AppSec tools meter usage in units such as developers, repositories, projects, scans or assets. The unit matters less than its definition. Get each term defined in the order form, test how the vendor counts in your pilot, and agree what happens when you cross a limit.
Common units and where they bite
| Unit | Looks simple, but ask |
|---|---|
| Developer or contributor | Active in what period? Do bots, contractors and service accounts count? |
| Repository | Do archived, forked or empty repos count? What about monorepos? |
| Project | Is a project a repo, a branch, a directory, or any scanned target? |
| Scan | Does a failed or cancelled run count? Do scheduled rescans count? |
| Asset | What is an asset: image, host, application, domain? |
| Seat | Named or concurrent? Do read only viewers need a seat? |
A vendor is not hiding anything by using one unit. But a vague unit invites a surprise at the true up.
What to define in writing
- The unit and how it is counted, including edge cases above.
- The measurement window, such as trailing 90 days for active contributors.
- Who has access to the usage report, and how often it updates.
- What happens at the limit: block, warn, or overage billing with notice.
- How to reduce quantity at renewal, and whether unused volume carries over.
- Whether pilot usage counts toward the commitment.
This article gives no prices. Commercial terms belong in your own negotiation.
Test counting in the pilot
Ask the vendor to show the usage page during the pilot. Then check it against your own numbers.
- Add a bot account that commits to a repo. Does the count change?
- Archive a repo. Does it drop out?
- Run a scan twice on the same commit. Is that one scan or two?
- Add a contractor with limited access. Do they take a licence?
Record the answers. They become the basis of the definitions you ask for.
Watch for incentive mismatches
If you pay by scan, teams may cut scan frequency to save budget. If you pay by developer, wide rollout costs more, which discourages adoption. Pick a unit that matches how you want people to behave, then check that the security outcome does not depend on rationing. A policy that says scan on every pull request fits poorly with a unit that charges per scan.
Keep the usage honest
Review actual usage every quarter against what you bought, in the same meeting as your vendor review. See compliance platform year two: what to review at renewal for a similar approach.
Safeguard offers SBOM and dependency scanning with a free scan at gold.safeguard.sh/scan.
Quick check
Should bots count as developers?
Agree this in writing. Many buyers argue that service accounts used by CI are not people and should not take a licence.
What if we exceed the limit mid term?
Define it up front: a warning, a grace period, and a quoted rate or a mid term adjustment, instead of discovering it on an invoice.
Last reviewed: 19 October 2026.
