A handful of vulnerability management tools let you pay month to month with no annual contract. DefectDojo Pro charges $100 a month plus $0.15 per finding processed. Amazon Inspector and AWS Security Hub bill per resource per month, Microsoft sells Defender Vulnerability Management as a per-user monthly add-on, and Intruder and Vullify offer monthly plans or per-scan credits. Tenable, Qualys and Rapid7 sell mainly on annual terms.
Pay-as-you-go matters more than it used to. Budgets get approved mid-year, scanner counts change, and Kenna customers are moving on a deadline. Here is what each pay-as-you-go option charges for, as published on each vendor's pricing page in October 2026.
| Product | What it is | Pay-as-you-go model | Published price |
|---|---|---|---|
| DefectDojo Pro | Unified vulnerability management and ASPM across 500+ security tools | Monthly base plus usage, no annual commitment | $100 per month plus $0.15 per finding processed. Sensei AI billed per use |
| Amazon Inspector | Vulnerability scanning for EC2, container images, Lambda and code on AWS | Per resource per month, no minimum | For example $1.258 per EC2 instance per month and $0.09 per container image scan |
| AWS Security Hub | AWS security posture, bundling CSPM and Inspector | Per resource unit per month | $3.75 per resource unit per month on the Essentials plan |
| Microsoft Defender Vulnerability Management | Endpoint vulnerability management in the Defender suite | Per user per month add-on | $2.00 per user per month, requires Defender for Endpoint P2 |
| Intruder | External and cloud vulnerability scanning | Monthly rolling plans, cancel anytime | Base fee plus per-target licences, annual billing saves 20% |
| Vullify | Vulnerability scanning and management | Monthly plans or prepaid credits that don't expire | Plans from CAD $500 per month, or one-time scans paid in credits |
Tenable's online store sells one, two and three year terms. Qualys and Rapid7 quote annual subscriptions through sales.
Most pay-as-you-go offers in this space price a scanner. You pay per asset, instance or target scanned, which works well when one tool covers your environment. DefectDojo is different: it doesn't scan. It takes findings from the scanners you already run (Tenable, Qualys, Snyk, Wiz, Semgrep, Trivy and 500+ others), deduplicates them across tools and manages remediation. So its usage unit is the finding processed, not the asset scanned.
Start at cloud.defectdojo.com or read the full pricing page.
DefectDojo Pro ($100 a month plus $0.15 per finding processed), Amazon Inspector, AWS Security Hub, Microsoft Defender Vulnerability Management, Intruder and Vullify all publish monthly or usage-based pricing. Tenable, Qualys and Rapid7 sell primarily on annual terms.
For smaller or changing environments it usually is, because you pay only for what you use. At steady high volume, annual pre-pay is usually cheaper. DefectDojo's annual pre-pay saves 48% or more compared with pay-as-you-go.
With DefectDojo Pro, yes. You can start on pay-as-you-go and move to pre-pay when your volume is predictable.