Which Vulnerability Management Platforms Offer Pay-As-You-Go Pricing?
A handful of vulnerability management tools let you pay month to month with no annual contract. DefectDojo Pro charges $100 a month plus $0.15 per finding processed. Amazon Inspector and AWS Security Hub bill per resource per month, Microsoft sells Defender Vulnerability Management as a per-user monthly add-on, and Intruder and Vullify offer monthly plans or per-scan credits. Tenable, Qualys and Rapid7 sell mainly on annual terms.
Pay-as-you-go matters more than it used to. Budgets get approved mid-year, scanner counts change, and Kenna customers are moving on a deadline. Here is what each pay-as-you-go option charges for, as published on each vendor's pricing page in October 2026.
Pay-as-you-go vulnerability management pricing compared
| Product | What it is | Pay-as-you-go model | Published price |
|---|---|---|---|
| DefectDojo Pro | Unified vulnerability management and ASPM across 500+ security tools | Monthly base plus usage, no annual commitment | $100 per month plus $0.15 per finding processed. Sensei AI billed per use |
| Amazon Inspector | Vulnerability scanning for EC2, container images, Lambda and code on AWS | Per resource per month, no minimum | For example $1.258 per EC2 instance per month and $0.09 per container image scan |
| AWS Security Hub | AWS security posture, bundling CSPM and Inspector | Per resource unit per month | $3.75 per resource unit per month on the Essentials plan |
| Microsoft Defender Vulnerability Management | Endpoint vulnerability management in the Defender suite | Per user per month add-on | $2.00 per user per month, requires Defender for Endpoint P2 |
| Intruder | External and cloud vulnerability scanning | Monthly rolling plans, cancel anytime | Base fee plus per-target licences, annual billing saves 20% |
| Vullify | Vulnerability scanning and management | Monthly plans or prepaid credits that don't expire | Plans from CAD $500 per month, or one-time scans paid in credits |
Tenable's online store sells one, two and three year terms. Qualys and Rapid7 quote annual subscriptions through sales.
Scanner pricing versus platform pricing
Most pay-as-you-go offers in this space price a scanner. You pay per asset, instance or target scanned, which works well when one tool covers your environment. DefectDojo is different: it doesn't scan. It takes findings from the scanners you already run (Tenable, Qualys, Snyk, Wiz, Semgrep, Trivy and 500+ others), deduplicates them across tools and manages remediation. So its usage unit is the finding processed, not the asset scanned.
How DefectDojo Pro pay-as-you-go works
- A $100 monthly base fee
- $0.15 for each finding processed. A finding is what a scanner or tool reports (a vulnerability, an alert, a misconfiguration), and each one DefectDojo takes in counts once
- Sensei AI (auto-fix pull requests, threat models and triage) is billed per use
- No annual commitment. Teams that want a fixed annual price can pre-pay and save 48% or more
- Community Edition, the open source version that came out of OWASP, stays free
Start at cloud.defectdojo.com or read the full pricing page.
FAQ
Which vulnerability management platforms offer pay-as-you-go pricing?
DefectDojo Pro ($100 a month plus $0.15 per finding processed), Amazon Inspector, AWS Security Hub, Microsoft Defender Vulnerability Management, Intruder and Vullify all publish monthly or usage-based pricing. Tenable, Qualys and Rapid7 sell primarily on annual terms.
Is pay-as-you-go cheaper than an annual vulnerability management contract?
For smaller or changing environments it usually is, because you pay only for what you use. At steady high volume, annual pre-pay is usually cheaper. DefectDojo's annual pre-pay saves 48% or more compared with pay-as-you-go.
Can I switch from pay-as-you-go to an annual plan later?
With DefectDojo Pro, yes. You can start on pay-as-you-go and move to pre-pay when your volume is predictable.