Trend Vision One credits are the licensing unit for Trend Vision One, the Trend Micro security platform that the vendor’s documentation now calls TrendAI Vision One. The Global Products Agreement (GPA) defines Credits as “the universal licensing unit for obtaining access to Products made available on the Trend Vision One platform” and states that they are purchased upfront, used automatically by solutions or packages, and expire at the end of the Subscription Period (rule).[1] The documentation calls the commercial vehicle the TrendAI Flex (credits) licence, “a type of subscription license”, and says credits can be used for all paid solutions, packages and features in the Vision One console.[2] Starting in January 2026 the Flex (credits) licence became the only Vision One licence available for purchase.[3]
Editions
Vision One has no platform editions. The vendor publishes a rate card of packages grouped by solution, each with a credit requirement per unit per month and per year and a calculation type.[5] The main packages are:
| Solution | Package | Monthly credits | Annual credits | Unit | Type |
|---|---|---|---|---|---|
| Endpoint Security | XDR for Endpoints (EDR) | 1.67 | 20 | endpoint | Snapshot |
| Endpoint Security | Endpoint Security Core | 3.75 | 45 | endpoint | Snapshot |
| Endpoint Security | Endpoint Security Essentials | 5.42 | 65 | endpoint | Snapshot |
| Endpoint Security | Endpoint Security Pro | 25 | 300 | endpoint | Snapshot |
| Endpoint Security | SAP Scanner for Endpoint Security - Pro | 400 | 4,800 | SAP server/host | Snapshot |
| Email and Collaboration Security | Core / Essentials / Pro | 2.08 / 4.17 / 8.75 | 25 / 50 / 105 | user | Snapshot |
| Cyber Risk Exposure Management | Core / Essentials | 1.67 / 4.17 | 20 / 50 | assessed desktop or server | Snapshot |
| Cyber Risk Exposure Management | Cloud account assessment (1 to 500 resources) | 83.33 | 1,000 | cloud account | Snapshot |
| Container Security | Container Security | 91.67 | 1,100 | Kubernetes node or ECS instance | Snapshot |
| XDR for Networks | Virtual Network Sensor | 1,041.67 | 12,500 | 500 Mbps | Snapshot |
| Zero Trust Secure Access | Private Access / Internet Access | 4.17 / 5 | 50 / 60 | user | Snapshot |
| Agentic SIEM and XDR | Analytic data ingestion (third-party) | 3 | 3 | GB | Volume |
| Sandbox Analysis | Manual submission | 2 | 2 | submission | Volume |
| File Security | Storage, SDK, scanners | 5,000 | 5,000 | 500,000 scans | Volume |
| Threat Intelligence Hub | Threat Intelligence | 6,666.67 | 80,000 | account/tenant | Snapshot |
All figures are from the vendor’s credit requirements page as published on 2026-09-30 (rule).[5] Annual rates for snapshot packages are twelve times the monthly rate, subject to rounding; volume packages have the same rate in both columns. Cloud account assessment runs in tiers of 500 resources per account, up to 666.67 credits per month for accounts with more than 3,500 resources.[5] Trend does not publish a price per credit; the credit purchase price is set in the Quote, the Private Offer or the marketplace listing.
Metrics
The Credit is the unit bought. The unit consumed depends on the package: Endpoint, User, GB of data, 500 Mbps of monitored throughput, Assessed cloud account, Protected Kubernetes node or ECS instance or 500,000 scans.[5] The number of credits an endpoint needs depends on the features enabled for it and on its type by activity.[6]
Counting / floors
Metering and monthly drawdown
The GPA states that usage is metered daily and Credits are drawn down on the first of each month based on the previous month’s usage (rule).[1] The documentation says the monthly drawdown model started in January 2026 and that monthly drawdowns are rounded to the nearest whole credit.[4] Usage and credit information updates daily at 05:00 UTC.[2]
Each package uses one of two calculation types:[4]
- Snapshot-based. Vision One takes a daily snapshot of the units in use. The monthly drawdown uses the snapshot at the 85th percentile of the month’s active usage days, which discards the highest 15% of days (rule). The vendor’s example: a package used from 1 to 20 April has its three highest days (15% of 20) excluded, and the highest of the remaining 17 days sets the April drawdown. Because the 15% applies only to active days, the vendor recommends activating new packages early in the month.
