Unit economics and the compute bill

The founder-defending numbers, upfront: a single deep agentic security review costs somewhere between $0.04 and $2.40 depending entirely on which model runs it, and that spread is the whole ballgame — it determines whether the product can run a real agent on every PR at a $25/dev/month price point or has to ration deep review to a fraction of traffic. Post-training a small model pays for its own compute bill only once volume clears roughly 10,000-60,000 reviews per month; below that, prompting a frontier model with good scaffolding is cheaper in total. Every number below is built from a stated assumption — check the arithmetic, don't take the conclusion on faith.

#Cost to run one agentic security review

The token math. Post-training playbook's cost model for a long agentic rollout (DeepSWE's 100-200 step episodes) puts a full investigation at 2-8K tokens per turn, 400K-1.6M tokens per episode. A single-PR security review is typically shorter than a full incident investigation, so this page uses its own working assumption, stated explicitly: 50-150 tool-call turns per deep review, averaging ~3.3K tokens/turn, for roughly 500K tokens total — split 85%/15% input/output because context (repo files, prior turns, tool outputs) accumulates and gets resent each turn, while the model's own output per turn is comparatively short. That's 425K input tokens, 75K output tokens per deep review. This is a modeling assumption, not a measured figure — rerun it with your own scaffold's actual turn count before trusting the dollar figures that follow.

Cost driver breakdown, in order of leverage:

1. Context resend without caching — the dominant driver. An agentic loop resending the full accumulated context every turn scales roughly with turns × context-size; prompt caching (charging a fraction of full price for tokens seen in a prior turn) is the single biggest lever available, standard on every major API, though the exact discount is provider-specific [unsourced specific %].
2. Model choice — the second-biggest lever, sourced cleanly below.
3. Number of turns — a scaffold resolving a review in 20 turns instead of 100 cuts cost roughly proportionally; this is CAIBench's "scaffolding dominates outcome variance" finding cited in Post-training playbook (up to 2.6x variance from framework choice alone) applied to cost rather than accuracy.
4. Output verbosity — reasoning-heavy models produce more output tokens per turn, typically priced 4-5x input.
5. Repo/diff size — outside per-customer control, but why "full repo context" costs structurally more than "diff in isolation."

Cost at three model tiers, using sourced per-token prices:

Model tier	Price	Cost/review (425K in + 75K out)
Frontier (Claude Sonnet 4.6-class, $3/$15 per M) [source: GitHub Copilot billing docs]	$3/$15 per M in/out	$2.40
Open 70B-class, served (Llama 3.3 70B, Together AI)	$1.04/$1.04 per M	$0.52
Cheap open small model (gpt-oss-20B, Together AI)	$0.05/$0.20 per M	$0.036

Sources: Together AI pricing, fetched Aug 2026, as cited in Post-training playbook Section 5.4.

Orders of magnitude at volume:

Volume	Frontier ($2.40/review)	Open 70B ($0.52/review)	Cheap small model ($0.036/review)
10 PRs/mo	$24/mo	$5.20/mo	$0.36/mo
1,000 PRs/mo	$2,400/mo	$520/mo	$36/mo
100,000 PRs/mo	$240,000/mo (~$2.9M/yr)	$52,000/mo (~$624K/yr)	$3,600/mo (~$43K/yr)

At 10 PRs/month, model choice barely matters — the whole line item is noise against salaries and infra overhead. At 100,000 PRs/month, it's the difference between a $2.9M and a $43K annual compute line, which is the entire argument for why unit economics, not raw capability, is the reason to post-train — see below.

#Gross margin analysis: how many agent runs can you afford?

This is the central economic question for a PR-review product, and the arithmetic is checkable in one line: allowable COGS per review = price/dev/month × (1 − target gross margin) ÷ PRs reviewed per developer per month.

Two inputs need an explicit assumption. Target gross margin: this page uses 80%, a standard SaaS benchmark [unsourced, industry-typical figure, not from the research notes]. PRs per developer per month: no source in the underlying research states this; this page uses 20 as a working midpoint [estimate] — rerun with your own org's actual PR velocity, which plausibly ranges 10-40 depending on team size and diff granularity.

