Per seat. Per token. Or paid once.
Code security is priced three ways: per developer, per token, or once for hardware. Per-seat and per-token punish you for scanning. Local doesn't.
Code-security tooling gets priced three ways: per developer, per token, or once for the hardware. Two of those three charge you more the more you actually use them. Here's the math — and why "pay once, scan forever" is the only model that doesn't fight you.
Every team buying code-security tooling is really picking a pricing model, and the model shapes behavior more than the feature list does. There are three:
- Per seat — the traditional SAST license. You pay for every developer, every year.
- Per token — the cloud-AI meter. You pay for every million tokens the model reads and writes.
- Per box — a local model on your own hardware. You pay once for the machine, then run it.
The first two share a quiet flaw: they bill you for the thing you want to do more of. The third doesn't. That difference decides how often you scan, how much code you cover, and how much of your security budget evaporates before it finds a single real bug.
Per seat: you pay for headcount, not security
Traditional SAST — Checkmarx, Veracode, Snyk, Semgrep, Sonar — is licensed per developer or per enterprise contract. The public numbers:
- Snyk Code: ~$25/developer/month — about $300/developer/year, or $7,500/yr for a 25-dev team.
- Semgrep:
$35/contributor/month ($420/yr). - Checkmarx / Veracode: opaque enterprise quotes, typically $40,000–$200,000+/year, scaling with seats and contract size.
Look at what the meter measures: developers. Not vulnerabilities found, not lines scanned, not risk reduced. Hire ten engineers and the bill climbs whether or not the tool surfaced a single new bug. Scan once a quarter or never — you pay the same. The license is a fixed tax on headcount, disconnected from how much security you actually get.
And the seats you bought get burned by the tool's own noise. A scanner that floods developers with false positives spends the exact attention you're paying for — you license 50 seats, then watch half their security time go to triaging findings that were never exploitable. (Why that noise is the real problem: pattern matching finds patterns, attackers find weaknesses.)
Per token: you pay to look
Cloud-AI scanning moves the meter from people to tokens. Frontier security models are priced like Mythos at $25/$125 per million input/output tokens — so reading your repo costs money, and reading it again costs again.
The numbers get ugly fast. A brute-force sweep of one kernel-sized codebase runs to thousands of dollars in tokens at frontier pricing — which is exactly why nobody runs a frontier model over every file, and why published Mythos costs are quoted per bug-hunt ($10k–$20k a campaign), not per scan. We did that math in detail here.
So you ration. And that's the trap: the more thorough the scan, the bigger the bill, so teams scan less, later, on fewer files. The pricing model actively fights the security goal. Even a cheap hosted model at ~$0.20/M still meters you — fine for a weekend experiment, but every CI run, every commit, every re-scan becomes a line item you'll be tempted to cut.
Per box: you pay once
A local model inverts the whole arrangement. You buy the hardware once — capex, not a recurring meter — and the marginal cost of a scan collapses to roughly the electricity it burns.
That changes what's affordable. Scan every file. Re-scan on every commit. Run several specialist models over the same file. Sweep the whole monorepo nightly. The bill doesn't move, because there is no meter — only a box you already own. The behavior that per-seat makes pointless and per-token makes expensive is, locally, just the default.
And the code never leaves your perimeter — no per-seat SaaS upload, no repo shipped to a token API. (Why your code never leaves Europe.)
The three models, side by side
| You pay for | Bill grows with | One more scan costs | Code leaves? | |
|---|---|---|---|---|
| Per seat (SAST) | developers | headcount | $0 — but you prepaid, and eat the false-positive tax | usually (SaaS) |
| Per token (cloud AI) | tokens | code volume × scan frequency | metered every single time | yes |
| Per box (local) | hardware, once | nothing | ≈ electricity | no |
The metric that actually matters
Ask one question of any code-security tool: what does it cost to scan your entire codebase on every commit?
- Per seat: technically allowed, but you're capped by the tool's noise — more scanning just means more false positives to triage with the seats you bought.
- Per token: financially absurd. The thing you most want to do is the thing the pricing most punishes.
- Per box: free. It's not just affordable to scan everything all the time — it's the cheapest thing you can do, because the alternative is leaving an idle machine switched on.
That's the whole argument. Per-seat prices your team. Per-token prices your curiosity. Local prices a one-time piece of hardware and then gets out of the way — so "scan everything, all the time, and keep the code at home" stops being a budget negotiation and becomes the default. That's what we build at Codelight.
Sources
- CodeAnt, "How Much Do SAST Tools Cost in 2026?" — per-developer and enterprise SAST pricing.
- "Snyk Pricing in 2026" — Snyk Code per-developer tiers.
- Anthropic Red Team, "Assessing Claude Mythos Preview's cybersecurity capabilities" — frontier token pricing ($25/$125 per M) and per-campaign costs.
Topics: #security #ai #data-sovereignty