS and iOS.[4] The OneView Product Catalog shows features and pricing and lets admins add products to sites. It is not shown for bundle subscriptions or for partners who buy through a distributor.[9] Catalog: OneView bundle sites are paid or 14-day trial and not usage-billed.
Metrics
The usage-billing unit is the Billable endpoint. Add-ons have their own counts: OneView reports billable mailboxes per site for the Email Security add-on.[2] Upfront sites count Devices as seats. The Invoices page shows seats used against the subscription for partners billed up-front.[7]
Counting / floors
Maximum protection level. Partners no longer subscribe to a specific product type. They subscribe to a maximum protection level, and each endpoint’s policy decides what it is billed for, up to that maximum.[1] ThreatDown’s examples:[1]
| Site subscription | Endpoint policies | Billed as |
|---|---|---|
| Endpoint Protection | All endpoints in an Incident Response policy | All Incident Response |
| Endpoint Protection | 5 in Incident Response, 15 in Endpoint Protection | 5 Incident Response, 15 Endpoint Protection |
| Endpoint Protection | All endpoints in an EDR policy | All Endpoint Protection; not billed or protected above the subscription level |
The monthly usage report’s “Billable license” is the highest protection level used during the billing period, so it can rise within a month.[2] Catalog: OneView bills each endpoint at its policy level up to the site maximum.
Unique endpoints in the month. Billing is based on all unique endpoints active at any point during the monthly cycle. In ThreatDown’s example, a site with 10 endpoints that deletes 2 and deploys 2 new ones in the same month is billed for 12 that month, and for 10 the next month if nothing changes.[1] Endpoints are billed as soon as they are deployed to a site with a paid subscription. Endpoints on deleted sites, or on sites with no active subscription, are not counted.[1] Re-imaging churn therefore costs money: a reinstalled machine that appears as a new endpoint is counted twice in that month. Catalog: OneView bills unique endpoints active during the month.
Allocations do not cap anything. For usage billing, licence allocations are informational only and do not affect billing or protection. Exceeding an allocation triggers a notification, not an extra bill.[1] Sites are billed for all endpoints deployed.[4] OneView can send a “Site over deployed” notification.[13] On upfront accounts, allocations are limited to the purchased licence amount.[3] Catalog: OneView licence allocations are informational only.
Servers. A site cannot subscribe for servers only. Protecting servers needs a Workstation & Server subscription, but no workstation charge arises if no workstation agents are deployed.[1] Catalog: Servers need a Workstation & Server subscription.
Add-ons. Enabling an add-on such as Email Security or DNS Filtering on a site requires the partner to accept that all endpoints with deployed add-ons will incur additional monthly charges. The number of allocated add-on endpoints is used only for notifications.[3]
Cut-off and reporting. The billing usage cut-off is the last day of the month at 0:00 UTC.[2] The Monthly Usage tab covers the past 12 months. It shows per-endpoint billable licence, billing type, previous licence and status (Added, Upgraded, Downgraded, No Change), with an audit log and CSV or XLSX export.[2] Catalog: OneView billing cut-off is the last day of the month at 0:00 UTC.
Floors. The cited OneView articles publish no minimum monthly commitment.
Trials, cancellation and NFR
Trials. One help article offers 15- or 30-day trials when managing a subscription. The site set-up article lists 14- and 28-day trials and says the maximum trial length is 28 days.[3][4] A trial can convert to paid automatically at 11:59:59 PM GMT on its end date if that option is set.[3] Trial subscriptions need an allocation between 1 and 100, and Incident Response is not available for servers or trials.[4][3] An expired trial that did not auto-convert can be extended once. After that it can only be converted to paid or removed.[3] Partners should set auto-conversion deliberately, because an unattended trial becomes billable at the end date.
Cancellation. Cancelling a site’s subscription removes real-time protection but leaves the agent installed. Endpoints without an active subscription are not counted towards usage billing.[3] The optional site contract end date has no effect on protection or billing.[4] Catalog: Endpoints without an active subscription are not billed.
Not for Resale. An NFR subscription is for a partner’s own testing. It applies to a single site with up to 20 endpoint seats per product.[6] Only one NFR site can exist at a time. It is available only to partners signed up directly with ThreatDown, not to distributor-managed accounts. It cannot be converted to a trial or paid subscription.[6] Catalog: One NFR site with 20 seats per product, direct partners only.
Managed services through MSPs
MSPs can add Managed Detection and Response or Managed Threat Hunting to a site.[4] An MSP that accepts the Managed Services Agreement binds its end customers to it. It is responsible for implementing recommendations and for its customers meeting the prerequisites.[12] The agreement requires EDR on all endpoints and charges for added endpoints for the rest of the term. See ThreatDown bundles and managed services licensing.
Virtualization & partitioning
OneView reports each endpoint’s OS type as Workstation, Server or Mobile.[2] The EULA’s Device rule applies: each virtual or partitioned OS instance is a Device.[11]
Out of scope
- The MSP partner agreement, programme tiers and pricing, which are on the partner portal.
- Integrations that sync OneView billing to PSA and RMM tools (ConnectWise, Kaseya).
- Distributor marketplaces and their invoicing.