RMM Platform Pricing Models and Feature Coverage

This post documents the pricing models used by major RMM platforms, what each platform's base price includes, what is sold as an add-on, and the published feature coverage of ET Ducky.

Pricing models

Per-device pricing is used by NinjaOne, ConnectWise RMM, Datto RMM, and Kaseya VSA. Costs scale linearly with fleet size, with volume discounts at roughly 100, 500, and 1,000+ endpoints. These vendors do not publish their rates publicly; quotes require a sales conversation.

Per-technician pricing is used by Atera and Syncro. Pricing is per seat regardless of endpoint count. SuperOps.ai uses the same model with published pricing around $119 to $199 per technician per month. Kaseya offers Kaseya 365, a per-technician bundle packaging VSA with EDR, backup, and other modules at roughly $299 to $399 per technician per month.

Hybrid model. ET Ducky uses a flat monthly subscription that covers a base query allowance and 20 managed agent seats per subscribed user. Additional agents are $5 per month on shared infrastructure, dropping to $4, $3, and $2 at higher tiers. Data retention is a separate per-agent add-on.

What Each Platform Includes and What Costs Extra

Feature Matrix

The matrix below shows what's included in each platform's standard pricing versus what requires an add-on or a higher subscription level. An add-on means the feature exists but costs extra. A tier means it's included only above a certain plan. For ET Ducky, every feature is available at all paid tiers.

ET Ducky Data Retention Tiers

Data retention controls how long cloud-stored ETW events, health metrics, correlation analyses, and session data are kept before automatic purge. The 14-day default is free for all organizations, and add-on tiers are billed per managed agent per month across the fleet. Annual billing saves 15%.

Data sources

Standard RMM agents poll WMI health counters at 30 to 60 second intervals and forward Event Log entries. WMI returns sampled snapshots at the poll interval. Event Logs record what applications choose to log.

Event Tracing for Windows (ETW) is the kernel's event subscription infrastructure. A Windows server under moderate load emits 10,000 to 100,000 ETW events per second. ET Ducky processes this stream on the agent, correlates related events into summary records, strips PII locally, and reports a 99.6% reduction in bandwidth compared to raw ETW.

An ET Ducky correlation summary for a CPU anomaly contains the contributing kernel-level events. Example output:

"CPU exceeded 90% on SERVER-12 because the .NET garbage collector ran a full Gen 2 collection lasting 4.2 seconds, triggered by WorkerService.exe exceeding its 2 GB heap limit."

The other platforms in this comparison do not subscribe to ETW providers.

ET Ducky feature coverage

Auto-generated KB documentation

The agent recorder captures the ETW event stream while an admin performs a procedure, uses an AI description of the goal to filter background events, and produces a Markdown KB article with numbered steps. Screenshots taken with a global hotkey (default Ctrl+Shift+S) are embedded inline. IT Glue (Kaseya) and IT Boost (ConnectWise) are separate documentation products that require manual authoring.

Security posture in heartbeat

The heartbeat includes 35+ metrics, among them a security snapshot. The snapshot covers Defender real-time protection status and definition age, Windows Firewall state, BitLocker encryption, UAC configuration, and Secure Boot state. The metrics are queryable in the Data Explorer and available to Smart Reports. NinjaOne and Kaseya bill separately for security dashboards. Atera requires a Bitdefender add-on. Syncro does not include native posture reporting.

Behavioral detection

ET Ducky does not include a signature-based AV scanner. The agent includes an always-on behavioral monitor that runs on a separate ETW kernel session from diagnostic collection. The monitor watches for file encryption sweeps, shadow copy deletion, backup service sabotage, and suspicious process ancestry chains. When a pattern crosses a High or Critical confidence threshold, the agent applies network isolation by adding Windows Firewall rules that block all traffic except to etducky.com. De-isolation requires dual approval: a dashboard operator initiates the request and the physically logged-in user must confirm via a desktop popup.

