Billing Mode Description
CSC offers two billing methods to meet the procurement needs of different enterprises:
|
Prepaid (Yearly/Monthly Subscription) | Purchase monthly in advance to enjoy a lower unit price, suitable for long-term use. | Core Edition: CWPP (Professional Edition) / CWPP (Flagship Edition) |
Prepaid (On-Demand Purchase) | Billed monthly based on actual usage, with flexible on-demand addition. | Extended feature modules (CSPM, DSPM, and so on) |
Core Edition Billing
The Core Edition is purchased on a monthly basis, with billing based on hosts (units) or containers (virtual cores).
|
CWPP (Professional Edition) | 12 USD per host per month | Entry-level CWPP, basic host protection |
CWPP (Flagship Edition) | 27 USD per host per month | CWPP for medium and large enterprises |
Container Runtime Security
Billing mode: You must purchase both CWPP (Ultimate Edition) and Container Cluster Security. Together, they provide runtime security protection for container nodes and clusters.
|
CWPP (Flagship Edition) | Host (unit) | 27 USD per host per month | Protect node security within container clusters |
Container cluster security | Core (vCore) | 6.75 USD per core (vCore) per month | Protect container cluster security |
Note:
Container security protects container nodes, clusters, and images. It provides full-lifecycle protection through a combination of container image scanning, CWPP (Ultimate Edition), and container cluster security.
Container Image Scanning
Billing policy: pay-as-you-go, with the number of images as the billing unit.
|
Container image scanning | Number of images | USD 0.1/image | Repeated scans of the same image are not billed. |
Cloud Resource Configuration Check (CSPM)
Billing is based on the number of checks using a progressive tiered model: the higher the usage, the lower the unit price.
|
0 ~ 100,000 times | USD 0.0009 per time |
100,001 ~ 500,000 times | USD 0.00069 per time |
More than 500,000 times | USD 0.000625 per time |
Minimum purchase quantity: 15,000 times; Purchase step: 55,000 times.
Cost Example: 220,000 checks per month
First 100,000 times: 100,000 × 0.0009 = USD 90
Next 120,000 times: 120,000 × 0.00069 = USD 82.8
Total: USD 172.8 / month
Quota Consumption Logic: The cloud resource configuration check is calculated cumulatively and consumes quota based on the number of assets per rule execution. Example:
|
Unauthorized public network access to ES | Number of ES instances: 10. | 10 |
Unauthorized public network access to cloud database KeyDB | Number of cloud database KeyDB instances: 5. | 5 |
Total | - | 15 |
Note:
CSC provides over 30 free cloud resource configuration check rules (subject to the console display). Executing these rules does not consume quota. Similarly, reviewing detected risks does not consume quota either.
Data Security
Database Risk Monitoring
Billing Model: (Service Edition + Database Risk Monitoring Extension Pack) * Service Duration.
Service Version
|
Pro Edition | The Professional edition provides basic data security management capabilities. Its main specifications include: 3 database instances; 8,000 SQL statements/second peak throughput; 200 million online SQL statements storage; 0.5 TB log storage space. | 830 USD/month |
Database Risk Monitoring Extension Pack
|
Log storage expansion pack | 1 TB log storage | 150 USD/month |
Database instance expansion pack
| 0 - 20 instances | 270 USD per instance per month |
| 21 - 50 instances | 255 USD per instance per month |
| 51 - 100 instances | 240 USD per instance per month |
| 101 - 200 instances | 225 USD per instance per month |
| 201 - 300 instances | 210 USD per instance per month |
| 301 - 400 instances | 195 USD per instance per month |
| 401 - 500 instances | 180 USD per instance per month |
| More than 500 (exclusive) | 150 USD per instance per month |
Note:
Each Database Instance Extension Pack includes: 1 database instance; 1,000 SQL statements/second peak throughput; 20 million online SQL statements storage; 0.1 TB log storage space.
Database Instance Extension Packs are billed using tiered pricing: the total usage is calculated based on the unit price corresponding to the range of actual asset instances.
Application and TencentCloud API Risk Governance
|
TencentCloud API Risk Governance | Account AK (each) / month | 14 USD per instance per month | Minimum purchase: 60 AKs; no additional charges beyond 500 AKs. |
Note:
TencentCloud API Risk Governance Billing Cap: When the number of account AKs exceeds 500, billing will not increase further, and the maximum fee is capped.
