:One-click pay-as-you-go onboarding and billing

Host and container security

After activation and authorization, the host and container security feature automatically assigns a protection level to all servers in your Alibaba Cloud account: Host Protection or Hosts and Container Protection.

You can later go to the Overview page on the Security Center console and use the Quota Management feature to change the protection level assigned to your servers. For more information, see Manage security authorizations for hosts and containers.

The default protection level for new hosts is Unprotected. Use the Quota Management feature to configure an automatic protection level for new hosts.

Serverless security

After completing the activation and authorization, the serverless asset protection feature automatically authorizes all serverless assets in your Alibaba Cloud account.

You can later go to the Assets > Serverless Asset page on the Security Center console and use the authorization management options to manage the binding status of your assets. For more information, see 3.2. Bind or unbind authorized assets.

Application protection

After completing activation and authorization, the application protection feature automatically enables full protection for Java processes only and adds them by using the slow connection method.

Malicious file detection SDK

After activating and authorizing the malicious file detection feature, Security Center automatically creates and enables a default detection policy named Auto_Create_Config. To modify this policy, go to the Malicious File Detection > OSS File Check tab, and click Policy Configuration in the Policy Management area to view and modify the policy. The policy details are as follows:

• Detection scope: All OSS buckets in your Alibaba Cloud account.

• Detection targets: All new or updated files after the feature is enabled.

• Execution cycle: Once per day.

• Detection method: By default, files are not decompressed or decrypted.

Cloud Security Posture Management (CSPM)

• For users who have never enabled a periodic CSPM scan policy:

  • Scan frequency: Once a day. The system randomly generates a specific scan time.

  • Scan scope:

    The scan checks for common high-risk misconfigurations based on security best practices, such as improper security settings, exposed high-risk ports, internet-exposed allowlists, public data read/write permissions, and risks related to identity and privilege management. These checks help improve the security of your cloud products and platform.

    On the Security Center console, you can go to the Risk Governance > CSPM page and view the default check items in the Policy Management panel. The selected check items define the scan scope of the recommended policy.

• For users who have previously enabled a periodic CSPM scan policy:

  • Scan frequency: Same as your existing configuration.

  • Scan scope: The union of the check items in your existing configuration and the recommended scan scope described above.

Vulnerability fix

• After completing the activation and authorization, the pay-as-you-go feature for vulnerability fix becomes active.

• Security Center configures an automatic vulnerability fix policy to run daily from 00:00 to 06:00. This policy automatically fixes high-risk vulnerabilities on all affected assets, including newly added hosts. Security Center creates a snapshot before each fix and retains it for one day. For more information, see View and manage vulnerabilities.

Agentless detection

• Scan frequency: Once every 5 days.

• Scan scope: All machines. The Default Scan for New Assets option is enabled by default.

Cloud Threat Detection and Response (CTDR)

After you complete the activation and authorization, the CTDR feature automatically ingests logs from the Alibaba Cloud products and data sources listed in the following table.

Anti-ransomware

This feature periodically backs up important file paths on your servers. If a ransomware attack occurs, you can use these backups to restore your servers. To adjust the protection scope, go to the ransomware protection policy management page.

Log Management

Security Center delivers logs to a Logstore. By default, it delivers logs to the China (Shanghai) region for accounts in the Chinese mainland and to the Singapore region for accounts outside the Chinese mainland.

Basic service fee

When you enable any pay-as-you-go feature of Security Center, the system charges a basic service fee. The billing rules are as follows:

• Billing method: This fee is billed based on the duration for which the pay-as-you-go service is enabled.

  Important

  The minimum billing unit is one hour. If the duration is less than one hour, it is billed as one hour.

• Billing cycle: Billed daily.

• Price: USD 0.0072/hour.

Host and container security

After enabling the pay-as-you-go feature for host and container security, fees are calculated based on the number of servers assigned to each protection level and the actual protection duration. The duration is measured in seconds and accrues only when the agent is online. Bills are settled daily.

Serverless security

After you enable and authorize serverless assets, serverless protection uses pay-as-you-go, tiered pricing based on cumulative monthly usage.

Application protection

After enabling the pay-as-you-go feature for application protection, the system counts the number of online instances every minute and charges USD 0.0002/instance/minute. Bills are settled daily.

Malicious file detection SDK

Billing for the SDK for malicious file detection is based on the number of files detected, which determines the number of detections. After enabling the pay-as-you-go feature, you are charged USD 0.0002/detection daily.

Cloud Security Posture Management (CSPM)

• Quota: CSPM uses Quota as the unit of measurement for its paid features. Performing a billable operation, such as a scan, verification, or successful remediation on an instance, consumes one Quota unit.

  For example, if you have 10 cloud services and each service has 15 instances, scanning all instances with 5 check items consumes 10 × 15 × 5 = 750 Quota units.

• Instance: An instance refers to a specific cloud resource, such as an OSS bucket or an ECS security group.

• Check item: Check items are categorized as free or paid.

