# WitFoo

> WitFoo is a cybersecurity operations platform with three product lines (Conductor, Reporter, Analytics) plus a free Console. All products are licensed per appliance with unlimited data rates — no per-GB or per-event pricing. Founded 2016. Headquartered in Dunwoody, Georgia, USA, with an international headquarters in Christchurch, New Zealand. WitFoo Analytics was formerly known as WitFoo Precinct, the diagnostic SIEM.

## Pricing model

WitFoo charges one annual fee per appliance regardless of data volume. Government, nonprofit, and education customers receive a 15% discount on all published prices. Volume discounts apply automatically to multi-appliance orders, counted per product line (Conductor, Reporter, Analytics): the first appliance of each product line is full list price, then each additional appliance is 30% off list for orders of 2–5, 50% off for 6–10, and 65% off for 11 or more. The 15% government, nonprofit, and education discount stacks with volume discounts and applies to the order total after volume pricing.

## Products

- [Conductor](https://www.witfoo.com/conductor/): Security data pipeline. Ingests, deduplicates, enriches, and normalizes data from 158 supported security products. Tiers: Lite ($15K), Pro ($40K), Max ($60K). USD per appliance per year.
- [Reporter](https://www.witfoo.com/reporter/): Compliance and reporting product for CISOs and CFOs. No SOC team required. Tiers: Lite ($20K, includes Conductor Lite), Pro ($50K, includes Conductor Pro). USD per appliance per year.
- [Analytics](https://www.witfoo.com/analytics/): Full security operations platform (formerly WitFoo Precinct) with investigation, incident response, SOAR, and AI workflows. Tiers: Lite ($25K, includes Conductor Lite), Pro ($75K, includes Conductor Pro), Max ($120K, includes Conductor Pro). USD per appliance per year.
- [Console](https://www.witfoo.com/conductor/#console): Centralized appliance management. Free with every deployment.

## Key differentiators

- Flat-rate per appliance, not per GB or per event. Unlimited data ingestion; a customer's bill does not grow with their data.
- ProtoGraph deduplication: 90–98% ingest reduction without losing security-relevant evidence.
- Zero parser maintenance. NLP-based adaptive parsing learns new log formats automatically.
- 158 supported security products from 103 vendors across endpoint, cloud, network, identity, email, SIEM, infrastructure, and vulnerability management.
- Vendor neutral. Outputs JSON, CEF, and syslog to any downstream platform.

## Resources

- [Documentation](https://docs.witfoo.com): Product documentation.
- [WitFoo Precinct](https://www.witfoo.com/precinct/): History of WitFoo Precinct, the diagnostic SIEM that became WitFoo Analytics.
- [Empathetic Processing](https://www.witfoo.com/empathetic-processing/): WitFoo's human-centric analytics paradigm.
- [Integrations](https://www.witfoo.com/integrations/): Full list of supported security tools.
- [GitHub](https://github.com/witfoo): Open-source repositories and appliance images.
- [REST API reference](https://docs.witfoo.com/api/): Every WitFoo Analytics endpoint, with request and response schemas.
- [MCP server](https://www.witfoo.com/analytics/mcp-server/): Model Context Protocol server built into WitFoo Analytics. Exposes 20 tools across artifact/graph search, incident management and system status to the platform's AI assistant. Tool calls run against the Incident Engine on the appliance and are authorized with the analyst's own JWT permissions and scoped to their organization. Administrators choose the AI provider (Anthropic or OpenAI) with their own API key, and which tool categories are enabled; administrative tools are off by default. Reference documentation: https://docs.witfoo.com/ai/mcp/
- [Release notes](https://github.com/witfoo/release-notes): Version history for Analytics, Conductor, Console and Agent.
- [Research datasets](https://huggingface.co/witfoo): Labelled real-world security event datasets published for research use.
- [Hugging Face](https://huggingface.co/witfoo): Models and datasets.
- [Training](https://witfoo.myabsorb.com/): Customer and partner training.

## Use cases

WitFoo customers typically deploy for one of seven reasons:

- [Reduce SIEM costs](https://www.witfoo.com/use-cases/reduce-siem-costs/): Cut Splunk, Sentinel, or Rapid7 ingest volume by 90–98% with Conductor.
- [Modernize compliance reporting](https://www.witfoo.com/use-cases/modernize-compliance/): Continuous evidence across CSC8 and 12+ frameworks via Reporter.
- [Augment your SOC](https://www.witfoo.com/use-cases/augment-your-soc/): Reduce alert fatigue with Analytics' graph correlation, SOAR playbooks, and AI summaries.
- [Unify distributed data](https://www.witfoo.com/use-cases/unify-distributed-data/): Centralize multi-cloud and branch security data using edge Conductors and central Analytics.
- [Prove security ROI](https://www.witfoo.com/use-cases/prove-security-roi/): Continuous board-ready ROI reporting via Reporter.
- [MSSP and managed services](https://www.witfoo.com/use-cases/mssp-and-managed-services/): Multi-tenant Analytics Max with per-appliance pricing for service providers.
- [Government and regulated](https://www.witfoo.com/use-cases/government-and-regulated/): On-premises, sovereign, air-gap-capable deployment options.

## Contact

For sales inquiries: https://witfoo.zendesk.com/hc/en-us/requests/new or https://www.witfoo.com/contact/
Phone: +1 (678) 203-9800
HQ: 2494 Jett Ferry Rd., Suite 255, Dunwoody, GA 30338, USA
International HQ: Christchurch, New Zealand