Sold by: Red Canary
Deployed on AWS
Red Canary detects and stops threats 24x7 across your endpoints, network, cloud, identities and SaaS applications.
4.6
Overview
Red Canary gives customers the confidence they need with unmatched, actionable intelligence and 24x7 expert response to stay ahead of adversarial threats. With customer-validated 99% threat detection accuracy, security teams can focus on the threats that matter instead of wasting time on noise. With a combination of actionable threat profiles, intel-driven analytics, and specific response and remediation recommendations, your team can make better decisions and prioritize resources according to the most relevant threats to your organization. Features:
- 24/7/365 expert investigation of potential threats
- Advanced threat detection
- Global threat intelligence team
- Continuous threat hunting
- Proactive response and remediation
Highlights
- Unmatched threat detection accuracy, Red Canary helps protect your endpoints, network, cloud, identity and SaaS applciations.
- Actionable threat intelligence with on-demand adversary insights and expert collaboration so you can stay ahead of threats.
- Guided, automated or human-led 24/7 expert response so you can focus on your business objectives instead of the next cybersecurity event.
Details
Sold by
Categories
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor, and additional usage. You pay upfront or in installments according to your contract terms with the vendor. This entitles you to a specified quantity of use for the contract duration. Usage-based pricing is in effect for overages or additional usage not covered in the contract. These charges are applied on top of the contract price. If you choose not to renew or replace your contract before the contract end date, access to your entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months | Overage cost |
|---|---|---|---|
Endpoint | Computer or instance running Windows, MacOS, or Linux | $120.00 | |
Account | User account | $100.00 | |
Resource | Cloud resource | $250.00 | |
Network | Network coverage | $20.00 |
Dimensions summary
This contract covers four separate coverage units you can combine to match your environment. Endpoint counts each computer or instance running Windows, MacOS, or Linux. Account covers user accounts. Resource covers cloud resources. Network covers network coverage. You buy the quantity of each unit you need, so pricing scales with how many endpoints, accounts, resources, and networks you protect. Endpoint usage is measured monthly, with servers and workstations counted separately and true-ups reviewed every three months. Volume discounts may apply as you increase counts.
Top-of-mind questions for buyers
An endpoint is any computer or instance running Windows, MacOS, or Linux. Servers are counted using a monthly average from four daily samples. Workstations are counted by the number processed each month. Virtual machines sharing an identical hostname and IP address are treated as a single endpoint for licensing.
Red Canary keeps processing data from all endpoints, so extra usage does not reduce your protection. Usage is reviewed every three months. If you have an overage, you can either raise your license count, prorated for the rest of your contract, or pay a one-time overage charge.
Each unit bills independently based on the quantity you buy. Endpoint covers devices, Account covers user accounts, Resource covers cloud resources, and Network covers network coverage. You add the counts you need for each unit, and the charges appear together. Endpoint volume often drives cost in device-heavy environments.
docs.redcanary.com
Helpful?
Vendor refund policy
No refunds
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Red Canary
By Arctic Wolf
By Deepwatch
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Threat Detection Accuracy
99% threat detection accuracy across endpoints, network, cloud, identities and SaaS applications
Continuous Threat Hunting
Continuous threat hunting capabilities with proactive identification and analysis of potential threats
Threat Intelligence Integration
Intel-driven analytics powered by global threat intelligence team with actionable threat profiles and adversary insights
Automated Response and Remediation
Guided, automated, and human-led response capabilities with specific remediation recommendations
24/7 Expert Investigation
Round-the-clock expert investigation and response services for potential threats across all security domains
Continuous Threat Monitoring
24x7 monitoring of networks, endpoints, and cloud environments for threat and risk detection
Incident Detection and Response
Automated detection and response to critical security incidents with guided response procedures to prevent threat propagation
Multi-Environment Coverage
Monitoring capabilities across networks, endpoints, and cloud environments
Security Investigation Services
Managed investigation services for security incidents with expert analysis and remediation guidance
Expert Security Operations
Access to dedicated security experts providing threat analysis and incident response operations
Alert Prioritization Engine
Patented Dynamic Risk Scoring alert engine for precise threat identification and response prioritization
Security Monitoring Coverage
24x7x365 monitoring and managed detection & response across multiple security domains including endpoint detection, vulnerability management, and firewall management
SOC Technology Integration
Curated integration with industry-leading SOC technologies including AWS and Splunk tools through the Deepwatch Security Center
Security Posture Assessment
Proprietary Security Index providing quantitative analysis and industry benchmarking for security program maturity evaluation
Threat Hunting Capability
Proactive threat hunting services to identify and remediate security threats across the attack surface
Standard contract
No
No
No
Customer reviews
Ronaldo P.
