Hey everyone, been wrestling with a procurement headache and wanted to get the community's take, especially from those in consulting or agency environments.
We're evaluating SAST tools (looking at a couple of the usual suspects) to standardize our security scanning. Our dev teams are a mix of maybe 30% FTE and 70% contractors/consultants who rotate on and off projects, sometimes for just a few months. The pricing models we're seeing are almost exclusively per-seat, per-developer, which seems to assume a stable, growing headcount.
My worry is twofold: the administrative nightmare of constantly provisioning and deprovisioning licenses, and the sheer cost inefficiency. We'd be paying for a "seat" for a contractor who might only be with us for one quarter, and then we have to hope we can reassign that license immediately to the next hire. It feels like we're being penalized for our operational model.
Has anyone found a SAST or dependency scanning vendor with a more flexible model? Something like per-repo, per-project, or based on scan volume? Or are we stuck trying to shoehorn this per-seat cost into our contracts? I'm also curious if any tools handle short-term access gracefully—like temporary licenses or API keys that we could automate via our internal systems.
Coming from a Salesforce/low-code background, I'm used to licensing being a bit more modular, so this feels like a step back. Real-world experiences would be super helpful.
Yeah, that per-seat model is brutal for a fluid team structure. The license churn alone is a huge hidden cost.
Have you looked at any tools that charge based on active committers over a rolling period, like the last 90 days? Some of the newer players in the cloud-native scanning space are experimenting with that. It still tracks people, but it might align better with your contractor cycles than a fixed annual seat.
Also, definitely push back during sales calls. Vendors are way more flexible on pricing models when they know you'll walk. Ask them point blank about short-term access tokens or project-based tiers - sometimes they have the capability but don't lead with it.
That rolling committer model is a really interesting idea, it seems like it would map well to how teams actually use source control. I wonder about the latency of those metering systems, though. If they bill based on a 90-day lookback, you're still paying for a contractor's seat for three months after they've left.
Pushing back on sales is key. In my experience, the worst they can say is no, and you'd be surprised how many have a "concurrent user" option buried in their enterprise SKU that they never mention until you threaten to walk. It's a different kind of seat management, but it can be easier than named licenses.
ms matters
Great point about the latency. A 90-day lookback is essentially a long-term commitment by another name, just with a delayed invoice. You're still on the hook.
You're dead on about the "concurrent user" option. We found one that was exactly like that, hidden behind a vague "floating license" term. The catch was a hard cap on simultaneous users that was way below our total potential headcount. It solved the contractor problem but introduced a new one - we had to play license bouncer, making sure people logged out. Sometimes the workaround is just a different kind of headache.
Have you ever seen a vendor successfully price based on repositories or lines of code scanned? I feel like that would align incentives better for this kind of team structure.
Try everything, keep what works.