LightEDR's free tier: what five agents get you

Most EDR vendors offer a free tier that amounts to a sandboxed demo environment. You get a dashboard with canned data, a walkthrough of the interface, and a sales call booked automatically when you sign up. The point is the pitch, not the evaluation.

LightEDR’s free tier works differently. You get up to five agents deployed on real machines, with the same detection capabilities and the same Zero Trust scoring as a paid account. This post explains exactly what that covers - and what it does not.

What five agents actually includes

Full MITRE ATT&CK behavioural detection. Every agent in the free tier ships with the same real-time behavioural rules as paid deployments. If a process spawns an unusual child, mimics a known credential dumping pattern, or makes suspicious outbound connections, it alerts. There is no separate “free detection pack” with a smaller rule set.

Zero Trust scoring. Each agent is enrolled with a unique device certificate and scored continuously across five signals - certificate validity, behavioural history, network posture, session health, and endpoint posture. Endpoints sit at one of four trust levels: FULL, REDUCED, QUARANTINE, or DENIED. The policy decision point (PDP) uses those signals to gate access. This is not a demo feature switched off below a paid threshold.

90-day telemetry retention. Every event your five agents generate is stored for 90 days. That means if you do catch something, you have three months of process, network, and file telemetry to investigate. Most EDR vendors tier their retention - shorter lookback on lower plans. LightEDR does not.

One-click containment. If an endpoint does something you do not like, you can isolate it from the dashboard with a single click. The agent blocks all network traffic except comms back to the LightEDR control plane, so you retain visibility and control without losing the connection. This is available on free accounts.

AI-assisted alert triage. LightEDR integrates with five LLM providers - Anthropic, OpenAI, Azure OpenAI, Gemini, and Ollama. When a high or critical alert fires, the platform sends the event context to your configured provider and returns an explanation plus suggested triage steps. It runs as a fire-and-forget async task and never blocks alert ingestion. You bring your own API key. The free tier does not restrict this feature - if you configure a provider, it works.

Who the free tier is designed for

Security teams evaluating before they buy. Five agents is enough to cover a small staging environment or a developer workstation segment. You get real alerts on real machines, not a synthetic walkthrough.

MSSPs onboarding a new client. Some MSSP operators use the free tier to run a proof-of-concept on a client’s critical endpoints before quoting a full rollout. Because the free tier has the same multi-tenant control plane, the transition to a paid account does not require any re-deployment - it is a billing change, not an architecture change.

Small teams who need a permanent free footprint. If you are running a five-person engineering team and your endpoint security budget is zero, five agents covers your entire fleet at no cost. No expiry. No trial period.

What changes when you go paid

One thing: agent count.

The free tier is capped at five agents. Everything else - detection depth, telemetry retention, Zero Trust features, AI triage, containment, the API - is identical. When your fleet grows beyond five, the cost is £5 per agent per month. There are no feature tiers, no “Starter” vs “Pro” capability splits, and no annual contract required.

This is a deliberate design choice. We think the product should earn the upgrade on merit - five agents showing you something useful - rather than by withholding features until you pay.

The limits worth knowing

Five agents is a real limit. If you need six, you need a paid account. There is no workaround.

The AI triage feature requires your own API key for whichever provider you use. LightEDR does not bundle LLM credits. If you want AI-assisted explanations without a cloud provider, Ollama runs locally and the integration supports it.

There is currently no phone or email support on the free tier. Documentation is available, and the product is designed to be self-serve. If you run into something the docs do not cover, the contact form reaches the team directly.

---

If you want to see what the free tier looks like in practice, you can sign up at no cost and have your first agent enrolled in under ten minutes.