Skip to content


What is the difference between a module and an add-on?

Module: A standalone cybersecurity feature, for example, Email Security.

Add-on: An optional component that can be added to any purchase for a fee but is not required to obtain full functionality from the module itself and is dependent on the module for which it is an add-on.

For further information, see Modules and add-ons.

Workspace invitation links are valid for seven days.

Why does my console not work following a Coro update?

If your Coro console experiences functionality issues following a Coro update, it may be necessary to clear your browser cache. Please refer to the instructions below for clearing the cache in your specific browser:

As a Coro SOC client, if my organization is targeted by a cyberattack, how does Coro notify me?

The information you provided on your Coro SOE engagement form determines the notification method. Coro contacts the designated point of contact via email.

Is Coro MITRE certified?

No, Coro is not MITRE certified.

Can I still use Coro after my free trial has expired?

No. When a Trial ends and there is no active Subscription, the workspace reverts to an Inactive state.

When a workspace is in an Inactive state:

  • No data is monitored, and no tickets are generated.

  • Module independent assets remain associated with the workspace, for example, users, cloud apps, and devices. This ensures efficient onboarding if the workspace subscription is renewed.

  • Module dependent assets, for example. infrastructure required to keep a particular module feature functioning are discarded.

For more information, see Coro workspace trial state.

See also:

Is the Coro platform available in languages other than English?

Currently, the Coro platform is only available in English.

What percentage of my day-to-day security operations can Coro automate?

Coro automatically handles at least 95% of your daily security tasks by automating best practices and employing various AI techniques to automatically classify and resolve tickets. This means you only need to devote 5% of your current time to daily security operations management.

How do I sign-up for a free Coro trial?

Coro workspaces are based on a subscription model. To get started, visit

For further information on Coro workspace subscriptions, see Subscriptions.

Where can I view the SE labs analysis report?

You can view the SE labs analysis report by visiting Reports and selecting GET THE REPORT.

Coro report

Can Coro be provided to clients in other countries?

Depending on the country, using Coro effectively requires local language support as well as language and country-specific data governance modules. Currently, the Coro platform is only available in English.

Is it safe to use the trial version in a production environment without impacting other apps?

The Coro Security Platform utilizes a Bitdefender Software Development Kit (SDK). To avoid conflicts that may interfere with the installation of the Coro Agent, Bitdefender and any other antivirus software must be uninstalled prior to installing the Coro Agent.

After the Coro Agent is installed, you can safely use a Coro workspace in Trial state. To begin a workspace trial, an initial onboarding event trigger must be performed in order to transition the workspace from New to Trial state.

You have access to the following modules:

  • Cloud Security

  • Endpoint Security

  • Email Security

  • Endpoint Detection and Response (EDR)

For further information, see Coro workspace states.

How do I contact technical support?

Contact support at:

How do I delete a Coro workspace?

Coro workspaces can be deleted by the Coro support team. Contact support at:

How do I re-open tickets in bulk from the Ticket Log?

To re-open tickets in bulk from the Ticket Log:

  1. Click the Closed filter option to filter closed tickets.

  2. Click the checkbox next to each individual ticket:

    Select closed tickets

    Alternatively, click the checkbox adjacent to ACTIONS to select all closed tickets.

    Select all closed tickets

  3. Click ACTIONS.

  4. Click Re-open tickets:

    Re-open tickets

When is a workspace classified as Inactive?

A workspace is classified as Inactive when either its Trial or Subscription state expires. When a Trial ends and there is no active Subscription, the workspace reverts to an Inactive state. If additional devices are activated within a trial workspace prior to the trial's expiration date, the workspace reverts to an Inactive state after 30 days.

How does the Coro Trial state work?

A workspace moves into a Trial state when it is currently in a New state and an onboarding event trigger occurs for the first time, for example, a cloud app is connected, a device is activated, or an inbound gateway is set up.

During the trial period data is monitored and tickets generated for both protected and unprotected users. Unlike previously, all tickets will be presented in the Actionboard. Data is monitored and tickets are generated for all devices.

After activation, a workspace remains in a Trial state for a period of 30 days if no endpoint devices are activated.

When an endpoint device is activated within the workspace, the workspace Trial state is extended for an additional 30 days.

For further information, see Coro workspace lifecycle.