Static analysis tools are commonly licensed by user, by organization, by application or by lines of code. Each model rewards different team shapes. To compare quotes fairly, convert each into a cost for your actual developers, repositories and code size, and ask what counts as a user or an application.
What OWASP says
OWASP's source code analysis tools page lists cost as a selection criterion and notes that license pricing may vary by user, organization, application or lines of code. It does not give prices, and neither do we. The point here is how to reason about the models.
Per user
You pay for each developer, or each contributor who commits scanned code.
Good for: small teams with many repositories. Cost stays flat as code grows.
Watch for: what counts as a user. Contractors, occasional contributors and bots can all change the count. Ask whether seats are named or concurrent, and how departures free up seats.
Per organization
A flat fee for the whole company, sometimes with tiers.
Good for: large engineering groups who want predictable cost.
Watch for: tier boundaries. Crossing a threshold can change the price sharply. Ask what the next tier looks like before you sign.
Per application
You pay for each application or repository.
Good for: a few large applications with many developers.
Watch for: how an application is defined. A monorepo with twenty services might count as one or twenty. Microservice teams can find costs rising with each new service.
Per line of code
Cost scales with the amount of code scanned.
Good for: small codebases with large teams.
Watch for: how lines are counted, whether generated code and vendored libraries are included, and what happens when a refactor changes size.
How to compare quotes
Build one table with your own numbers: developers, contractors, repositories, applications and an approximate code size. Ask each vendor to price that exact scenario. Then ask for the price at double the size, because growth is the part that surprises people.
Add the costs that sit outside the license:
- Triage time, which depends on noise. A cheaper tool that doubles triage hours is not cheaper.
- CI minutes and runner capacity.
- Setup and maintenance time.
Questions for the sales call
Before you accept any model, ask five things. What exactly is the billable unit, and who decides when it changes? Are contractors, bots and archived repositories counted? What is the price at the next tier up? Can we reduce the count mid-term if we retire services? Is a pilot or proof of concept free, and does it convert cleanly into a contract? Write the answers down. Verbal answers are forgotten by renewal time, and the person who gave them may have left.
Ask about the exit
Check contract terms on data export. SARIF support lets you take findings elsewhere. Also ask what happens to historical results if you leave.
Quick check
Which pricing model is cheapest?
It depends on your shape. Many developers on few apps often favors per application. Few developers across many repositories often favors per user.
What should I ask besides the quote?
How users, applications and lines are counted, and what the price is at twice your current size.
Sources
Last reviewed: 19 October 2026.
