You are never charged for the detection engine. All signals, all four inline registry proxies and the full tarball content scan are in every plan, including the entry tier. What scales is how deep you go: AI model coverage, SOC integration, threat hunting and deployment model.
Startups and small engineering teams. Minimum 10 developers.
Growing organisations running a real SOC. Minimum 25 developers.
Large organisations, MSSPs and technology partners. Volume pricing from 250 developers.
All prices in USD. A developer is any person or CI runner that pulled a package through CyberXYZ in the last 90 days; dormant seats are not billed. Ecosystems are never metered: adding NuGet or Go to an npm deployment costs nothing.
| Capability | Team | Business | Enterprise |
|---|---|---|---|
| Per developer, per month | $25 ($20 annual) | $60 ($48 annual) | Volume |
| Minimum developers | 10 | 25 | 250 |
| Full detection engine (all signals) | ✓ | ✓ | ✓ |
| Install-time proxy / firewall | ✓ | ✓ | ✓ |
| Security dashboard | ✓ | ✓ | ✓ |
| Ecosystems | ✓ | ✓ | ✓ |
VSCode extension + CLI | ✓ | ✓ | ✓ |
CI/CD gating (depalert)   | ✓ | ✓ | ✓ |
| AI model supply chain (Hugging Face) | · | ✓ | ✓ |
| Pickle opcode scanning, model XYZ score, AI alert review | · | ✓ | ✓ |
| Per-machine install attribution | · | ✓ | ✓ |
| SBOM scanning, campaign tracking, remediations | · | ✓ | ✓ |
| Organisation block list | · | ✓ | ✓ |
SIEM / XDR integrations   | webhook | 3 | All 8 |
| SAML 2.0 SSO (Okta / Azure AD / Google) | · | · | ✓ |
| JIT provisioning + org auth policies | · | · | ✓ |
| Threat hunting workspace and Detection Ops | · | · | ✓ |
| Commit-level AI on your own repositories | · | · | ✓ |
| Private cloud or on-premise deployment | · | · | ✓ |
| Support | Community | Priority email | Dedicated + SLA |
| 30-day proof of value | ✓ | ✓ | ✓ |
Per developer, per month. Team is $25, Business is $60, and annual billing saves 20 percent. A developer is any person or CI runner that pulled a package through CyberXYZ in the last 90 days, so dormant seats are never billed. Enterprise is priced by volume from 250 developers and the effective rate falls with scale.
The usual alternatives consume public feeds. We run our own detection estate: 17 detectors, three registry watchers, a commit watcher across 181 repositories and a wave correlator. We caught all 19 Hades packages within 30 minutes of publish, four days before the public write-up of the same campaign. You pay for original intelligence, not a repackaged feed.
An additional SIEM connector on Team or Business is $500 per integration per month. Dedicated onboarding, with proxy rollout and team training, is a one-time $5,000. Private cloud deployment is quoted per environment on Enterprise.
npm, PyPI, NuGet and Go at the inline proxy, Java and Maven in the CLI and CI/CD gate, and Hugging Face models on Business and above. Ecosystems are never metered.
The dashboard runs as a managed service and the proxy deploys into your environment, on developer machines, CI runners and Kubernetes. Enterprise plans include additional self-managed options.
Yes, partner and reseller pricing is available. See the CyberXYZ partner program for reseller, technology and MSSP options, or apply to become a partner.
Multiply your developer count by the rate above, or book a 15-minute demo below and we will scope it with you and start the 30-day proof of value the same week.
Tell us your team size and ecosystems. We'll send a tailored quote and set up a 30-day proof of value.
Check your inbox. We'll reach out within 24 hours.