Design partner pilot

90 days, up to 25 seats, limits included.

A design-partner pilot puts the sensor on a real fleet and the events in your SIEM. You get the enterprise packaging and the maintainer's time. The fee is scoped in the SOW, not listed here: a number we would not take is worse than no number.

Start a pilot conversationRead the source firstcontact@agentmetry.ai

exit 0 23exit 1 1exit 2 1

pilot-08 exit 1 · an agent is present and not recorded

An illustrative 25-seat wave. Each laptop reports what agentmetry hooks status returns on it. Select one to read it.
Term
90 days
Seats
Up to 25
Implementation support
4 hours, remote
First reply
Within 2 business days

No demo gate. No qualification call. No sales team. One maintainer reads the mail. No third SKU until a real tenant has run the MSI.

Two paths

Same sensor. Different packaging.

Evaluate

Open source

Free, Apache-2.0

pip install, doctor, trail, detections, SIEM forwarders. You run it on a machine you control. No account.

GitHubPyPI

Deploy

This page

90 days, up to 25 seats

Fleet packaging and the maintainer's time. Mail contact@agentmetry.ai. The commercial figure is in the SOW that follows, not in a cart.

The trade

What you get, and what it needs from you.

You get

Enterprise MSI

Silent per-machine install through your MDM. The ingest client ships inside the frozen binary, so a machine with no git checkout still captures.

Intune deployment pair

A Remediation that installs hooks into each signed-in user's profile rather than LocalSystem, plus the detection script, so a device fails a compliance check instead of quietly recording nothing.

Splunk TA

Search-time extraction for the heartbeat envelope: coverage per agent, hook profile, MCP schema digest, Merkle root. Saved searches ship disabled until you have a baseline.

Detections and the corpus

14 sequence rules with MITRE tags, the public benchmark they are tested against, and Splunk, Sigma and YARA-L equivalents for the heartbeat signals.

The maintainer

Up to 4 hours of remote implementation support, and a person on the other end of every message rather than a queue.

You provide

A cohort and a way to reach it

Up to 25 developer machines, and an admin who can push an MSI and a user-context script through your MDM.

An index to forward to

A Splunk HEC token and index, a Google SecOps ingestion account, an Elastic endpoint, or a Microsoft Sentinel data collection rule with an Entra app registration. Nothing leaves the machine until you set one.

One technical contact

Somebody who will open the findings. A pilot where nobody triages produces a trail and no answer about whether the trail is useful.

Written feedback before the end

On detection quality and deployment friction. This is being bought as much as the fee is.

Shape of the engagement

Deploy, run, review.

Weeks 1 to 2

Deploy

MSI to the cohort, hooks into user profiles, one sink wired to your index. Success is agentmetry hooks status returning 0 on every seat and the heartbeat visible in your SIEM.

Weeks 3 to 10

Run

Developers work normally. Findings arrive as events. You triage them and the dispositions append to the same hash chain, so the triage is itself evidence.

Weeks 11 to 13

Review

Detection quality, false-positive rate on your traffic, deployment friction, and whether the trail answered a question you actually had. Written, so it is useful to both of us.

Day one, per machine

msiexec /i agentmetry.msi /qn
agentmetry hooks install
agentmetry hooks status

What your MDM reads back

0
every agent present here is recorded
1
an agent is present and not recorded
2
coverage undeterminable, install will not help

What is not ready

Stated here, not discovered in week three.

The MSI is not EV-signed

Deployment needs Unblock-File or your own signing. A clean-room certified build does not exist yet. If unsigned installers are a hard stop in your environment, say so first and we will not waste each other's time.

Never run against a real tenant

The MSI installs, upgrades, uninstalls and purges in CI on a clean Windows runner, with the service running as a virtual account. It has not met a managed device: yours would be the first real tenant. Remediations also need Intune Plan 2 or Windows Enterprise E3/E5, not base Intune.

Attribution is a first cut

The hash chain proves ordering and non-modification of what was written, not who wrote it. The Enterprise package signs forwarded events per host with Ed25519, and the console verifies each against that host's registered key. It is built and tested, and it has not run on a customer fleet. If attributable evidence across a fleet is the reason you are here, say so in the first message and we will test it on yours first.

It is not a CASB

Unmanaged ChatGPT, Microsoft 365 Copilot, and any IDE with hooks removed stay invisible. Removal is loud in the heartbeat. It is not prevented.

Covered is not capturing, for Codex

Codex trusts hooks by hash and skips untrusted ones silently. A file check cannot see that decision, so Codex seats are confirmed by events arriving, not by a coverage report.

One maintainer

No support rota and no second pair of hands. The continuity terms exist because that risk is real and should be priced rather than argued away.

If the maintainer stops

Written down before anyone needs it.

Perpetual licence

The licence to the delivered build survives expiry, termination, non-renewal, and cessation of business. You keep running what was delivered.

Source deposited with you

A source archive at every delivery. You hold it from day one with no licence to use it, until a Continuity Event grants one automatically.

Apache-2.0 floor

The core is already Apache-2.0. Trails, detections and forwarders keep working with or without anyone, because nothing depends on a cloud that can be switched off.

A Continuity Event means cessation, insolvency, or incapacity. The clause lives in the pilot SOW, not in a slogan.

Evaluate it before you talk to anyone.

You do not need a pilot to evaluate this. It is Apache-2.0 and installs with pip. Run it on one machine for a week, read the trail, and decide whether the events answer a question you actually have. An evaluation that starts with a purchase order is a worse evaluation.

Email about a pilotSecurity propertiesHow the sensor works