// changelog
Changelog: pricing, KEV, and shortlist changes
Log of pricing changes, KEV additions, and shortlist guidance shifts. Updated as primary sources update.
author: Oliver Wakefield-Smith · verified 2026-06-26
// direct-answer
What changed on vulnerabilityscannertools.com this month?
2026-09-22: Snyk re-verified. Team is billed monthly and published as a flat "Starting at $25 / month" for teams up to 10 developers, not $25 per developer; Enterprise moved to a prepaid credit pool at 1 credit = $1. Earlier: 2026-08-08, KEV / CVE counters refreshed (CISA KEV 1,662 entries, NVD 49,044 CVEs YTD); 2026-07-27, four vendors re-verified; launch 2026-06-26. Full history below.
2026-09-22
- Snyk Team corrected on two counts. It is billed monthly, not annually, and the published figure is "Starting at $25 / month" for a development team of up to 10 developers, not $25 per developer per month. Snyk publishes no rate at which Team scales past 10 developers, so we no longer multiply the $25 by a seat count.
- Snyk Team is not a Snyk Code tier. The published Free-versus-Team comparison carries Snyk Open Source, Snyk Code, Snyk Infrastructure as Code and Snyk Container on both plans; the difference is limits, 5 projects and 100 Code tests / month against 100 projects and 1,000 Code tests / month.
- Snyk Enterprise moved to the Snyk Platform Subscription, a prepaid credit pool at 1 credit = $1 with a published rate card (Code 1.0, Open Source 1.0, Secrets 0.66, Evo AI-SPM 0.66, IaC 0.33 per Active Contributor per Day; Container 0.33 per Monitored Image per Day; API and Web 3.0 per Provisioned Target per Day; AI Pentesting 4,000 credits per assessment). The old AppRisk / RBAC / SAML tier description is retired because snyk.io/plans no longer supports it.
- TCO calculator rebased for Snyk. Below 11 proxied developers it now returns the flat $300/yr published Team plan; above that it uses the Enterprise credit rate card rather than multiplying $25 by a seat count. At the default inputs (8 web apps, 13 proxied contributors) the mid figure moves from $3.9k to $9.5k.
2026-08-08
- KEV / CVE counters re-verified against primary feeds. CISA KEV catalog total updated 1,289 to 1,662 (catalogVersion 2026.08.07, released 2026-08-07).
- NVD CVEs published year-to-date updated 28,720 to 49,044 (published 2026-01-01 to 2026-08-08, per the NVD CVE API).
- Ticker refreshed: 6 KEV entries added in the week to 2026-08-07; most recent addition CVE-2026-8037 (Progress LoadMaster). Retired the stale week-of top-exploited callout in favour of a latest-addition marker.
2026-07-27
- Burp Suite Enterprise reclassified to quote-only: PortSwigger rebranded it Burp Suite DAST and withdrew the published Starter $8,395 / Grow $17,380 / Accelerate $49,425 tiers (old /burp/pricing now 404s; /burp/dast/pricing routes to a sales quote).
- Rapid7 InsightVM reclassified to quote-only: pricing folded into Exposure Command packages, and neither the InsightVM nor Exposure Command pricing page lists a per-asset rate. Prior ~$1.75/asset/mo figure retained only as a partner-reported anchor.
- Pentest-Tools.com plans refreshed: renamed to NetSec $95/mo, WebNetSec $140/mo, Pentest Suite $190/mo (from 5 assets), replacing the old Basic / Advanced / Teams labels and $200 / $475 figures.
- HostedScan tiers refreshed: Basic $39 / Premium $109 / Professional $189 per month, plus Flex from $3,500/yr, with a 14-day trial in place of the former perpetual free plan.
2026-06-26
- Site launch. 15 scanners verified, 8 compares published, 4 compliance pages live, full taxonomy.
- KEV ticker initialised at 1,289 entries, 28,720 CVEs YTD, 7 new KEV additions in last 7 days.
- All vendor pages verified against published pricing pages on this date.
- FedRAMP Marketplace cross-checked; Tenable.io, Qualys VMDR (Moderate and High), Rapid7 InsightVM, Wiz all currently Authorized.
Watch list
- Wiz x Google Cloud transition: monitoring for product changes through 2026-2027.
- FedRAMP 20x Phase 2 Moderate general availability (expected late 2026).
- HIPAA Security Rule final rule following 2025 NPRM.
- Snyk Evo rollout and the Enterprise credit rate card: watching for changes to the per-Active-Contributor credit rates and for any published Team rate above 10 developers.
// faq
FAQ
- How often is the changelog updated?On each material pricing change, KEV catalogue refresh, or per-vendor re-verification cycle. Typically weekly to monthly.
- Are KEV updates logged here?Yes, weekly KEV refresh notes appear here when there are material additions affecting shortlist guidance.
- Are vendor corrections logged?Yes, with date, vendor, and the change. See the corrections policy at /how-we-verify-pricing.
- Is there an RSS feed?Not yet. Direct subscription to the page is the current cadence. Planned 2026 H2.
- How to suggest an addition?Email oliver@digitalsignet.com with vendor name, public pricing URL, and a one-line description.