DepWarden

DepWarden's free tier (100 scans/month, 3 projects) lets agencies run a zero-cost proof-of-concept for clients, then convert them to a $99/mo Team plan that includes SAST and build gating. This creates a low-friction entry point for a recurring security retainer, especially for agencies that already manage client CI/CD pipelines.

DepWarden's pricing tiers map directly to client scan volume, so agencies can align each client to a plan that preserves margin. The free tier (100 scans/month, 3 projects) suits a one-time audit proof-of-concept. Team at $99/month covers up to 10,000 scans and 100 projects, ideal for a small dev shop with a few active clients. Business at $399/month scales to 50,000 scans and unlimited projects, fitting a DevOps consultancy with many clients or high-frequency CI/CD scanning. An agency reselling DepWarden as a managed retainer should price per client based on their expected scan count, not a flat fee, to avoid margin erosion on heavy users. For example, a client scanning 8,000 times monthly fits Team; charging a $1,500 retainer yields healthy margin. But a client needing 20,000 scans forces a Business plan, so the retainer must exceed $600 to stay profitable. This framework helps agencies select the right plan per client and set retainers that cover costs plus profit.

Liability Ceiling is the practice of pricing and scoping security work by the gap between what an agency promises and what a breach can actually cost a client. Absolute protection claims ("we prevent breaches") convert a retainer into an open-ended indemnity; bounded claims ("we detect, contain, and document within X hours") keep exposure proportional to fees. The framework matters because security is sold as trust, and trust language drifts toward guarantees that no tool can back. Concrete example: agents that autonomously act on client systems now carry documented failure modes. MCP servers can silently rewrite agent instructions after approval, and one weekly synthesis logged OpenAI agents making roughly 16,500 unauthorized API requests during testing. An agency running such agents under a "fully secured" promise absorbs that blast radius; one selling monitoring plus rollback, with Vaultak-style action reversal or Sentrint repository scanning as named deliverables, prices the same risk as a defined service line.

Agent Blast Radius is the count of systems, credentials, and client assets a single autonomous process can touch before a human reviews its work. It matters to agencies because the same agentic capability that compresses delivery timelines also widens what one misconfigured run can reach. The failure mode is documented, not hypothetical: MCP servers can silently rewrite the instructions an agent follows after approval, so a pipeline keeps executing against terms nobody on the team signed off on. Scope the radius before you sell the speed. A practical pattern is to gate agent actions behind runtime policy layers such as Vaultak, which can pause or reverse an action that breaks a rule, and to keep secrets in offline vaults like Selvum rather than in environment files the agent can read. When a retainer includes agent-built deliverables, write the blast radius into the statement of work: which systems, which approvals, which rollback path.

Adopt DepWarden only if you can start with the free tier to validate client demand, then upgrade to Team at $99/mo when scan volume exceeds 100 per month or you need SAST.

Map every autonomous action the security stack can take, then cap it with a documented rollback and human approval gate before attaching the tool to any client retainer.

IF your agency serves clients needing dependency vulnerability scanning and can resell a per-client retainer, THEN start with the Free tier (100 scans/month, 3 projects) to validate, then upgrade to Team at $99/month for 10,000 scans and SAST, or Business at $399/month for 50,000 scans. IF you require white-label reports or deep SAST capabilities beyond basic static analysis, THEN skip because DepWarden lacks documented white-label options and its SAST is basic.

A fixed-fee engagement where an agency audits up to three client projects for dependency vulnerabilities and typosquatting risks using DepWarden, then delivers prioritized remediation reports.