DepWarden

DepWarden's free tier (100 scans/month, 3 projects) lets agencies run a zero-cost proof-of-concept for clients, then convert them to a $99/mo Team plan that includes SAST and build gating. This creates a low-friction entry point for a recurring security retainer, especially for agencies that already manage client CI/CD pipelines.

DepWarden's pricing tiers map directly to client scan volume, so agencies can align each client to a plan that preserves margin. The free tier (100 scans/month, 3 projects) suits a one-time audit proof-of-concept. Team at $99/month covers up to 10,000 scans and 100 projects, ideal for a small dev shop with a few active clients. Business at $399/month scales to 50,000 scans and unlimited projects, fitting a DevOps consultancy with many clients or high-frequency CI/CD scanning. An agency reselling DepWarden as a managed retainer should price per client based on their expected scan count, not a flat fee, to avoid margin erosion on heavy users. For example, a client scanning 8,000 times monthly fits Team; charging a $1,500 retainer yields healthy margin. But a client needing 20,000 scans forces a Business plan, so the retainer must exceed $600 to stay profitable. This framework helps agencies select the right plan per client and set retainers that cover costs plus profit.

Every security retainer carries an implicit liability ceiling: the gap between what an agency promises and what an attack surface can actually guarantee. Agencies that sell "we will keep you secure" absorb unlimited downside; agencies that sell defined detection, response, and remediation scopes cap their exposure while still charging recurring fees. The framework asks three questions before signing: what specific asset is protected, what detection window is promised, and who owns the residual risk when a novel attack path emerges. Cogent's VR-1 model maps attack paths across enterprise infrastructure, which reframes the deliverable from "prevention" to "path visibility," a bounded promise. Sentrint grades repository security and generates fix prompts, giving clients a measurable artifact rather than an assurance. Vaultak monitors and rolls back AI agent actions in production, another bounded scope. California SB 813 and AB 1405, signed September 9, 2026, formalize third-party AI audit expectations, which pushes agencies toward documented, auditable scopes instead of blanket guarantees.

Blast Radius Budgeting treats security scope as a function of how much damage a single compromised asset can cause, not how many assets exist. An agency protecting a 40-person client with one shared drive has a smaller blast radius than a 12-person client whose AI agents hold production database credentials. The framework asks three questions per engagement: what can be reached from the weakest credential, how fast can it be revoked, and who eats the loss if it is not. That third question is the pricing lever. Runtime governance layers such as Vaultak intercept agent actions and roll them back automatically, which shrinks the radius and justifies a lower liability premium; frontier reasoning models like Cogent map attack paths across the same infrastructure, which expands the billable discovery phase. California SB 813 and AB 1405, signed September 9, 2026, now formalize third-party audit expectations, so documented radius estimates become client-facing evidence rather than internal notes.

Adopt DepWarden only if you can start with the free tier to validate client demand, then upgrade to Team at $99/mo when scan volume exceeds 100 per month or you need SAST.

Scope every security engagement as detection, evidence, and response support, and never contract for absolute protection.

IF your agency serves clients needing dependency vulnerability scanning and can resell a per-client retainer, THEN start with the Free tier (100 scans/month, 3 projects) to validate, then upgrade to Team at $99/month for 10,000 scans and SAST, or Business at $399/month for 50,000 scans. IF you require white-label reports or deep SAST capabilities beyond basic static analysis, THEN skip because DepWarden lacks documented white-label options and its SAST is basic.

A fixed-fee engagement where an agency audits up to three client projects for dependency vulnerabilities and typosquatting risks using DepWarden, then delivers prioritized remediation reports.