Centralized Visibility and Cloud-Native Security That Streamlines SecOps
Reviewed on Oct 29, 2026
Review provided by G2
What do you like best about the product?
What I like best about Zscaler Sec Ops is its centralized visibility and cloud-native security approach. It helps simplify security operations by providing better threat detection, monitoring, and response capabilities. I also appreciate how it integrates with other security tools, improves visibility across the environment, and helps security teams identify and respond to potential threats more efficiently.
What do you dislike about the product?
One of the main downsides is the learning curve and complexity of the platform, especially when configuring policies, integrations, and troubleshooting issues. Some features can be difficult to navigate, and investigating incidents may require switching between different dashboards or tools. Additionally, licensing costs can be relatively high, and getting the most value from the platform requires proper configuration and ongoing administration.
What problems is the product solving and how is that benefiting you?
Zscaler Sec Ops helps address the challenges of limited security visibility, fragmented security tools, and slow threat detection and response. It provides centralized visibility into security events, helps identify potential threats earlier, and improves incident investigation and response times. This benefits the business by reducing security risks, improving operational efficiency, strengthening the overall security posture, and helping security teams make more informed decisions while protecting critical business resources and data.
Kanchan M.
Game-Changer for Alert Fatigue with Minor Onboarding Overhead
Reviewed on Oct 28, 2026
Review provided by G2
What do you like best about the product?
The best part of Zscaler SecOps is its shift from noise-heavy log analysis to high-fidelity, actionable threat detection. By placing indistinguishable decoy assets directly in the network traffic path, any interaction is guaranteed to be an active threat, immediately ending alert fatigue for analysts
What do you dislike about the product?
Zscaler SecOps is an exceptional tool for mature, cloud-first organizations already heavily invested in the Zscaler ecosystem. However, for organizations with heavy legacy on-premises footprints or small, under-resourced security teams, the platform's high deployment complexity and ongoing maintenance overhead can make it difficult to realize full value.
What problems is the product solving and how is that benefiting you?
Zscaler SecOps solves the massive business problem of "Alert Fatigue" and delayed incident response. By replacing low-context, noisy log alerts with high-fidelity, active threat indicators (via deception decoys), the platform allows lean security teams to instantly detect and autonomously contain active threat actors before they can move laterally or access sensitive data.
Edgardo A.
Easy, Secure Cloud Access with Room to Improve App Flexibility
Reviewed on Oct 23, 2026
Review provided by G2
What do you like best about the product?
I like that Zscaler Sec Ops feels friendly and light. I appreciate the access and easy integration, and that it brings secure access to the cloud. I’m happy with it. The setup instructions were easy to follow.
What do you dislike about the product?
I sometimes find Zscaler Sec Ops inflexible with apps. The company should work harder on updates and patches to make it more flexible with newer apps and configurations.
What problems is the product solving and how is that benefiting you?
I use Zscaler Sec Ops for security access.
reviewer2856117
Security team has gained reliable secondary threat detection and rapid incident response
Reviewed on Jun 14, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for Red Canary is that a Red Canary analyst monitors our logs, and if they see any abnormality, they create a ticket that we use to analyze the situation. We assign that ticket and analyze it to ensure we have all the details needed. We use other tools to investigate, but we mainly rely on the evidence from Red Canary, and we can also use the isolate feature from Red Canary. There are threat reports and agents, and in our environment, we have endpoints and identity as well.
A recent situation where I used Red Canary to analyze a ticket involved an employee from the US who logged in from the UK, a country he had never visited before. Red Canary's analyst assumed that account was compromised, but after analyzing using our other tools, it seemed the login was legitimate. The user confirmed he had traveled to the UK and used one of our company phones to log into the account to check emails, so the alert triggered was a true positive but a legitimate anomaly.
What is most valuable?
The best features Red Canary offers are that they monitor our logs and have their own use cases, providing us with these tickets. If we miss anything, we treat Red Canary as a secondary triggering tool, so we use it as a secondary detection tool.
The most valuable feature in my day-to-day work is that those logs are monitored by actual experienced analysts from Red Canary. Although we have tools from our end with use cases, those can miss some events and incidents, but since Red Canary uses active, live agents to monitor and detect these anomalies, we rely on that feature for our security operation center.
