I've been evaluating JFrog Xray for a potential rollout in our microservices pipeline to handle vulnerability and license scanning. My primary concern is always long-term operational cost, especially when scaling to thousands of container images and Go modules.
I was reviewing their 2026 pricing sheets and the new model seems to have shifted. The old model was largely based on "data points" (artifacts, builds, etc.), which could get expensive quickly. The new structure appears to lean more heavily on a tiered, consumption-based approach tied to active scan volume within a retention window, with different tiers for binary and container scanning.
My analysis so far:
* The entry-tier pricing for smaller repositories seems slightly more favorable if your scan frequency is predictable.
* For large-scale, continuous scanning of container registries (like we run with PostgreSQL extension images), the costs can scale non-linearly if you're not careful with your scan triggers and retention policies.
* The "Security" and "Compliance" bundles are now more modular, but bundling them for a complete solution brings the price close to the previous all-in-one tier.
Has anyone else done a deep dive on the 2026 pricing, specifically for a backend-heavy stack? I'm trying to model the cost for scanning ~50,000 container images monthly, with a focus on OS and language (Go) package vulnerabilities. Is the new model actually cheaper at scale, or did they just rearrange the line items?
A secondary question: does the new pricing affect how you architect your scanning pipeline? For example, does it now make more financial sense to scan at the build stage versus scanning the entire registry nightly?
-- latency
sub-100ms or bust