start with a pilot · priced per host · cancel anytime
Start with a founding pilot — the full product on up to five of your hosts, white-glove installed, for $1,500 a month. If oknek doesn't catch something real in your first week, you owe nothing. When you're ready to scale, it's simple per-host pricing.
founding pilot
$1,500 per month · up to 5 hosts
The full product on your fleet, white-glove installed. Watch oknek stop your own agents in week one — or your money back.
team
$349 per host · per month
Ongoing runtime defense for teams running AI in production. Scales with your fleet.
enterprise
Custom annual · volume + compliance
For regulated workloads, off-box audit escrow, and 24/7 incident response.
Or run it free. The daemon, the CLI, the BPF-LSM programs and the full 21-rule pack are AGPL-3.0 on GitHub — self-host on your own machines, read every rule before you trust it, pay nothing. The paid tiers are the control plane on top: one place to run a fleet, and an audit record anchored off-box where your own root account can't reach it.
Not sure how many hosts? Start a pilot and we'll scope it with you — no commitment past 30 days.
plan by plan · every capability
The pilot is the full product — every core capability is included. Team adds scale; Enterprise adds kernel-grade enforcement and compliance.
| Capability | Pilot | Team | Enterprise |
|---|---|---|---|
| oknekd daemon + oknek CLI + shim | ✓ | ✓ | ✓ |
| Full rule pack (21 rules, R1–R24) | ✓ | ✓ | ✓ |
| Dean — AI security co-pilot (brief · ask · recommend) | ✓ | ✓ | ✓ |
| Real-time enforcement — blocks at the process | ✓ | ✓ | ✓ |
| Tamper-proof audit ledger (Okular) | ✓ | ✓ | ✓ |
| Live dashboard · event feed | ✓ | ✓ | ✓ |
| Dean recommendations → approve → apply | ✓ | ✓ | ✓ |
| Multi-host roll-up dashboard | ✓ | ✓ | ✓ |
| Hourly rule updates | ✓ | ✓ | ✓ |
| White-glove install | ✓ | ✓ | ✓ |
| Unlimited hosts | — | ✓ | ✓ |
| Forensic replay (full agent decision tree) | — | ✓ | ✓ |
| Kernel-grade BPF-LSM enforcement | ✓ | ✓ | ✓ |
| SSO (SAML / OIDC) + SCIM | — | — | ✓ |
| SOC 2 evidence room | — | — | ✓ |
| Off-box WORM audit escrow | — | — | ✓ |
| Air-gapped deployment | — | — | ✓ |
| 24/7 incident response + dedicated CSM | — | — | ✓ |
common questions · plain answers
The complete product on up to five of your hosts, white-glove installed — all 21 detection rules, real-time enforcement, Dean your AI security co-pilot, the tamper-proof audit ledger, and the live dashboard. Not a crippled trial: the pilot is the whole thing.
You continue on Team (per-host, per-month) or Enterprise, or you cancel — no charges beyond the pilot. Cancel anytime during the pilot for a full refund.
We install oknek on your hosts and it watches your agents. If it does not catch something real — a credential read, an unauthorized egress, a dangerous command — that you agree mattered, you owe nothing and you keep the audit log of what we saw.
A host is one machine running oknekd. The pilot covers up to five for a flat $1,500/month. Team is billed per protected host, per month — it scales with your fleet, so you pay for exactly what you protect.
Only if you want the strongest guarantee. The default install uses a userspace shim — no kernel reconfiguration, no reboot. Kernel-grade BPF-LSM enforcement is included on every tier, and in the open-source build: it needs a Linux kernel ≥ 5.8 with the bpf LSM active, which on Ubuntu 24.04 is one GRUB line and a reboot. We do that for you on the white-glove install.
Yes — the part that runs on your host. The oknekd daemon, the oknek CLI, the shim, the BPF-LSM programs and the full 21-rule pack are AGPL-3.0 at github.com/oknek/oknek. Read every rule before you install a thing, no NDA. What we sell is the control plane around it: Dean, the multi-host dashboard, forensic replay, the managed rule feed, and off-box WORM audit escrow — plus install, support and compliance.
Yes. Self-host the open-source build on your own hosts, free, forever, under AGPL-3.0 — full kernel enforcement and the local hash-chained audit ledger. You start paying when you need a fleet managed from one place, or when you need the audit record anchored somewhere your own root account cannot reach it.
Enterprise handles SSO/SCIM, SOC 2 evidence, off-box WORM audit escrow, air-gapped deployment, custom rules, and 24/7 response on a custom annual contract. Write to hello@oknek.com.
The fastest way to know if oknek is the right call is to watch it work on your own hosts. Start a pilot — we install it, and within a week you'll see exactly what your agents are doing that's out of bounds. If it catches nothing that matters, you owe nothing.