Pricing Plans
Two ways to get DefectDojo Pro. Start on usage pricing today, or pre-pay for the year and save 48% or more.
Pay As You Go
plus $0.15 per finding processed
Pricing: $100 per month plus $0.15 per finding processed. Sensei AI is billed per use.
Pre-Pay & Save
Save 48%+ when you pre-pay
Priced per month, billed annually on a one-year commitment. Size it below.
Every annual agreement includes a Sensei AI allowance for fixes, threat models and Advisor runs. Your quote lists it.
Pricing questions
How much does a Pre-Pay agreement cost?
Pre-Pay agreements run from low four figures a month on an annual commitment and are sized to the findings you process. At up to 250,000 findings a year you save 48% or more compared with Pay As You Go, and the discount grows with volume. Your quote includes the exact price for your tier.
What counts as a finding processed?
A finding is what a security scanner or tool reports: a vulnerability, an alert, a misconfiguration. Each finding DefectDojo takes in and processes counts once. Pay As You Go bills $0.15 for each one. Pre-Pay sizes an annual allowance to your volume instead.
Can I start on Pay As You Go and move to Pre-Pay later?
Yes. Start on Pay As You Go today, watch your real volume, and request a quote when an annual agreement would cost less. Your data and configuration carry over.
Is Sensei AI included?
On Pay As You Go, Sensei AI is billed per use. Pre-Pay agreements include a Sensei AI allowance each term for fixes, threat models and Advisor runs. Your quote lists what is included.
We process more than 1 million findings a year. What then?
Above 1 million findings a year we write a custom agreement. The savings against Pay As You Go are 66% or more at that volume.
Is there a free option?
Yes. DefectDojo Community Edition is the full open source platform, free forever, in production at 10,000+ organizations. Prove it in your stack, then bring the same system of record to Pro.
DefectDojo Features
| Capability | The RecordCommunity Edition · Where programs start | The ActionDefectDojo Pro · Where programs scale |
|---|---|---|
| Intelligence | ||
| Deduplication | Within a scanner; limited across | Across your entire stack, configurable to the field |
| Root cause analysis | Correlation traces the cluster: one fix closes many findings | |
| Threat intel | EPSS + CISA KEV enrichment, automatic | |
| Reachability | Beta: five verdicts, KEV overrides the ceiling | |
| Prioritization | Risk engine, tunable per asset | |
| Prioritization simulator | Preview scoring changes before they land | |
| Action | ||
| Automatic ingestion | All 500+ integrations, by file import or API push | 130+ Connectors pull on a schedule: Wiz, Snyk, Tenable, Qualys, CrowdStrike |
| Triage rules | Triage Engine: auto-triage, auto-close, acceptance rules | |
| Remediation | Sensei ships the fix as a pull request, at the autonomy you set | |
| Ticketing | Bi-directional Jira | Adds GitHub, GitLab, Azure DevOps, ServiceNow |
| SLAs | Basic tracking | Enforcement with breach alerting |
| Governance | ||
| SSO, RBAC & audit | SSO (SAML 2.0, OIDC), granular RBAC, full audit trail | |
| Reporting | Core metrics | Executive BI suite, custom report builder |
| Audit-ready reporting | Hand the assessor a report, not a spreadsheet | |
| Federal & compliance | POA&M, CMMC, STIG/CCI, FIPS | |
| PSIRT advisory workflow | Intake to published advisory, built in | |
| Support | Community: OWASP Slack, GitHub | SLA-backed, dedicated Customer Success Engineer |
