I've been running Snyk on our Kubernetes clusters for about 8 months now, and I just finished my quarterly cloud cost and tooling review. The verdict is... complicated. It's good, but the pricing model makes me question if it's truly a must-have or if we're just paying for the brand.
For context, we're a mid-sized team managing ~50 microservices across three dev/prod clusters. Snyk does catch things. The container vulnerability scanning is thorough, and the Kubernetes workload monitoring gives decent visibility into misconfigurations in real time. I especially like how it integrates into the CI/CD pipeline to block deployments with critical CVEs.
But here's where my frugal ops brain starts crunching numbers. The pricing is per-developer, which scales linearly with our headcount, not with our actual usage or infrastructure footprint.
* Our cluster count or number of scanned images could double, and our cost wouldn't change if the team size stays the same.
* Conversely, hiring more developers immediately increases the bill, even if they don't touch k8s.
* We're essentially subsidizing access for our front-end and mobile devs who get value from Snyk for their npm packages, but not from the k8s security features.
This leads me to my core question for the community: **For a team focused specifically on Kubernetes security, is Snyk's per-developer model justified, or are we better off with a combination of more targeted (and potentially cheaper) tools?**
I've been looking at alternatives like Trivy for image scanning and Kube-bench for CIS compliance, which are open-source and run on our own infra. The trade-off is obviously more management overhead versus Snyk's integrated platform.
Has anyone done a similar cost/benefit breakdown? I'm particularly interested in:
* Real-world efficacy of Snyk's k8s policy blocks versus building similar gates with OSS tools.
* Whether the per-developer pricing includes hidden costs for certain scanning frequencies or retention.
* Experiences with scaling Snyk costs as both your team and cluster count grow.