Skip to main content

Optimal Premium Upgrade Setup

💡 Why Organize Before Upgrading?​

Premium upgrades apply to an entire Organization. You may not want Premium features for all environments—typically only Production needs extended retention, higher quotas, and advanced protection.

By organizing your Security Engines before upgrading, you save costs and keep your infrastructure organized.

Common Multi-Environment Setup​

Most teams have a mix of environments with different security requirements:

🔥 Production Environments​

Needs Premium:

  • Extended alert retention (12 months)
  • Higher alert quotas (millions/month)
  • Organization-wide blocklists
  • CTI API access for SIEM integration
  • Threat Forecast blocklists
  • Multi-seat team access

🧪 Dev / Test / Staging​

Community is sufficient:

  • Basic alert monitoring (500/month)
  • Short retention (2 months)
  • Community blocklists (3k IPs)
  • Individual engine management
  • Single-user access

1️⃣ Create Production Organization​

Create a new organization specifically for your Production environment.

Community accounts get 1 extra organization for free (beyond your Personal Account).

Learn about Organizations →

2️⃣ Organize Your Engines​

  • Personal Account: Keep Dev/Test/Staging engines here (Community tier)
  • Production Org: Transfer Production engines to the new organization

You can transfer engines in two ways:

3️⃣ Upgrade Production Only​

Upgrade only the Production organization to Premium.

Your Dev/Test/Staging environments remain on Community tier with no additional cost.

✅ Alerts reappear in the new organization within minutes

Step-by-Step: Splitting Your Engines​

Option 1: Transfer via Console UI​

Best for: Quick transfers of individual or small batches of engines

  1. Navigate to Security Engines page in Console
  2. Select the engine(s) you want to transfer
  3. Use the Transfer feature to move them to your Production organization
  4. Confirm the transfer

Transfer Feature Documentation →

Option 2: Re-enroll via cscli​

Best for: Bulk transfers, automation, or infrastructure-as-code deployments

# Get enrollment key from your Production organization
# Console → Organizations → Production → Enrollment Keys

# Re-enroll the Security Engine with --overwrite flag
cscli console enroll <ENROLLMENT_KEY> --overwrite

The --overwrite flag forces the engine to move to the new organization, even if already enrolled elsewhere.

Example Organizational Structure​

Before Organizing (All in Personal Account):

  • 10 Production servers (web, API, database)
  • 5 Staging servers
  • 3 Dev laptops

After Organizing:

Personal Account (Community - Free):

  • 5 Staging servers
  • 3 Dev laptops

Production Organization (Premium - Paid):

  • 10 Production servers
  • Full Premium features
  • Team collaboration with 3 seats
  • Extended retention and quotas

Benefits of This Approach​

Cost Optimization

Save 60-80%

Only pay for Premium where you need it. Dev/Test environments remain free on Community tier.

Clear Separation

Zero confusion

Production and non-production environments are cleanly separated, reducing noise and improving security posture visibility.

Flexible Scaling

Grow as needed

Add more organizations later (MSPs can create unlimited orgs). Start simple, expand when required.

No Downtime

Seamless transfer

Alerts reappear in new organization within minutes. No disruption to security monitoring.

When NOT to Separate​

You may want all engines in a single Premium organization if:

  • You need extended retention across all environments for compliance
  • Your team investigates attacks in staging/dev environments regularly
  • You want centralized allowlists and blocklists everywhere
  • You're an MSP managing multiple client environments (use Multi-Organization instead)

Next Steps​

Ready to upgrade?​

  1. Organize your Security Engines across Personal Account and Production Organization
  2. Upgrade the Production organization to Premium
  3. Test Premium features during your trial period (Testing Guide →)