One subscription. Everyone covered.
Coverage is priced per person for the whole organization, with nothing metered and no per-incident surprises.
Excavate Coverage
priced per person · per yearOne subscription covers the whole organization. Your number depends on headcount and connected sources, and you will have it by the end of the first call, before any commitment.
- Every person covered, no tiers and no seats
- The forensic record, preserved continuously
- AI triage on every single trigger
- Human examiner reviews, concluded with verdicts
- Unlimited exit reviews on every offboarding
- Examiner-led investigations with endpoint enrichment
- The portal: Data hub, Ask Excavate, person records
- Forensic-readiness assessment and gap tracking
- Read-only connectors, nothing to deploy on day one
How the pricing behaves
All users covered
Coverage is per person and covers the whole organization, because equal coverage is what makes the program defensible.
Exit reviews included
Every offboarding is reviewed and concluded in writing at no per-case cost, and for most clients it is where coverage proves itself first.
Priced to be boring
A subscription that reads like insurance rather than an incident bill, with no surprise line items when something happens.
Four ways to handle insider risk.
A DLP or insider-risk tool needs a team you may not have. A forensics firm arrives after the damage, priced by the hour. Building it yourself takes months and a standing headcount. We run the program continuously and hand you conclusions.
| Capability | DLP tool | Forensics firm | In-house | Excavate |
|---|---|---|---|---|
| Works continuously, before anything goes wrong | Yes | No | Yes | Yes |
| Warns you while it is happening | Yes | No | No | Yes |
| Blocks data from leaving | Yes | No | No | No |
| Every trigger investigated, not only forensic cases | No | No | No | Yes |
| No team to hire, train or keep | No | Yes | No | Yes |
| Conclusions, not alerts to triage | No | Yes | Yes | Yes |
| Forensic depth and chain of custody | No | Yes | Partly | Yes |
| Evidence preserved before you need it | No | No | No | Yes |
| Every departure reviewed, included | No | No | No | Yes |
| Independent of your org chart | No | Yes | No | Yes |
The hard questions, answered plainly.
“So you’re monitoring us?”+
Our rules read the record and produce triggers for our examiners, not alerts for your team. Everyone is covered equally, so no one is singled out and nobody is scored or ranked. You receive written conclusions, and when your own team consults the record directly, that access is itself logged and attestable. A person cleared by a review is indistinguishable from one never reviewed.
What happens when a trigger fires?+
It is examined automatically against the record: what fired, what was checked, why it resolved. Almost all close quietly with a logged cause. The few that matter open a review by a human examiner, which ends in a verdict, cleared or escalated. Only investigations conclude a violation.
Who can see the data?+
Your authorized team, through the portal, with every access logged. Excavate examiners see what the pipeline routes to them, under per-client isolation. Your data is never used to train models and never leaves your engagement.
Do we need to install agents?+
Not to start. The record builds from read-only connections to Microsoft 365, Entra ID, GitHub and your HR systems. Endpoint enrichment deepens investigations where you roll out endpoint collection, and unlocks additional evidence like device-level file activity.
How is this different from insider risk tools?+
Tools sell you a queue. You staff it, tune it, and keep up with it. We run the pipeline, examine every trigger, and bring you verdicts with the evidence behind them, each one signed by a certified examiner who stands behind it. You get the record and the conclusions without hiring a team to produce them.
What happens when someone resigns?+
The offboarding itself is a trigger. Every departure gets an exit review of the preserved record: files, shares, sign-ins, repositories. Unlimited, included, and concluded with a verdict in writing.
We operate in the EU. Does this hold up?+
Coverage was designed for proportionality. Everyone is covered equally, rules are tiered rather than people, access is purpose-bound and logged, and every conclusion carries its cause. We provide your counsel and works council the documentation to review, in plain language.
What does it cost?+
A per-person subscription for the whole organization. The number depends on headcount and sources, and we share it on the first call, before any commitment.