Cross-platform agent

The agent ships as an MSI for Windows and as .deb, .rpm, or universal .run for Linux. Enrollment is one command on either OS. The dashboard treats both operating systems uniformly: the same agent table, metrics, query language, AI live sessions, and behavioral rules. Among the seven platforms compared, ConnectWise and Kaseya offer Linux support; neither runs the same agent and diagnostic stack across operating systems.

The behavioral rule engine runs on both operating systems against the kernel-event stream (ETW on Windows, eBPF on Linux). Five rules ship today: suspicious exec chains, mass file access (the ransomware pattern), a reverse-shell heuristic, privilege escalation from a non-interactive parent, and unusual outbound traffic from a system daemon. Detections appear in the dashboard with the triggering events attached as evidence.

The Linux agent runs unprivileged as the etducky user under a hardened systemd unit. Privileged actions follow an operator-driven model: when the AI generates a sudo command, the dashboard prompts the responsible operator for the host password at the moment of the action. Each elevation produces an immutable audit row covering operator identity, source IP, command summary, and exit code.

On-demand event upload

Aggregate health metrics ride the heartbeat. Inflection-bracketed evidence ships alongside a metric anomaly. Behavioral detections ship with their triggering events. The full kernel-event stream is not uploaded by default. When an operator opens a live session or issues an explicit collection command, a reference-counted upload gate opens for the duration of that work. The full kernel-event stream ships while the gate is open and stops when it closes.

Anomaly-triggered diagnostics

The agent runs an inflection detector after every heartbeat. When a metric changes significantly (for example CPU jumping 25 points, available memory dropping 500 MB, disk queue spiking from 1 to 10+, or network throughput up 10x), the agent flushes the buffered ETW event window to the cloud. The events from the anomaly window are submitted for correlation, and the cloud marks the heartbeat row with the detected inflections.

Distribution Servers: governed LAN file distribution

Most RMMs include a way to cut WAN bandwidth by caching deployment payloads on the local network. NinjaOne offers patch caching, where a designated Windows device serves downloaded patches to its neighbors. Datto RMM has a component cache (a nominated device stores downloaded components and serves the site over port 13229). N-able N-central uses a patch/probe cache via its Patch Repository Service, including caching patches and agent files at remote sites. ConnectWise Automate can cache Windows Update files to a per-location network share. These are effective, and they are table stakes — the bandwidth-saving idea is not unique to any one platform.

What they have in common is also their limit: each caches the RMM's own artifacts (patches, software components, agent installers) as an internal optimization. None is a user-facing file share — you can't map it as a drive, put arbitrary files in it, or grant a specific person read-only access to one folder.

ET Ducky Distribution Servers are a different category. An agent becomes a LAN-local hub that serves a mountable file share over WebDAV/HTTPS for arbitrary organization files, governed from the cloud:

• Per-path, per-principal access control — grant list/read/write/delete to everyone, a role, or one user, on a path or glob; rules are re-evaluated live, so a change reaches existing mounts without re-issuing anything.
• Opaque, revocable mount keys as the credential — salted-hashed at rest, scoped to the grant, and cut off instantly on revoke.
• Data residency by design — the cloud is only the control plane (catalog, access rules, audit). File bytes move directly between the client and the hub on the customer's own infrastructure and never traverse the ET Ducky cloud.
• LAN today, optional WAN reach — off-LAN devices can mount the same share through customer-side reachability (STUN/UPnP/manual port-forward), with certificate distribution handled from the dashboard.

Summary

The calculator above produces per-platform monthly cost estimates for a given endpoint count and technician count. Per-device platforms scale linearly with endpoints. Per-technician platforms are flat per seat regardless of endpoints. ET Ducky's hybrid model combines a per-subscriber fee with per-agent overage and an optional per-agent retention add-on.

Among the platforms compared, ET Ducky is the only one that subscribes to ETW providers and ships the additional ETW-derived capabilities (KB documentation generation, behavioral detection, anomaly-triggered diagnostics).