Pricing guide
How much does a cloud security posture management tool typically cost?
CSPM pricing is hard to compare. Some vendors charge per asset, some per workload, some per user and some per cloud account, and many publish no price at all. This guide sets out what the published prices actually are, what drives them, and which tools are affordable for a small team. We make one of these tools, so every price links to its source.
The short answer
- Free to license: open-source scanners and AWS’s own services. You pay in engineering time, and AWS charges for Security Hub by usage.
- Roughly $1,000 to $10,000 a year: tools aimed at start-ups and small teams that publish their prices.
- $24,000 a year and upwards: enterprise CNAPP platforms. Published entry tiers run from $24,000 to $84,000 a year for 100 workloads, and larger estates are quoted individually.
How CSPM tools are priced
The unit a vendor charges by matters more than the headline number, because it decides how your bill grows. These are the models you will meet most often.
- Per asset or resource. You pay for the number of cloud resources scanned, often in tiers. Predictable while your estate is stable, but the bill rises as you add resources, and counting rules differ between vendors.
- Per workload. Common for CNAPP platforms. A workload is usually a virtual machine, container host or serverless function, with conversion ratios for each. Entry tiers are often sold in blocks of 100.
- Per user or developer. Common for tools that combine code and cloud scanning. The cost follows your team size rather than your infrastructure.
- Per cloud account. One price per connected account, however many resources it holds. Simple to forecast, and it does not penalise growth inside an account.
- Quote only. An annual subscription negotiated with sales, usually based on the number and type of resources. You cannot see the price until you are in a sales process.
Published CSPM prices in 2026
The table shows each vendor’s lowest published paid price, as listed on its own pricing page or AWS Marketplace listing on 29 September 2026. The annual figure is our own arithmetic so that the rows can be compared; it is not a quote. Tools cover different things, so a higher price often buys a broader platform.
| Tool | Type | Pricing unit | Lowest published paid price | Per year at that tier |
|---|---|---|---|---|
| AWS Security Hub | Native AWS posture service | Per monitored resource (unified Security Hub); per check (Security Hub CSPM) | Usage-based; 30-day free trial (AWS Security Hub pricing) | Depends on resources |
| bearhug | AWS CSPM | Per AWS account | $100 per AWS account per month (AWS Marketplace) | $1,200 per account |
| Intruder | Vulnerability scanner with cloud checks | Plan plus per-target licences | $2,870 per 12 months for 5 targets (Intruder on AWS Marketplace) | $2,870 |
| Aikido Security | Code and cloud security platform | Per user | $3,780 per 12 months for 10 users (Aikido on AWS Marketplace) | $3,780 |
| Cyscale | Multi-cloud CNAPP for SMBs | Tiers by assets and connectors | $850 a month, billed annually, up to 1,000 assets (Cyscale pricing) | $10,200 |
| Wiz | Enterprise CNAPP | Per workload, in blocks | $24,000 per 12 months for 100 workloads, Wiz Essential (Wiz on AWS Marketplace) | $24,000 |
| Orca Security | Enterprise CNAPP | Per concurrent workload | $7,000 per month for up to 100 workloads (Orca on AWS Marketplace) | $84,000 |
| Prisma Cloud (Cortex Cloud) | Enterprise CNAPP | Annual subscription by resources | Quote only (Cortex Cloud licence plans) | Not published |
For a tool-by-tool view of strengths and trade-offs, see our buyer’s guide to CSPM tools for start-ups.
A worked example for a small team
Take a start-up with three AWS accounts (production, staging and a shared services account), about 40 EC2 instances and a few hundred other resources. Here is what the smallest published tier of each tool would cost for a year.
| Tool and tier | Why that tier | Per year |
|---|---|---|
| bearhug | 3 AWS accounts at $100 a month each | $3,600 |
| Cyscale Pro | Under 1,000 assets and 10 connectors | $10,200 |
| Wiz Essential | Smallest block of 100 workloads | $24,000 |
| Orca Small | Smallest tier of 100 workloads, for 12 months | $84,000 |
This is not a like-for-like comparison. Wiz, Orca and Cyscale cover several clouds and add capabilities such as container and code security that bearhug does not offer. The point is that a small AWS-only team can pay for a large platform it will only partly use. Remember, too, that tools built on Security Hub and GuardDuty, including bearhug, add AWS usage charges for those services, which you can forecast with the Security Hub cost estimator in your AWS console.
The costs that are not on the price list
- AWS service charges. Security Hub and GuardDuty are billed by AWS according to usage. If a tool depends on them, include them in your budget.
- Set-up time. A roll-out that takes weeks of engineering time can cost more than the first year’s licence at a small company.
- Triage time. Hundreds of technical findings are only useful if someone can tell which ones matter. Without a security engineer, that work lands on your developers.
- Remediation effort. Many tools tell you what is wrong but leave the fix to you. Guided or automated fixes reduce the hours between a finding and a closed issue.
- Growth and overage. Asset and workload tiers step up as you grow. Check what happens when you cross a tier boundary part-way through a contract.
- Commitment. Annual contracts paid upfront tie up cash. Monthly plans cost the same or more per month, but let you stop if the tool is not being used.
Who offers affordable cloud security posture tools for small teams?