List price	COGS budget/dev/mo (80% margin)	Budget per review (20 PRs/mo)
$25/dev/mo (Snyk/Socket Team tier)	$5.00	$0.25
$50/dev/mo (Socket Business tier)	$10.00	$0.50
$105/dev/mo (Snyk Ignite)	$21.00	$1.05

Lay this against the per-review cost table above:

The practical answer every vendor in this category has converged on, even without stating it in economic terms: tiered triage, not uniform deep review. Run a cheap, fast first pass (small model, or non-LLM static analysis) on every PR, and escalate only a fraction — the ones that trip a heuristic or a cheap model's own low-confidence flag — to an expensive deep agentic review. If roughly 10-20% of PRs get escalated, blended cost per PR drops close to the cheap-tier number while frontier-quality review still runs on the subset that needs it. This is the concrete mechanism behind Semgrep's "auto-triages 60% of incoming findings" claim and Corgea's tiered fix-quota structure in Who buys, and what they pay — not just a product design choice, but a margin-survival requirement at the $25-50/dev/month price points where most of the market sells.

#Why post-training is an economic argument before a capability argument

Post-training playbook's own verdict, restated in cost terms: post-training a full agentic security model to beat a frontier model plus good scaffolding on raw capability is not supported by current evidence — CAIBench shows scaffold choice alone produces up to 2.6x variance on the same underlying model, and every agentic security benchmark surveyed (CyberGym ~20%, Repair-CVE-Bench ~21%, CyberChainBench 23.4% patching) shows the field nowhere near saturated even with frontier models. A smaller post-trained model starting from a weaker base starts from a worse position on a genuinely hard task, not a solved one.

The economics case is separate and stronger. Post-training a 32B-class model with long agentic rollouts costs $30,000-$60,000 in raw compute for the RL stage alone (DeepSWE's anchor: 9,216 H100-hours at Nebius on-demand pricing of $3.85/GPU-hr ≈ $35,500), and $100,000-$200,000 in total compute once you account for the SFT warm-start stage and the 2-4x compute typically burned on failed/tuning runs before a released checkpoint Post-training playbook Section 5.3.

Break-even volume, worked through:

• Frontier-vs-70B comparison ($2.40 → $0.52, savings of $1.88/review): a $150,000 program (midpoint of the $100K-200K range) breaks even at ≈79,800 cumulative reviews. At 1,000 reviews/month, that's 80 months — too slow to matter. At 10,000 reviews/month, ≈8 months. At 100,000 reviews/month, ≈24 days.
• Frontier-vs-cheap-small-model comparison ($2.40 → $0.036, savings of $2.36/review): the same $150,000 breaks even at ≈63,600 cumulative reviews — 64 months at 1,000/month, 6.4 months at 10,000/month, under 3 weeks at 100,000/month.

The deployment-constraint case for post-training (air-gapped/on-prem customers, no-refusal calibration for legitimate defensive work) doesn't wait for this volume threshold — see Post-training playbook — but the pure cost argument does, and the two should not be conflated when justifying the spend.

#The training budget: 12 months, 5-person lab

Post-training playbook's own budget table, condensed, using Nebius on-demand H100 pricing ($3.85/GPU-hr, cheapest of the surveyed providers) as the GPU anchor:

Line item	Low	High
Salaries (5 people, fully loaded) [unsourced, standard comp assumption]	$900K	$1.6M
Environment/harness engineering (containerization, ARVO-style pipeline)	$60K	$150K
SFT warm-start runs (7B-32B, multiple iterations)	$15K	$50K
Agentic RL runs (multiple iterations toward a released checkpoint)	$150K	$400K
Eval infrastructure, repeated benchmark runs	$20K	$60K
Serving/inference (internal dogfooding + pilot deployment)	$10K	$80K
Frontier-API costs for data generation/distillation	$20K	$100K
Misc: storage, tooling, licenses	$15K	$40K
Total (excl. salaries)	~$290K	~$880K
Total (incl. salaries)	~$1.2M	~$2.5M

The naive "just the training run" number quoted in blog posts ($30-60K for a single RL pass) understates the real 12-month program cost by roughly an order of magnitude once environment engineering, iteration, and evaluation are counted. Budget accordingly, and treat the DeepSWE-anchor figure as a lower bound on a single run, not the program cost.

