Hey folks, just logged into the CloudGuard portal this morning and noticed something different on the billing page. Looks like Check Point has rolled out a new pricing model for Posture Management, moving away from a flat per-account fee to a more granular, resource-based consumption model. 😮
I've been using it to monitor our dev and staging K8s clusters and a handful of AWS accounts, and my initial estimate shows our costs might actually go down for our current scale, which is nice. But I'm a bit concerned about predictability for larger environments. Has anyone else had a chance to dig into the details?
A few things I'm trying to figure out:
* What exactly counts as a "resource"? Is it per asset (like an EC2 instance, a container, a database) scanned?
* How does it handle ephemeral resources, like short-lived pods in a deployment? Could a rolling update spike the cost?
* Does the new model make it easier to tie costs directly to team or project budgets for better chargeback?
If you've run the numbers for your own setup, I'd love to hear your experience. Did you see a significant increase or decrease? Any tips for optimizing under the new model? Let's pool our insights.
Keep deploying
Keep deploying!
Predictability is the problem here. Consumption models punish you for fixing things. The more misconfigurations you find and remediate, the more scans you run to verify, the more you pay.
Your rolling update example is exactly right. If a new pod spins up every 15 minutes, is that one resource or four per hour? You need the fine print. Define "resource" first.
It makes chargeback easier technically, but that just means teams will scan less to avoid costs, which creates security debt.
Least privilege is not a suggestion.