Who Can Buy From Us Today, Where We Are Headed, and What Is Not True Yet
We spent October 12 auditing ourselves against the current rules, not the ones we remembered. CMMC changed in July, FedRAMP changed in August, StateRAMP is now GovRAMP, and the federal micro-purchase threshold moved to $15,000. Our own notes had drifted too: we had been calling ourselves "SAM registered" when SAM.gov says we hold a Unique Entity ID and nothing more. So here is the plain version, for anyone who wants to buy threat intelligence from us: who can do it today, who can do it soon, and the claims we are not making.
Today: three doors that are already open
Commercial buyers can subscribe now. Pro is $99 a month or $948 a year, and Enterprise is $995 a month or $9,950 a year, on the pricing page at analytics.dugganusa.com/pricing. A free tier gives 10 queries a day. If your security team needs evidence before buying, we can share our system security plan, 19 written policies, quarterly access reviews, our MFA coverage evidence and a CycloneDX software bill of materials. We do not have a SOC 2 report, so we answer your questionnaire with evidence instead of a certificate.
Federal buyers with a government purchase card can buy now. The micro-purchase threshold is $15,000 under FAR 2.101 (FAC 2026-01, effective March 13, 2026). FAR 4.1102(a)(1) exempts purchases under that threshold from the SAM registration requirement when the purchase card is both the purchasing and the payment method, not just the payment method. Both of our annual tiers sit under $15,000. One thing that is your call, not ours: whether your agency treats a threat intelligence feed as a cloud service that needs FedRAMP. Ask your ISSO before you swipe.
Prime contractors can bring us in as a subcontractor now. Subawards need a Unique Entity ID, and ours is TP9FY7262K87. Whatever else a prime requires of its subs is between us and the prime.
What we take off the operator's plate
The person running the firewall should not have to run a procurement too. Here is what we remove from that person's day.
Nothing to install, so nothing to STIG. We ship no agent, no appliance, no plugin and no software of any kind onto your systems. Your firewall, DNS filter or SIEM, which you have already hardened to your STIG or benchmark, makes an outbound HTTPS request and reads a text file. There is no new component to harden, no new inbound port, and no new package inside your accreditation boundary.
No shared secrets. You hold an API key we issued; we hold none of your credentials, and we never touch your network. If that key ever leaks, it gets rotated or revoked and nothing of yours is exposed, because nothing of yours was ever shared.
No sales call and no contract to negotiate. Registration, payment and keys are self-serve, and the free tier lets you test before anyone spends money.
No procurement paperwork for small federal buys. Under $15,000 on a purchase card, nobody waits on our SAM registration.
No integration project. The feed comes as plain CSV lists (ips.csv, domains.csv, hashes.csv) and as STIX, so a firewall, DNS filter or SIEM that can pull a URL can use it. OPNsense IP, Suricata and DNS lists are already live.
No guessing about how much to trust a row. Every indicator carries a confidence score, and min_confidence is your dial: start loose, tighten it, and our default floor does not decide your risk tolerance for you.
No hunting for where an indicator came from. Each campaign we feed carries its own source tag, so you can search it, audit it or drop it as one unit, and we credit the research that found it.
No finding out about our mistakes the hard way. When we are wrong, we publish the correction with the original claim next to it.
Weeks: what is in progress
Federal prime contracts need an active SAM registration. We started the "All Awards" registration on October 12. Four of its twelve sections are done and the IRS taxpayer check has been submitted, which SAM says takes two to five days. The CAGE code, which the Defense Logistics Agency assigns during validation, comes out of the same process. The registration is waiting on one thing: the company's business bank account details for payment.
We also closed a gap of our own. Every account that can sign in to our Microsoft tenant is now challenged for MFA on every sign-in. The one account that was not covered can no longer sign in at all. A policy that requires MFA for every user, including any account added later, is running in report-only mode until October 19 and is enforced after that.
Months: where we are headed
Defense work that involves federal contract information needs a CMMC Level 1 self-assessment posted in the DoD's SPRS system. As of September 2026 the rules allow self-assessment at Levels 1 and 2 and bind NIST SP 800-171 Revision 2, not Revision 3. We can post Level 1 once SAM gives us a CAGE code. We hold no controlled unclassified information, and we are not pursuing Level 2.
Some states require GovRAMP, the program formerly called StateRAMP, for cloud services. We are targeting a GovRAMP Snapshot by December 31. After that comes third-party assurance: a penetration test, then a SOC 2 Type I.
What we are not claiming
We do not have a SOC 2 report. We are not FedRAMP authorized, we have no GovRAMP status, and we hold no CMMC certification. Our SAM registration is not active yet. Until October 12, an internal note of ours described a SOC 1 self-score as SOC 2 progress. We corrected it the same day, along with seventeen stale references across our compliance documents.
The reason to say all this in public is the same reason we publish our corrections. A buyer who finds out later that a vendor's badge was not real stops trusting everything else that vendor told them. So this page will be updated when something on it changes, not before.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=who-can-buy-from-us-today-where-we-are-headed
Comments