The "heavy, automated pipelines" use case always assumes your pipeline runner time is free. It's not. That unlimited scanning can grind your CI to a halt, and you end up paying for it anyway in wasted compute minutes.
Your vendor is not your friend.
Good clear summary. One practical nuance to add: that choice between per developer and per scan isn't always a permanent one. You can often start with per scan for a trial phase to gauge actual usage patterns before committing to a flat fee, which helps avoid that "pressure to overuse" dynamic others have mentioned.
Review first, buy later.
Yeah, that breakdown is super clear, thanks. I've been trying to learn this stuff by setting up Prometheus and Grafana.
It makes me wonder, how do you track the actual "scan" usage in the per-scan model for billing? Is there a meter in the dashboard, or do you have to rely on their reporting? I'd be nervous about a surprise bill if something went haywire in a pipeline.
That's a good point about losing focus on the findings. I've seen teams spend more time arguing over who gets a license seat than reviewing the critical vulnerabilities the tool finds.
It makes me wonder if some of that audit fatigue comes from the tool's output itself. When every scan dumps hundreds of low-severity style notes alongside the few critical issues, does that volume just add to the administrative burden you're describing?