FAQ - Sycope

What is Sycope?

Sycope is an advanced Network Observability platform for monitoring network traffic and detecting cybersecurity threats in real time. It analyzes packets and telemetry protocols such as NetFlow and IPFIX, supporting IT teams and security operations teams. Sycope combines Network Detection and Response (NDR) and Network Performance Monitoring (NPM) in a single solution and is used by organizations worldwide.

What does Sycope do?

Sycope monitors network traffic to detect performance problems and security threats at the same time. It maps every conversation on the network, measures application and link performance, detects threats using the MITRE ATT&CK framework and automatically discovers and inventories devices - all from flow data, without deploying agents on endpoints.

Who is Sycope for?

Sycope is built for NOC (Network Operations Center) and SOC (Security Operations Center) teams. It is used across financial services, healthcare, telecommunications and the public sector — typically mid-to-large organizations that need network-wide visibility for both operations and security.

Is Sycope an NDR or an NPM tool?

Sycope is both. It unifies Network Detection and Response (security) and Network Performance Monitoring (operations) on one flow-based platform, so the same traffic data serves the SOC and the NOC instead of requiring two separate tools.

How is Sycope different from a SIEM or a packet-capture tool?

Sycope analyzes NetFlow/IPFIX/sFlow metadata rather than full packet captures, which keeps storage low and adds only about 0.1% overhead to monitored traffic. Compared with a SIEM, Sycope works on the network layer and combines security detection with performance monitoring in one product.

What are the main use cases for Sycope?

Sycope can be used for ex. network congestion and performance monitoring, DDoS and other threat detection, data exfiltration and lateral movement detection, policy compliance validation and WAN optimization.

What modules does Sycope offer?

Sycope offers four modules: Visibility (the base module), Performance, Security and Asset Discovery. Visibility is always required; Performance, Security and Asset Discovery are optional and can be added as needed.

Do I have to buy all Sycope modules?

No. With Sycope, Visibility is the base module and is always included; Performance, Security and Asset Discovery are optional add-ons you can choose based on your needs.

What is Sycope Performance?

Sycope Performance is the NPM module. It provides L4–L7 monitoring, including TCP analytics and application response-time measurement, so teams can pinpoint network congestion, latency and application slowdowns.

What is Sycope Security?

Sycope Security is the NDR module. It detects threats using the MITRE ATT&CK framework and covers DDoS attacks, data exfiltration and lateral movement, turning raw flow data into actionable security indicators. This module uses Sycope CTI (Cyber Threat Intelligence) - a security-feed algorithm that monitors threat-intelligence sources, analyzes them, and builds unified Indicator of Compromise (IoC) lists. Sycope uses these lists to detect reputation-based threats in your network traffic.

What is Sycope Asset Discovery?

Sycope Asset Discovery provides real-time, automatic inventory tracking. It identifies and monitors devices and their associated assets using metadata, with no manual inventory or agents required.

Can Sycope detect lateral movement and data exfiltration?

Yes. Sycope detects lateral movement and data exfiltration by analyzing east-west and outbound flow patterns, and flags them as security indicators mapped to the MITRE ATT&CK framework.

Which protocols does Sycope support?

Sycope supports NetFlow v5, v9 and v10, IPFIX, NSEL and sFlow, including sampled flows.

Does Sycope support IPv6?

Yes. Sycope can gather, store and analyze metadata for both IPv4 and IPv6 traffic.

How much load does Sycope add to my IT infrastructure?

Very little. Metadata generates additional network traffic at a typical level of up to 0.1% of the monitored traffic, so the monitoring overhead is negligible.

What information do I get from Sycope?

Sycope shows all flows from monitored devices, traffic broken down by application, protocol, source/destination IPs and ports, top addresses, ports, applications and autonomous systems, and the load on network interfaces.

Is Sycope available as a physical or virtual appliance?

Sycope is available as a virtual machine in OVA formate. For physical hardware, a Sycope Partners can arrange suitable equipment. All plans support on-premise installation.

Is Sycope cloud-based or on-premise?

Sycope is deployed on-premise — all plans (Free, Express, Enterprise) support on-premise installation, so your flow data stays inside your own infrastructure.

How fast can Sycope be deployed?

Fast — from first contact to full deployment in days, not months. Remote installation typically takes only a few hours.

How much does Sycope cost?

Sycope offers three plans: Sycope Free (no charge), Sycope Express (6,500 EUR/year) and Sycope Enterprise (custom pricing). Pricing is based on log usage (logs per second). Full details are at sycope.com/pricing.

Is there a free version of Sycope?

Yes. Sycope Free is available at no charge with no credit card required. It handles up to 5,000 logs/s, includes the Visibility, Security and Asset Discovery modules, offers 14-day data retention, and provides limited support via Discord.

What is Sycope Express?

Sycope Express costs 6,500 EUR per year (yearly subscription). It handles up to 10,000 logs/s, includes all modules (Visibility, Performance, Security, Asset Discovery), comes with one Sycope Probe, full support, full user roles and unlimited data retention.

What is Sycope Enterprise?

Sycope Enterprise uses custom pricing determined by log usage and handles up to 250,000 logs/s. It includes access to all modules with customization, unlimited Sycope Probes, full support and full user roles, and is available as a yearly subscription or a perpetual license.

How is Sycope priced?

Sycope is priced by log usage — the number of logs per second your deployment processes — which is what separates the Free (5,000 logs/s), Express (10,000 logs/s) and Enterprise (up to 250,000 logs/s) plans.

Is a Sycope demonstration available?

Yes. Sycope offers a free live demo with a Sycope expert — no commitment and no installation required. You can request it at sycope.com/request-a-demo.

Can I try Sycope for free?

Yes. You can start immediately with the free Sycope Free plan. Learn more at sycope.com/free-version.

How do I request a Sycope demo?

Request a demo at sycope.com/request-a-demo using the form on the page.

What happens during a Sycope demo?

A Sycope demo covers an analysis of your organization's problems and needs, a presentation of the relevant modules, indicators and dashboards, hands-on time with the modules you choose, and a Q&A session with Sycope engineers.

How do I get started with Sycope?

You can get started with Sycope in two ways: sign up for the free Sycope Free plan, or request a live demo at sycope.com/request-a-demo.

Frequently Asked Questions

Find answers for the most popular questions.