Red Canary has impacted my organization positively because we treat any ticket triggered by them as high priority due to the fact that 99 percent of the time it is a true positive. They can isolate machines, which is a feature I really appreciate because if something happens on a weekend when we are not available, they can isolate it and contain the situation.
What needs improvement?
I wish Red Canary could have a graph that shows the endpoint, user, and how it spreads, providing a visual representation to easily identify what happened.
For how long have I used the solution?
I have been using Red Canary for one year.
What do I think about the stability of the solution?
I have not experienced any stability or reliability issues with Red Canary so far.
What do I think about the scalability of the solution?
Red Canary's scalability is good in my experience, and we have not had any problems with scalability.
How are customer service and support?
The customer support has been really good from what I have seen. If I need more details about any incident, there is a contact us option to reach an agent, or another agent can substitute if the previous one is not available, allowing us to get additional details and opinions.
Which solution did I use previously and why did I switch?
I cannot speak to using a different solution before Red Canary because I started working here, and it has always been Red Canary.
How was the initial setup?
I cannot speak to the process to purchase Red Canary with certainty because I am an end user. Perhaps our managers or directors have a better answer regarding the purchasing process, but I do not know those details.
What about the implementation team?
I lack insight into pricing, setup cost, and licensing because I am an end user.
What was our ROI?
I believe we have seen a return on investment because we utilize Red Canary effectively. Any missed detection will definitely be triggered by Red Canary. I think it is a good investment since it provides accurate details.
Which other solutions did I evaluate?
I have no idea if my organization evaluated other options before choosing Red Canary, as that was perhaps another person's or another team's decision. Our role is to utilize this application without involvement in purchasing or decision-making.
What other advice do I have?
We use Red Canary as a secondary monitoring service so if our main tools miss any detection, Red Canary will detect it. We critically treat any alert from Red Canary as a high-priority ticket because it is most probably a true positive, but it can also be a legitimate anomaly, so we will treat it as a priority one case.
Red Canary serves as a secondary triggering tool, and we do not really use any kind of SLA or anything. They monitor and create threat tickets they believe are threats, and we use it as a secondary monitoring tool.
My advice to others looking into using Red Canary is to consider it as a good secondary detection tool, and they have good customer support. I would rate this product an 8 out of 10.
Luciana S.
Brilliant Threat Detection and SOC Monitoring with Strong Remediation Guidance
Reviewed on May 15, 2026
Review provided by G2
What do you like best about the product?
Red Canary is a helpful solution that offers brilliant threat detection and this makes it easy to identify security challenges
The software handles and manages SOC processes, and this includes active monitoring and proper security alerts
Red Canary reduces chances for false positives and this makes the entire security process successful
The app provides robust remediation procedures and guidance, which makes the users more solid and efficient
The app connects with Microsoft Defender and this helps in improving security visibility
Red Canary has remarkable threat intelligence capabilities and this helps in identifying and learning threat patterns
The software handles and manages SOC processes, and this includes active monitoring and proper security alerts
Red Canary reduces chances for false positives and this makes the entire security process successful
The app provides robust remediation procedures and guidance, which makes the users more solid and efficient
The app connects with Microsoft Defender and this helps in improving security visibility
Red Canary has remarkable threat intelligence capabilities and this helps in identifying and learning threat patterns
What do you dislike about the product?
Red Canary has premium pricing, something that makes small businesses ignore it and prefer to others
The customization of a dashboard is inflexible and this affects companies performance
The customization of a dashboard is inflexible and this affects companies performance
What problems is the product solving and how is that benefiting you?
The software is outstanding in detecting all threats and vulnerabilities, creating a reliable work environment
The program issues 24/7 systems and incidents monitoring, and this amplifies the response speed
When attacks appear, Red Canary is fast to offer reliable remediation and recovery
The visibility of ant endpoint status and cloud protection is also well addressed by this software
The program saves on time that can be used for triaging security alerts and this makes companies mature their SOC operations
Red Canary offers expert analysis and this largely supports companies with less security teams
The program issues 24/7 systems and incidents monitoring, and this amplifies the response speed
When attacks appear, Red Canary is fast to offer reliable remediation and recovery
The visibility of ant endpoint status and cloud protection is also well addressed by this software
The program saves on time that can be used for triaging security alerts and this makes companies mature their SOC operations
Red Canary offers expert analysis and this largely supports companies with less security teams