AppSec tools are usually priced per developer, per repository, per scan or asset, or by some bundle of these. None is cheaper in general. The right model is the one whose unit grows slowest in your organisation, so model each option with your own headcount, repositories and scan volume over three years.
The common models
Per developer. You pay for each committing user. It is predictable if headcount is stable and awkward if you have many occasional contributors, contractors or bots. Ask how a developer is counted: seats assigned, or contributors in a period.
Per repository. Cost follows the number of projects. It suits a few large repositories and punishes microservice and monorepo choices differently. Ask what counts as a repository and whether forks and archived projects count.
Per scan or usage. You pay for work done. It can be efficient for small teams and surprising for busy pipelines. Ask for a cap or alert.
Per asset or application. Cost follows inventory. Check how assets are defined and counted.
Platform bundle. Several capabilities for one fee. It simplifies purchasing, but you may pay for modules you do not use.
Build a simple model
- List your developers, repositories and monthly scan counts today.
- Estimate growth for each over three years, with a low and a high case.
- For each vendor, compute the cost under both cases using their unit definitions.
- Add integration and operating time.
The result is often different from the sticker comparison. A model that looks cheap at today's scale can overtake another at double the size.
Terms that change the real cost
- Minimum commitments and true-up rules.
- Overage rates.
- Renewal caps.
- Charges for extra environments, support tiers or data retention.
- Whether free scanning for open source or evaluation is allowed.
Avoid these traps
Do not compare per developer against per repository using one team's numbers and assume it generalises. Do not forget contractors. Do not ignore the cost of the people who triage findings: a cheaper tool that doubles noise can cost more.
When a free tier is the answer
If a free tool meets your needs now, record the trigger that would make you move, such as a repository count or an audit date, so the decision is made on a plan and not in a panic.
Where Safeguard fits: the free scan at https://gold.safeguard.sh/scan needs no purchase, and for platform terms (SBOM and dependency scanning, policies and gates, compliance and evidence automation) ask the team for current pricing rather than relying on third party summaries.
Quick check
Which pricing model is safest for a growing team?
The one whose unit grows slowest for you, with a renewal cap. Model it before choosing.
Should we negotiate usage caps?
Yes. A cap or alert avoids bill surprises from a busy pipeline.
Last reviewed: 19 October 2026.
