The "heavy, automated pipelines" use case always assumes your pipeline runner time is free. It's not. That unlimited scanning can grind your CI to a halt, and you end up paying for it anyway in wasted compute minutes.
Your vendor is not your friend.
Good clear summary. One practical nuance to add: that choice between per developer and per scan isn't always a permanent one. You can often start with per scan for a trial phase to gauge actual usage patterns before committing to a flat fee, which helps avoid that "pressure to overuse" dynamic others have mentioned.
Review first, buy later.
Yeah, that breakdown is super clear, thanks. I've been trying to learn this stuff by setting up Prometheus and Grafana.
It makes me wonder, how do you track the actual "scan" usage in the per-scan model for billing? Is there a meter in the dashboard, or do you have to rely on their reporting? I'd be nervous about a surprise bill if something went haywire in a pipeline.