- Full 30-day evaluation
- Automatic firewall IP blocking
- Dashboard, Diagnostics & monitoring
- Global Baseline threat feed (anonymized)
- AI Assistant — Professional only
- No credit card required
SYSMarshal Pricing — Windows Endpoint Security Plans
Choose the plan that fits. Automatic Windows Firewall protection backed by real-time threat intelligence — from a free 30-day trial to org-wide Professional licensing.
- Everything in Trial, fully unlocked
- Thousands of free AI queries + full AI Assistant
- Full hostnames in Baseline
- "View Global Data" worldwide toggle
- Global threat intelligence & sharing
- 1 license per PC · org-wide deploy
- One API key per machine
- Volume discounts from just 5 licenses
- Priority updates & support
- Extends your active Professional license
- Each unit = 1 additional PC
- New API key per added machine
- Full Professional features (AI, full hostnames, global data)
- Synced with existing renewal date
- Same priority support
- Professional includes thousands of free AI queries
- Prepaid credits for in-app AI Assistant
- Ask security questions in plain English
- AI-powered event & log analysis
- Credits deducted per query (token-based)
- Stack multiple top-ups for more credits
- Requires an active SYSMarshal license
What every SYSMarshal license includes
Every plan — including the free trial — ships the same detection and enforcement core. SYSMarshal reads the Windows Security event log in real time, scores hostile IP addresses, and writes block rules straight into the Windows Firewall, so protection keeps holding after the application is closed and across reboots.
Real-time threat detection
Continuous Windows Security event-log analysis for RDP brute force, SQL Server authentication attacks, credential attacks, account lockout storms and connection floods.
Autonomous firewall response
Threshold-based blocking written natively into the Windows Firewall, with an IP range editor, bulk import, and whitelist and trusted-range protection for your own offices and VPN egress.
Security dashboard
A native SOC console with KPI trends, a security posture score, an attack-spike banner, new attackers and repeat offenders, a weekly attack heatmap and a live threat origin map.
Diagnostics & DFIR
IP diagnostics with WHOIS, RDAP and geolocation, event flood reports, a ping monitor, IIS log analysis, and investigation cases with an exportable evidence timeline.
Community threat intelligence
The global Baseline feed of anonymized attacker intelligence, with Auto-Inoculation so IP addresses already attacking other members are blocked before they reach you.
Windows, end to end
Windows 10, Windows 11 and Windows Server 2019 to 2025, 64-bit. SQL Server Express, the .NET runtime and WebView2 are installed by setup. No inbound ports to open.
Compare SYSMarshal plans
The trial is the full platform on a 30-day clock. Professional adds the AI Security Assistant, full hostnames and worldwide threat data.
| Capability | Trial | Professional | Add-On |
|---|---|---|---|
| Automatic Windows Firewall blocking | Included | Included | Included |
| Dashboard, diagnostics & investigations | Included | Included | Included |
| Global Baseline threat feed | Included | Included | Included |
| AI Security Assistant | Not available | Thousands of free queries | Thousands of free queries |
| Full hostnames in Baseline | Masked | Included | Included |
| Worldwide Global Data toggle | Site data only | Included | Included |
| Term | 30 days | Annual, per PC | Inherits your renewal date |
| Volume discounts | — | From 5 licenses | — |
Pricing questions
How is SYSMarshal licensed?
One license covers one PC or server, billed annually. Every machine you license reports into the same customer account, so a single site-wide view covers your whole fleet.
What is the founding member price?
The first 5,000 members lock the $199 per year introductory price for three full years. Once those seats are taken, the standard $399 per year applies to new customers.
Do I need a credit card for the trial?
No. The 30-day trial needs no card and no sales call, and it performs live firewall enforcement — nothing is simulated.
I already have Professional and need more machines.
Buy the Professional Add-On instead of a second plan. Each unit covers one more PC at the same price and is synchronized with your existing renewal date.
Is SYSMarshal a replacement for antivirus?
No. Antivirus inspects files; SYSMarshal watches authentication, network and event-log behavior and shuts the attacker out at the machine's network edge. It runs alongside Microsoft Defender without conflict.
Do AI credits expire?
No. Credits stay on your balance while your SYSMarshal license is active, and top-ups stack. Professional already includes thousands of free AI queries.
Still deciding? Read the product documentation or the frequently asked questions.