WireTrace is licensed as three cumulative editions. Every edition includes the full passive collection core, so every deployment sees the same network. What the editions differ on is what the platform does with what it sees: Foundation establishes visibility and policy intent, Protect adds visualisation, detection and response, and Enterprise adds risk, compliance and active and forensic work.
The editions are strictly cumulative. Protect contains all of Foundation and Enterprise contains all of Protect, so an upgrade only ever adds capability and never moves it. Healthcare and IoMT is an add-on, not an edition, and can be attached to any of the three.
| Edition | What it is for | Headline capability it adds |
|---|---|---|
| Foundation | Know what is on the network, how it communicates, and what the intended communication policy is. The visibility and governance baseline. | Classification, Rumi private AI, policy definition and violation visibility |
| Protect | See the network as a picture, detect what is wrong in it, and act on policy rather than only describe it. | Heat Map, Physical Topology, Purdue view, Threat Detection, Hunting and Investigations, policy enforcement |
| Enterprise | Quantify and evidence risk, report against frameworks, and reach into the estate actively when passive observation is not enough. | WARS risk scoring, Vulnerability Management, Compliance, Bahith active discovery, PCAP capture and replay, forensics |
Licensed capability counts, including the shared collection core: Foundation 14, Protect 22, Enterprise 30. The Healthcare and IoMT add-on contributes one further licensed capability to whichever edition it is attached to. The full line-by-line breakdown is on pages 2 and 3.
The add-on is available on every edition. Healthcare and IoMT does not require Enterprise. A hospital that needs the clinical lens on a visibility-only footprint can buy Foundation plus the add-on, and the clinical lens is identical in all three cases. The add-on is granted by name on the licence, so an edition licence never silently includes it and never silently withholds it.
Upgrades are additive. Because the editions are cumulative, moving from Foundation to Protect, or Protect to Enterprise, only adds capability. Nothing an existing deployment relies on is withdrawn by an upgrade, and the add-on carries across an edition change as its own line item.
This is the authoritative line-by-line breakdown. The collection and visibility core is present in every edition and is never withheld. A green check means the capability is licensed in that edition.
| Capability | Foundation | Protect | Enterprise |
|---|---|---|---|
| Collection and visibility core — included in every edition | |||
| Kashif passive DPI and protocol intelligence | ✓ | ✓ | ✓ |
| Asset inventory | ✓ | ✓ | ✓ |
| Connections | ✓ | ✓ | ✓ |
| Sensors | ✓ | ✓ | ✓ |
| Integrations | ✓ | ✓ | ✓ |
| Segmentation and communication baselines | ✓ | ✓ | ✓ |
| Dashboards and network insights | ✓ | ✓ | ✓ |
| Standard reports | ✓ | ✓ | ✓ |
| Protocol baseline | ✓ | ✓ | ✓ |
| Change management | ✓ | ✓ | ✓ |
| Alert queue | ✓ | ✓ | ✓ |
| Foundation — classification, AI and policy intent | |||
| Classification rules | ✓ | ✓ | ✓ |
| Rumi private AI, ask your environment | ✓ | ✓ | ✓ |
| Policy definition, visibility and violations | ✓ | ✓ | ✓ |
| Protect — visualisation, detection and response, enforcement | |||
| Heat Map | — | ✓ | ✓ |
| Physical Topology | — | ✓ | ✓ |
| Purdue and OT view | — | ✓ | ✓ |
| Threat Detection | — | ✓ | ✓ |
| Hunting and Investigations | — | ✓ | ✓ |
| IOC and threat intelligence | — | ✓ | ✓ |
| Attack surface and exposure | — | ✓ | ✓ |
| Advanced Policy Fabric automation and enforcement | — | ✓ | ✓ |
Hunting and Investigations is a single licensed capability covering both the hunt workspace and the investigation workspace, including the Investigate tab on an asset. They are presented as one area of the product and are licensed together.
| Capability | Foundation | Protect | Enterprise |
|---|---|---|---|
| Enterprise — risk, compliance, active and forensic | |||
| WARS risk scoring | — | — | ✓ |
| Vulnerability Management | — | — | ✓ |
| Compliance reporting and frameworks | — | — | ✓ |
| Configuration hardening, CIS and STIG | — | — | ✓ |
| Bahith active discovery | — | — | ✓ |
| PCAP capture | — | — | ✓ |
| PCAP replay | — | — | ✓ |
| Forensic functionality | — | — | ✓ |
| Add-on — orderable with any edition | |||
| Healthcare and IoMT intelligence | Add-on | Add-on | Add-on |
The add-on is the clinical lens over the same collected data: medical device context, the clinical cybersecurity view, device recall awareness and the IEC 80001 dashboard. It changes how assets are interpreted and reported, not how they are discovered.
Healthcare overview, clinical anatomy, medical cybersecurity and FDA recall views, plus the IEC 80001 compliance dashboard. Clinical context is derived from traffic the platform already sees, so no additional collection is required and nothing is transmitted onto a clinical network.
As a line item alongside any edition: Foundation, Protect or Enterprise. It is named explicitly on the licence. Framework reporting against IEC 80001 appears with the add-on; the wider compliance framework set is an Enterprise capability.
Choosing the edition underneath the add-on. Foundation plus the add-on suits a hospital that needs a clinical device inventory and context first. Protect plus the add-on adds detection and investigation on clinical networks. Enterprise plus the add-on is the full picture, and is the combination to quote when the customer needs IEC 80001 alongside the other frameworks, device risk scoring, or active discovery of clinical equipment that stays silent on the network.
Capacity is sold independently of edition. Any edition can be bought at the entry capacity and grown without changing edition, and changing capacity never changes which capabilities are licensed.
| Dimension | How it is licensed |
|---|---|
| Monitored assets | Sold in bands of 1,000. Every edition starts at a 1,000-asset base and is extended in further 1,000-asset bands. |
| Sensors | Unlimited on every commercial edition. Multi-site and distributed deployments add sensors without a licence change. |
| Term | Subscription term with a grace period, both set on the licence at issue. |
| Licence types | Commercial, trial, NFR, proof of concept and internal. Non-commercial types carry the same edition structure, so an evaluation behaves exactly as the purchased edition will. |
Sensors are never the thing that limits a deployment. Placement is what determines what WireTrace sees, and a licence that charged per sensor would push customers towards seeing less of their own network. Capacity is counted in monitored assets only.
Each licence is bound to the platform's hardware fingerprint and signed by WireTrace. The platform verifies the signature and the binding locally, so no connectivity to WireTrace is required to run a licensed deployment, including in air-gapped environments.
Every licence states its edition, its licensed capabilities, the add-on where present, the asset band and the term. A licence certificate is issued alongside the licence file as a readable record for procurement to check against the purchase order.
What an edition does not do. An edition never silently grants more than it names. Capabilities outside the licensed edition are not hidden-but-reachable; the platform declines them. This matters for evaluations: a proof of concept issued as Protect behaves as Protect, so what a customer tests is what they will buy.
Tell us the asset count, the sites in scope and whether clinical or medical equipment is present, and we will come back with the edition, the add-on decision and the capacity band in one page you can put into procurement.
Book a demo at wiretrace.io/request-demo or email [email protected]