If you are a small team on AWS, these are the realistic options, from the cheapest to license upwards.
- Open-source scanners, such as Prowler. Free to license and thorough. Best for teams with an engineer who is comfortable running, scheduling and interpreting a command-line scanner.
- AWS Security Hub on its own. Native, charged through your AWS bill and free for 30 days. Findings are written for specialists, and automated fixes need to be built with EventBridge, Lambda or Systems Manager. See Security Hub compared with bearhug.
- bearhug. $100 per AWS account per month with every feature included. Built on Security Hub and GuardDuty, it explains every finding in plain English and fixes common issues in one click, with rollback. AWS only.
- Intruder. A free plan, and paid plans from $2,870 per 12 months. A good fit if external vulnerability scanning is your priority and cloud posture is secondary. See Intruder compared with bearhug.
- Aikido Security. A free tier, and paid plans from $3,780 per 12 months for 10 users. Suits developer teams wanting code, container and cloud scanning in one tool.
- Cyscale. From $850 a month, billed annually, for up to 1,000 assets. A good fit for SMBs that need posture management across several clouds. See Cyscale compared with bearhug.
If you run across AWS, Azure and Google Cloud, or you need runtime and container protection, a broader platform such as Wiz, Orca or Cortex Cloud may be worth the higher price. Our guide to CSPM vs CNAPP explains when the wider scope is worth paying for, and our Wiz alternatives guide compares the enterprise platforms. If you are only on AWS and do not have a security engineer, it is worth starting with something smaller.
How to keep CSPM costs under control
- Buy for the clouds you use. Multi-cloud coverage is valuable only if you are multi-cloud.
- Model your growth. Work out next year’s price at double today’s resources or headcount, not just today’s.
- Prefer a published price. If you can see the price, you can budget for it without a sales cycle.
- Buy through AWS Marketplace where possible. Charges land on your existing AWS bill, and Marketplace purchases may count towards an AWS Enterprise Discount Program commitment. Check the terms of your agreement.
- Trial on your own account. A trial on real infrastructure shows whether your team will act on the findings, which is where the value is.
What bearhug costs
bearhug costs $100 per AWS account per month, with every feature included and no per-asset counting. One account costs $1,200 a year, three accounts cost $3,600, ten cost $12,000 and 25, a typical mid-sized estate, cost $30,000. It is billed in USD through AWS Marketplace, on your existing AWS invoice, and the monthly plan has no long-term commitment. There is a 14-day free trial, which does not convert to a paid plan automatically. See the full bearhug pricing.
How we compiled these prices
Each price comes from the vendor’s own pricing page or its public AWS Marketplace listing, checked on 29 September 2026. Where a vendor publishes no price, we say so. Prices are in US dollars as listed, exclude taxes, and may vary by region, term and negotiated discount. Annual figures are our own arithmetic from the published price. If anything here is out of date, email support@bearhug.cloud and we will correct it.
CSPM cost questions
Published prices fall into three rough bands. Open-source tools and AWS’s own services cost nothing to license but take engineering time to run. Tools aimed at small teams publish entry prices of roughly $1,000 to $10,000 a year. Enterprise CNAPP platforms publish entry tiers of $24,000 to $84,000 a year for 100 workloads, and larger estates are quoted individually.
For teams on AWS, affordable options include AWS Security Hub (the unified Security Hub is charged per monitored resource and Security Hub CSPM by security checks, each with a 30-day free trial), open-source scanners such as Prowler, and commercial tools with published small-team prices such as bearhug ($100 per AWS account per month), Intruder (from $2,870 per 12 months), Aikido Security (from $3,780 per 12 months) and Cyscale (from $850 a month, billed annually). Which is best depends on whether you need AWS only or several clouds, and how much time your team has to act on findings.
Yes. Open-source scanners such as Prowler are free to license, and some commercial tools, including Intruder and Aikido, offer free plans. AWS Security Hub has a 30-day free trial per account and region. Free tools still cost engineering time to set up, run and interpret.
Vendors charge by different units (assets, workloads, users or cloud accounts), and many sell broader CNAPP platforms that add container, code and runtime security on top of posture management. A price for 100 workloads on a full CNAPP is not directly comparable with a price per AWS account for a posture-only tool.
Often, yes. Tools built on AWS Security Hub and GuardDuty, including bearhug, rely on those services, which AWS bills separately by usage. The larger hidden cost is usually staff time: set-up, tuning and turning findings into fixes.
For a mid-sized business with 25 AWS accounts, a flat per-account CSPM such as bearhug costs $30,000 a year. Platforms priced per workload or per asset scale with the size of your estate instead: Cyscale lists $24,000 a year for up to 5,000 assets, and Orca lists $17,000 a month for up to 500 workloads. Add your cloud provider’s own charges for the underlying services.
AWS Security Hub CSPM is charged by security checks, finding ingestion events and automation rule evaluations, with a 30-day free trial per account and Region. AWS’s examples use $0.0010 per check in the first tier. The newer, unified Security Hub is priced per resource instead. Check AWS’s pricing pages for current rates in your Region.
See what bearhug finds in your AWS account
14-day free trial. The paid plan is $100 per AWS account per month, billed in USD through AWS Marketplace, with no long-term commitment.
No credit card. No procurement. Starts from your AWS console.