Having just navigated a renewal for one of my enterprise clients, I have to say the new pricing structure has me a bit concerned. It feels like a shift from a tool-first to a platform-first model, and not necessarily in a good way for all teams. The bundling is more aggressive, and I'm hearing from several peers that the standalone CLI tool—which was a favorite for lean DevOps pipelines and pre-commit hooks—is becoming much harder to license independently.
The core issue I'm seeing mirrors problems we've faced in CRM and marketing automation rollouts: when you bundle essential, lightweight tools into a monolithic suite, you often sacrifice flexibility and cost-effectiveness for teams that have already built mature, customized workflows. They're effectively forcing you onto the platform to get the components you might already be using successfully.
Here are the specific pain points I'm observing in the field:
* **The "Platform Tax":** To get the CLI scan capabilities many of my clients rely on for developer feedback loops, they now need to step up to a higher tier that includes the web portal, orchestration, and a bunch of other features their security team might not even want. This creates internal friction and budget challenges.
* **Obfuscated SKUs:** It's becoming difficult to get clear, transparent pricing on the CLI component alone. The sales motion now heavily pushes the integrated platform, making the simple, automated use case feel like a second-class citizen.
* **Change Management Headaches:** For teams that built their entire shift-left process around the standalone tool, this feels like a rug pull. We're now looking at re-architecting pipelines or evaluating alternatives, which is a massive operational cost nobody budgeted for.
I've been through similar vendor transitions with marketing automation platforms that suddenly locked core segmentation features behind a "pro" tier. It fractures adoption and kills the ROI you initially sold internally.
My question to the community is: are you experiencing this as well? For those who have recently evaluated or renewed:
* Were you able to secure the CLI tool on its own, and if so, under what conditions?
* Has this pricing shift pushed you to look at other SAST solutions that still cater to the DevOps-native, pipeline-first use case?
* For those who accepted the bundled platform, how was the internal sell to both security and engineering teams? Did you face resistance?
The tool itself is still solid, but vendor strategy changes like this can completely derail a successful implementation. I'm worried we're losing a good option for focused, integrated security in the name of upselling.
Implementation is 80% process, 20% tool.
You're hitting the nail on the head with the "platform tax." I've seen this same playbook with middleware vendors - they dangle a useful, focused tool to get adoption, then bury it in a suite to force an upsell. It kills the ROI for teams that have a specific, automated use case.
It pushes people towards hacky workarounds, like trying to run the old CLI version in a container forever or building their own wrapper scripts, which defeats the purpose of buying a supported product.
The irony is, this often backfires. When you price out the lean use cases, you're just training your customers to look for alternatives.
Integration is not a project, it's a lifestyle.