Log Analysis
|
Log storage capacity | 0.13 USD per GB per month | Linear pricing |
Billing Model Description
Understanding the three billing models helps accurately estimate costs:
|
Linear pricing | Fixed unit price, cost = unit price × usage. | Log storage: 100GB × 0.13 = USD 13. |
Progressive tier (left-open, right-closed) | Each tier is billed at its own unit price, and usage that spans tiers is billed separately. | CSPM: The portion exceeding 100,000 times is calculated at a lower unit price. |
Attained tier (left-closed, right-open) | Calculate the cost for all usage based on the unit price of the tier in which the actual usage falls. | DSPM asset expansion pack: All 30 units are calculated at USD 255. |
Note:
The calculation methods for progressive tiering and attainment tiering differ. Progressive tiering involves accumulating usage in segments, while attainment tiering applies the unit price of the corresponding tier to the entire usage volume. When usage approaches a tier boundary, you should evaluate the cost impact.
Cost Estimation Guide
Quickly estimate monthly investment based on enterprise scale:
Scenario 1: Small and Medium-Sized Enterprises (20 Servers, Basic Host Protection)
|
CWPP (Professional Edition) | 20 | 12 USD per host per month | 240 USD |
Total | - | - | 240 USD/month |
Scenario 2: Medium-Sized Enterprises (50 Servers + Compliance + Log Analysis)
|
CWPP (Flagship Edition) | 50 units | 27 USD per host per month | 1,350 USD |
Log storage capacity | 500GB | 0.13 USD per GB per month | 65 USD |
Total | - | - | 1,415 USD/month |
Scenario 3: Containerized Enterprises (100 Container Images + 20 Container Nodes + 100 vCore Cluster)
|
Container image scanning | 100 images | USD 0.1/image | USD 10 |
CWPP (Flagship Edition) | 20 | 27 USD per host per month | USD 540 |
Container cluster security | 100 vCore | 6.75 USD per core (vCore) per month | USD 675 |
Total | - | - | USD 1,225 per month |
Note:
Container image scanning is billed once based on the number of images. If the same image is scanned repeatedly within the same month, no duplicate charges are incurred. Therefore, the actual cost depends on the number of unique images after deduplication. Container runtime security requires the combined purchase of CWPP (Ultimate Edition) and Container Cluster Security. Fees are calculated independently based on the number of hosts and the number of cores, and then added together.
FAQs
Q: Can core modules and on-demand modules be purchased together?
A: Yes. All on-demand procurement modules can be purchased additively on top of any core edition and flexibly combined based on actual security requirements.
Q: How is TencentCloud API Risk Governance billed after 500 AKs are exceeded?
A: Billing will not increase after 500 AKs are exceeded. The maximum fee is calculated based on 500 AKs (USD 7,000/month), and no additional charges will be incurred regardless of how many more AKs are added.
Q: What is the difference between CSPM's progressive tiering and DSPM's attainment tiering?
A: Their calculation logic differs. CSPM progressive tiering is billed in segments based on usage intervals, with the portion exceeding a tier calculated at a lower price. DSPM attainment tiering applies the unit price of the tier corresponding to the actual usage volume to the entire usage. Consequently, the unit price jumps when usage crosses a tier boundary. We recommend carefully evaluating your usage when it is near a tier boundary.
Q: Is container image scanning billed per scan?
A: No. Container image scanning is billed based on the number of images. If the same image is scanned multiple times, it is billed only once and will not be charged repeatedly.
Q: For container runtime security, can I purchase only CWPP (Ultimate Edition) or only Container Cluster Security?
A: No. Container runtime security requires purchasing both CWPP (Ultimate Edition) and Container Cluster Security. The former protects the nodes within container clusters, while the latter protects the container clusters themselves. Only when combined do they provide complete container runtime protection.
Q: Do I need to purchase Container Image Scanning, CWPP (Ultimate Edition), and Container Cluster Security at the same time?
A: No, simultaneous purchase is not mandatory. Container Image Scanning is an independent on-demand module that can be purchased separately for security checking at the image level. Container Runtime Security (CWPP Ultimate Edition + Container Cluster Security) is another combination for runtime protection at the node and cluster levels. Enterprises can flexibly purchase either one or a combination of both based on their container security coverage scope (image/node/cluster) to achieve full lifecycle protection.