VRadar's answer

Two things, and both are structural rather than marketing.

There is no black-box agent. What runs on your machines is standard open-source tooling, Wazuh and Suricata, which you or your IT provider can read, verify, and uninstall yourself. The proprietary part is the AI backend those tools report into. Most vendors ask a small business to install a closed binary with deep system access and simply trust it. We don't think you should have to.

There is no minimum device count. Most SMB-focused security vendors start at 50 or 100 endpoints, which quietly excludes the ten-person firm that is actually getting breached. VRadar starts at one device.

The practical effect: about 15 minutes per device from signup to protected, and you can verify exactly what you installed.

VRadar's answer

Honest answer: often you shouldn't. If you already have 100+ endpoints and a security team, Huntress or Arctic Wolf are mature, well-staffed options and we are not going to pretend otherwise.

VRadar is worth a look in three situations:

• You're too small for the others. Many SMB security vendors have a 50 or 100 device minimum. We have none. One device is a valid deployment.
• You want to verify what you're installing. The endpoint side is Wazuh and Suricata, both open source. You can audit them, and remove them, without asking us. The AI backend is the proprietary part.
• Nobody on staff speaks security. Alerts come back in plain language with a recommended action, not as a SIEM console someone has to learn.

Where we are genuinely weaker, so you can weigh it properly: we are early and small. Our security testing is an internal automated review, not a third-party pentest. Our cloud posture is a CSA STAR Level 1 self-assessment. We are not an EDR with rollback, and we will not stop a determined, targeted attacker. If any of those are dealbreakers for your risk profile, that is a reasonable call to make.

The free tier runs 3 months on up to 3 devices with no card, so the cheapest way to judge is to point it at one real machine and see what it catches.

VRadar's answer

Two groups.

Small and mid-sized businesses with no in-house IT or security team, roughly 5 to 50 devices. Accounting firms, clinics, law offices, agencies, shops, small manufacturers, early startups. The pattern is always the same: they hold data worth stealing, they are visibly a target, and there is nobody whose actual job is to watch for it. Security usually falls to whoever is most comfortable with computers.

MSPs and IT providers who look after those businesses. They often have clients too small to fit a 50 or 100 seat minimum, so those clients end up with nothing but antivirus. No minimum means an MSP can cover a three-person client on the same footing as a larger one.

The common thread is not company size, it's the absence of anyone who speaks security. That's why alerts are written in plain language with a recommended action rather than as a console someone has to learn.

VRadar's answer

On the endpoint: Wazuh and Suricata, both standard open source. We deliberately did not write our own agent. If you want to know exactly what is running on your machines, you can read the source of both projects, and neither of them is ours.

On the backend: a decision layer that is deliberately mostly not a language model. Around 99.6% of decisions are made by deterministic rules and detection logic. The AI is used at the margin, for triage and for turning findings into plain-language explanations, rather than being the thing that decides whether you are under attack. Rules are auditable and repeatable; a model's guess is neither, and security is a bad place for guessing.

A side effect of that design is that inference cost is tiny, on the order of $0.25 per month, which is part of why there is no device minimum to make the economics work.