Unit of metering: one named control, one run
Not per seat, not per scanned asset, not per “score”. Every control × run maps to one pinnable, replayable verdict page.
Baseline: control × month
Each registered named control (origin-waf, fail2ban, CF edge…) runs a monthly cycle with verdicts and drift records. The suggested range is anchored on replacing manual re-test days: entry ≈ the re-test part of 1–2 manual pentests a year; standard ≈ quarterly cadence.
On-demand: one run either side of an upgrade
Extra comparison runs around a ruleset/firmware window, metered per run, with a per-case verdict diff report.
AI narrative = add-on, not a premium
When the AI slow path is absent, every verdict still ships. Pay for explanatory power, not for the letters “AI”.
What the invoice can actually explain
- Budget line: device maintenance / manual re-test days (not a new-platform budget)
- Meter: the console “scores” page = control × run detail, same granularity as billing
- No seats, no asset counts, no traffic tiers — those fields do not exist here
Try before talking: fire one at the public range, or leave a contact (a human replies; there is no self-serve signup).