- Volume-based. The monthly drawdown is the sum of each day’s usage multiplied by the package’s credit requirement (rule).
Endpoint counting
Only endpoints with active and long-lived agents require credits; inactive endpoints do not (rule).[6] The documentation defines three types:[6]
| Endpoint type | Definition | Counted? |
|---|---|---|
| Active | Agent reported a status in the last hour of usage measurement | Yes |
| Long-lived | More than seven days between the agent’s first and latest status reports | Yes, even if it did not report in the last hour |
| Inactive | Did not report in the last hour and is not long-lived | No |
The seven days need not be consecutive, so a laptop that is switched off for a week still counts once it has been long-lived. To stop paying for decommissioned machines, the vendor says they must be deleted from Endpoint Inventory manually, through the API, or by automatic removal of endpoints that stay inactive for a set period.[6]
Each endpoint applies the credit requirement of one feature package at a time. An endpoint counts as Endpoint Security Essentials if XDR for Endpoints and at least one Core feature are enabled; add-ons such as SAP Scanner, Sandbox automatic submission and the Data Security Sensor are charged on top (rule).[6] In Server & Workload Protection, enabling recommendation scans for the Intrusion Prevention, Integrity Monitoring and Log Inspection modules charges the endpoint at the Pro rate of 25 credits.[7] Policy settings therefore decide the bill: to reduce usage, the documentation says, features must be disabled in policies or endpoint overrides.[6]
Balance, overuse and true-up
The credit balance is made of purchased credits and credits converted from existing licences.[8] If usage exceeds the balance, Vision One keeps running, the balance goes negative, and the Trend representative asks the customer to renew or buy more credits (rule).[9] Contractually this is excess Capacity: the GPA makes the Company solely responsible for keeping usage within its purchased intention and Capacity, liable for excess usage fees, and warns that enabling other functionalities “will use Credits differently than as intended and may result in overuse” (rule).[1] The solutions listed under a Flex licence in License Information are a planning aid only; credits do not have to be used for them.[10]
Expiry
When a Flex (credits) licence expires, the credits bought with it disappear from the balance.[2] Converted credits keep the expiration date of the original licence.[3] For SaaS solutions an expired licence has a 30-day grace period and a 30-day lock period before data is purged (rule).[10] Unused credits are not refunded: the GPA makes fees non-refundable, and a termination for convenience does not end payment obligations (rule).[1]
Virtualization & partitioning
Vision One counts virtual machines, VDI desktops and cloud instances as endpoints on the same activity rules as physical devices; non-persistent machines that stop reporting before becoming long-lived drop out of the count.[6] Containers are counted per protected Kubernetes node or Amazon ECS instance (91.67 credits per month) and per serverless pod or task (9.17 credits per month).[5]
Cloud / BYOL
Credits can be bought from a sales representative or through AWS Marketplace or Microsoft Marketplace.[8] Marketplace purchases follow the marketplace terms and any Private Offer, which prevails over the GPA where they conflict.[1]
Programs
Conversion of existing licences
All existing Vision One licences convert automatically to credits with the same value and expiration date, and converted credits are rounded up to the next whole number (rule).[3] The formulas are (rule):[3]
- Existing Flex licences: purchased credits divided by the months in the original term, multiplied by the remaining months. The vendor’s example is 12,000 credits bought on 2025-10-01 becoming 9,000 credits after 2026-01-01.
- Other licences: licence units multiplied by the associated package’s monthly credit requirement and by the remaining months, including partial months. The example is 100 units of Cyber Risk Exposure Management Core (1.67 credits) for 9 months, giving 1,503 credits.
Endpoint Security seats convert at 45 credits (Core), 65 credits (Essentials) and 300 credits (Pro) per seat, so 10 Pro seats become 3,000 credits.[7] Trial licences do not convert, and not every Trend licence converts: licences for on-premises products do not, and solutions tied to older licences with no conversion may not require credits until those licences expire.[10][8]
Registering licences
Licences are registered in Administration > License Information with an Activation Code or Registration Key; for some licences the Activation Code is only generated from the Registration Key when registration completes.[11] License Information shows each licence’s type, sales channel, units, credit conversion, start date and expiration date, and filters licences that expire within 90 days.[10]
Out of scope
The price of a credit, volume discounts and committed-spend terms are set per customer and are not published. Consumption of Vision One by managed service providers requires partner terms: the GPA prohibits use of Products to provide services to third parties.[1]