DefectDojo Pro pricing
One annual agreement, sized to the findings you process. Tell us your volume and we will send pricing for your tier.
Get a quote
Everything in DefectDojo Pro, priced for the findings you process a year.
DefectDojo Pro brings 500+ security tools into one platform. Slide to your annual findings volume, add your details, and our team will send a quote for your tier.
- Capacity sized to your findings volume
- Sensei AI included
- Deploy via SaaS, On-Prem, or Air-Gapped
- All DefectDojo Pro features
Every annual agreement includes a Sensei AI allowance for fixes, threat models and Advisor runs. Your quote lists it.
Get a Quote
Pricing questions
How much does DefectDojo Pro cost?
On our Pay As You Go model, DefectDojo Pro is $100 a month plus $0.15 per finding processed. Contact our sales team for the deepest discount: annual agreements are sized to the findings you process a year, and your quote includes the exact price for your tier. Sign up for Pay As You Go
What counts as a finding processed?
A finding is what a security scanner or tool reports: a vulnerability, an alert, a misconfiguration. Each finding DefectDojo takes in and processes counts once. Your agreement sizes an annual allowance to your volume.
What if I’m unsure how many findings I’ll process in a year?
That’s common. Pick your best estimate on the slider and contact sales. Our team will look at the scanners and tools you run today and help you land on the right tier before you commit.
Is Sensei AI included?
Yes. Every annual agreement includes a Sensei AI allowance each term for fixes, threat models and Advisor runs. Your quote lists what is included.
We process more than 1 million findings a year. What then?
Above 1 million findings a year we write a custom agreement. Choose More than 1 million on the slider and our team will follow up.
Is there a free option?
Yes. DefectDojo Community Edition is the full open source platform, free forever, in production at 10,000+ organizations. Prove it in your stack, then bring the same system of record to Pro.
How is DefectDojo priced compared with scanners?
Scanners usually charge per asset or target scanned. DefectDojo doesn't scan. It manages findings from the scanners you already run, so it charges per finding processed.
DefectDojo Features
| Capability | The RecordCommunity Edition · Where programs start | The ActionDefectDojo Pro · Where programs scale |
|---|---|---|
| Intelligence | ||
| Deduplication | Within a scanner; limited across | Across your entire stack, configurable to the field |
| Root cause analysis | Correlation traces the cluster: one fix closes many findings | |
| Threat intel | EPSS + CISA KEV enrichment, automatic | |
| Reachability | Beta: five verdicts, KEV overrides the ceiling | |
| Prioritization | Risk engine, tunable per asset | |
| Prioritization simulator | Preview scoring changes before they land | |
| Action | ||
| Automatic ingestion | All 500+ integrations, by file import or API push | 130+ Connectors pull on a schedule: Wiz, Snyk, Tenable, Qualys, CrowdStrike |
| Triage rules | Triage Engine: auto-triage, auto-close, acceptance rules | |
| Remediation | Sensei ships the fix as a pull request, at the autonomy you set | |
| Ticketing | Bi-directional Jira | Adds GitHub, GitLab, Azure DevOps, ServiceNow |
| SLAs | Basic tracking | Enforcement with breach alerting |
| Governance | ||
| SSO, RBAC & audit | SSO (SAML 2.0, OIDC), granular RBAC, full audit trail | |
| Reporting | Core metrics | Executive BI suite, custom report builder |
| Audit-ready reporting | Hand the assessor a report, not a spreadsheet | |
| Federal & compliance | POA&M, CMMC, STIG/CCI, FIPS | |
| PSIRT advisory workflow | Intake to published advisory, built in | |
| Support | Community: OWASP Slack, GitHub | SLA-backed, dedicated Customer Success Engineer |
