Pricing

Priced per developer.
Every signal in every plan.

You are never charged for the detection engine. All signals, all four inline registry proxies and the full tarball content scan are in every plan, including the entry tier. What scales is how deep you go: AI model coverage, SOC integration, threat hunting and deployment model.

plans

Pick the plan that fits your team.

Team

no minimum

Startups and small engineering teams. Pay for the developers you have.

$20/dev/month

$16/dev/month billed annually · 30 days free, no card

All detection signals
All four inline proxies: npm, PyPI, NuGet, Go
Zero-day tarball content scanning
Security dashboard, dependency graph, XYZ scoring
xyz Scanner, CyberXYZ Gate, VS Code extension
Webhook alerts for high and critical findings
TOTP multi-factor authentication
Community support
AI model supply chain (not included)
SAML SSO (not included)

Start a 30-day proof of value

Business

Enterprise

from 250 developers

Large organisations, MSSPs and technology partners. Volume pricing from 250 developers.

Custom

Volume pricing · partner and reseller rates available

Everything in Business
Threat hunting workspace and Detection Ops console
Environment management, multi-BU
Commit-level AI on your own repositories
Gated model repository coverage
Private cloud or on-premise deployment
JIT provisioning, enforce-SSO, require-MFA
Dedicated account manager, SLA, onboarding and training

Talk to sales

// free

Free, for individuals and evaluation.

No card and no expiry. Your own installs protected, verdicts in your editor and your pipeline, and every malicious verdict shown in full.

Install proxy for npm, PyPI, Go and NuGet
xyz Scanner audit and VS Code verdicts
CyberXYZ Gate in CI
CyberXYZ Check and public package reports

Create a free account

8 developers on Team$160 a month, or $128 a month billed annually
40 developers on Business$1,800 a month, or $1,440 a month billed annually
250 or more on Enterprisevolume pricing; the rate per developer falls with scale

// every plan includes

Every detection signal · all four inline proxies · tarball content scan · dashboard · xyz Scanner · VS Code · CyberXYZ Gate · 30-day proof of value

All prices in USD. A developer is any person who installed a package through CyberXYZ in the last 90 days. CI runners and pipelines are never counted, and dormant seats are not billed. Ecosystems are never metered: adding NuGet or Go to an npm deployment costs nothing.

Working with security teams, built with the platforms they run

// top row: security teams we work with · bottom row: platforms we build with

Compare plans

What's included
in each plan.

What each plan includes
capability	Team$20per developer / month $16 billed annually	Most popularBusiness$45per developer / month $36 billed annually	EnterpriseCustomvolume pricing from 250 developers
// plan
Minimum developersCI runners and pipelines are never counted	none	none	250
30-day proof of valueon your own installs, no card	Included	Included	Included
// detection, in every plan
Full detection engineevery signal, never metered	Included	Included	Included
Install-time proxy / firewallinline for npm, PyPI, Go and NuGet	Included	Included	Included
Zero-day tarball content scanning	Included	Included	Included
Security dashboarddependency graph and XYZ scoring	Included	Included	Included
VS Code extension and xyz Scanner	Included	Included	Included
CyberXYZ Gate in CIGitHub Actions, GitLab CI, Azure DevOps	Included	Included	Included
// ai models
AI model supply chainHugging Face fleet coverage	Not included	Included	Included
Pickle opcode scanningmodel XYZ score and AI-written alert review	Not included	Included	Included
Gated model repository coverage	Not included	Not included	Included
// soc and fleet
Per-machine install attribution	Not included	Included	Included
SBOM scanningCycloneDX and SPDX, campaign tracking, remediations	Not included	Included	Included
Organisation block list	Not included	Included	Included
Alert forwarding	webhook	webhook, SIEM (early access)	webhook, SIEM (early access)
Threat hunting workspaceand the Detection Ops console	Not included	Not included	Included
Commit-level AI on your own repositories	Not included	Not included	Included
// identity and deployment
SAML 2.0 SSOOkta, Azure AD, Google	Not included	Included	Included
JIT provisioning and org auth policiesenforce-SSO, require-MFA	Not included	Not included	Included
Private cloud or on-premise deployment	Not included	Not included	Included
Environment management, multi-BU	Not included	Not included	Included
// support
Support	Community	Priority email	Dedicated, with an SLA
Choose a plan	Start a proof of value	Talk to sales	Talk to sales

Pricing FAQ

Questions, answered.

How does pricing work?

Per developer, per month. Team is $20, Business is $45, and annual billing saves 20 percent. A developer is any person who installed a package through CyberXYZ in the last 90 days; CI runners and pipelines are never counted, so dormant seats and build machines are never billed. There is no minimum on Team or Business. Enterprise is priced by volume from 250 developers and the effective rate falls with scale.

Is there a free plan?

Yes. A free account has no card and no expiry: the install proxy for npm, PyPI, Go and NuGet on your own machines, the xyz Scanner audit, verdicts in VS Code, CyberXYZ Gate in CI, and every malicious verdict in full. Team adds the dependency graph and the policy controls; Business adds AI models, SBOMs and per-machine attribution.

How does the 30-day proof of value work?

Tell us which plan you want to try and we switch it on for your organisation for 30 days, on your own installs. No card is needed, and nothing is billed unless you decide to keep it.

Why not the cheapest option?

The usual alternatives consume public feeds. We run our own detection estate: 17 detectors, three registry watchers, a commit watcher across 181 repositories and a wave correlator. On the Hades PyPI wave, our scanner raised in-app HIGH alerts about 30 minutes after the wave began, hours before the first public advisory. You pay for original intelligence, not a repackaged feed.

Are there add-ons?

Dedicated onboarding, with proxy rollout and team training, is a one-time $5,000. Private cloud deployment is quoted per environment on Enterprise.

Which ecosystems are covered?

npm, PyPI, Go and NuGet at the inline proxy, in xyz Scanner, the VS Code extension and CyberXYZ Gate, and Hugging Face models on Business and above. Single Maven packages can be checked with xyz check PACKAGE VERSION -e maven; Maven project audits are not available yet. Ecosystems are never metered.

Cloud or self-managed?

The dashboard and the registry proxies run as a managed service hosted by CyberXYZ. On developer machines, servers and CI runners, xyz Scanner points each package manager at the hosted proxy. Self-managed deployment is scoped with sales on Enterprise.

Do you offer partner or reseller pricing?

Yes, partner and reseller pricing is available. See the CyberXYZ partner program for reseller, technology and MSSP options, or apply to become a partner.

How do I get a quote?

Multiply your developer count by the rate above, or book a 15-minute demo below and we will scope it with you and start the 30-day proof of value the same week.

// the ask

Let's price it
for your team.

Tell us your team size and ecosystems. We'll send a tailored quote and set up a 30-day proof of value.

✓ 30-day proof of value
✓ Tailored to your team
✓ Partner pricing available

✓

Thanks! We'll be in touch.

Check your inbox. We'll reach out within 24 hours.

Priced per developer.Every signal in every plan.