#Cost per vulnerability found and fixed

The AIxCC finals are the best public anchor for what it costs an autonomous system to find and correctly patch one real vulnerability AIxCC: the closest thing to a proof. Using the top three teams' self-reported compute+LLM spend against their finals patch counts (spend figures are the teams' own post-competition analysis, not DARPA's, and are marked unverified accordingly):

Team	Spend [unverified]	Patches	Cost/patch [unverified, computed]
Team Atlanta (1st)	$103,300	41	≈$2,520
Trail of Bits (2nd)	$39,600	19	≈$2,084
Theori (3rd)	$31,800	20	≈$1,590

That clusters around $1,500-$2,600 per validated patch — a competition-setting number (28+ open-source repos, a fixed 30-hour finals window, teams optimizing for score, not production cost discipline), not a production SaaS number, but the best public anchor for "what does it cost an autonomous system to find and correctly fix one real bug."

A traditional manual pentest engagement runs $5,000-$50,000 (Astra Security, Aug 2026) — but that's scoped to an engagement, not a per-vulnerability rate, and the underlying research does not disclose a typical findings-per-engagement count, so a direct per-vulnerability comparison would require inventing a number this page doesn't have. What can be said honestly: a bounded, days-long engagement costing $5K-$50K that surfaces even a modest number of real findings puts human-pentester cost-per-finding in the same order of magnitude as AIxCC's autonomous cost-per-patch, or higher for a narrowly-scoped engagement — the two aren't obviously different in raw per-finding cost, which is the interesting result: autonomous systems aren't yet dramatically cheaper per validated finding than a skilled human, they're dramatically cheaper per unit of continuous coverage.

That distinction is the whole game. A human pentester is activated once, for a bounded scope, over days. An automated review runs on every PR continuously, at the marginal cost computed above ($0.04-$2.40/review) — most of which find nothing, since most PRs don't introduce a real vulnerability. If, hypothetically, 1 in 50 reviewed PRs contains a real, fixable finding [unsourced hit-rate assumption], cost-per-actual-finding at the open-70B tier is $0.52 × 50 ≈ $26 — one to two orders of magnitude below AIxCC's per-patch figure or a human engagement's implied per-finding cost. The gap narrows at lower hit rates (1-in-200 pushes it to ≈$104) and widens at the cheap-model tier (≈$1.80 at 1-in-50). Either way, continuous low-cost triage is structurally cheaper per finding than periodic comprehensive human engagement at real volume — the same crossover logic as the post-training break-even above.

#Where the pricing power actually is

The Go to market recommendation to give away detection and charge for fixing and compliance evidence follows directly from this cost structure, not just from competitive positioning: the marginal cost of the free tier is genuinely low enough to sustain at scale (pennies per review at the cheap-model tier), while the paid tier captures value where buyers are actually starved — precision and validated remediation — rather than competing on a detection commodity that Microsoft, Google, and Cursor can subsidize indefinitely.

#What this means for us

• Build tiered triage (cheap first-pass, escalate a minority of PRs to deep review) into the architecture from day one — a uniform deep-review-on-every-PR design does not survive contact with an $25-50/dev/month price point using any model tier this page priced.
• Don't fund a post-training program on capability grounds alone; fund it once monthly review volume is plausibly approaching the 10,000-60,000/month range (roughly 500-3,000 active developers), and separately justify any earlier post-training spend on deployment constraints (air-gapped, on-prem, no-refusal calibration), not on cost.
• Model the 12-month training budget at $1.2M-$2.5M all-in for a 5-person lab, not $30-60K — the single-run number that gets quoted is a lower bound on one RL pass, not the program.
• Price the free tier assuming real, sustained marginal cost (not zero) — even the cheap model tier costs real money at 100,000+ reviews/month ($3,600-$43K/mo), and that number needs to be in the model before promising unlimited free scanning.
• Charge for validated autofix and compliance-evidence generation, not for scanning — the data says pricing power sits there, and it's also where the durable, cross-vendor buyer complaints (false positives, alert fatigue) actually live, per Who buys, and what they pay.
• Every dollar figure in this page rests on a stated assumption (token count per review, PRs per developer, target margin, hit-rate per PR) — rebuild the model with real numbers from the actual product and scaffold before using any of these figures in a board deck.