  • Free check items: The Cloud Service Configuration Risk feature provides a set of free check items for basic risk detection. You can run an unlimited number of scans and verifications. Quota is consumed only upon successful remediation.

    Important

    For users who authorized CSPM (formerly Cloud service configuration check) before July 7, 2023, you retain access to the number of free check items corresponding to your original Security Center edition (80+ for Anti-virus Edition, 90+ for Advanced Edition, and 250+ for Enterprise/Ultimate Edition), both before your current subscription expires and upon renewal.

  • Paid check items: These require you to purchase a specific edition or activate the CSPM service. The cost is either included in the edition fee or consumes Quota.

Security Center provides more than 80 check items for free. Scans that use only free check items are not billed. For a list of check items in the recommended scan policy, see Recommended periodic scan policy for CSPM.

CSPM supports subscription (prepaid) and pay-as-you-go billing methods. The fees are as follows:

• Subscription: Price × Number of authorizations × Purchase duration (calculated based on the Security Center instance's subscription duration).

  Authorizations	Price per authorization (USD)
  0–100,000	0.0009
  100,001–500,000	0.00069
  More than 500,000	0.000625.

• Pay-as-you-go: Uses a tiered pricing model based on the number of authorizations consumed and is settled daily.

  Authorizations	Price	Fee calculation formula (Z is the number of authorizations used per day)
  0 to 100,000	USD 0.0009 per authorization	0.0009 × Z (USD)
  100,001 to 500,000	USD 0.0007 per authorization	0.0009 × 100,000 + 0.0007 × (Z - 100,000) (USD)
  More than 500,000	USD 0.00045 per authorization	0.0009 × 100,000 + 0.0007 × 400,000 + 0.00045 × (Z - 500,000) (USD)

Vulnerability fix

After enabling the pay-as-you-go feature for vulnerability fix, you are charged USD 0.3/remediation daily. For more information, see How vulnerability remediation attempts are counted.

Agentless detection

• Agentless detection scan fee

  • Billing method: Pay-as-you-go.

  • Billing cycle: Daily.

  • Unit price: USD 0.03/GB.

  • Billable usage: Calculated based on the actual data volume of the scanned images, not the total disk capacity.

• ECS resource usage fees

  Important

  We recommend that when you configure host detection tasks, you select Retain Only At-risk Image. The system then automatically deletes risk-free images after the scan to reduce storage costs.

  • Image fees: The detection task creates an image for the server. You are charged for the image based on its usage capacity and duration. These fees are charged by ECS. For more information, see Image billing.

Cloud Threat Detection and Response (CTDR)

CTDR billing is based on the volume of ingested logs and the amount of stored data.

• Subscription billing:

  • Log Ingestion Traffic: Tiered pricing is used. The minimum purchase is 100 GB/day, with a step size of 100 GB/day. The prices are as follows (where X is the traffic ingested per day):

    • X=100 GB: USD 0.45/GB/day.

    • 200 GB =< X < 9,999,999,999 GB: USD 0.42/GB/day.

  • Log Storage Capacity: USD 100/1,000 GB/month (Minimum purchase of 1,000 GB, with a step size of 1,000 GB).

  • Intelligent Usage Analysis:

    • The minimum purchase is 100 GB/day. The purchase quantity must be consistent with the Log Ingestion Traffic.

    • Price: USD 9.6/100 GB/day.

      Note

      The usage is reset to zero at 00:00 every day. If the limit is exceeded, the system automatically throttles traffic.

  • Number of Managed Instances:

    • The minimum purchase is 10 instances/month, with a step size of 10 instances/month.

    • USD 1.434/instance/month.

      Note

      Each instance is counted only once. Duplicates are automatically removed.

• Pay-as-you-go billing: Fees are based on the cumulative daily log traffic from your products and use a tiered pricing model. The final daily bill is the sum of the fees from each usage tier.

  Important

  The minimum billing unit is 1 GB. If the data volume is less than 1 GB, it is billed as 1 GB.

  Log ingestion traffic tier	Price	Fee calculation formula (Y is the traffic ingested per day in GB)
  1 to 10 (GB/day)	USD 2.2/GB	2.2 × Y (USD)
  11 to 50 (GB/day)	USD 1.6/GB	2.2 × 10 + 1.6 × (Y - 10) (USD)
  51 to 100 (GB/day)	USD 1.4/GB	2.2 × 10 + 1.6 × 40 + 1.4 × (Y - 50) (USD)
  >100 (GB/day)	USD 1.2/GB	2.2 × 10 + 1.6 × 40 + 1.4 × 50 + 1.2 × (Y - 100) (USD)

Anti-ransomware

Charges are based on the size of the backup files and their storage duration. The price is USD 0.00013/GB/hour.

Log Management

Charges are based on the total daily storage volume (GB). The price is USD 7.2/1,000 GB.

Modifying recommended policies

Yes, you can.

• To modify the protection level assigned to a server, see Manage security authorizations for hosts and containers.

• To modify the authorization binding for a serverless asset, see 3.2. Bind or unbind authorized assets.

• To modify the default detection policy for OSS files in the SDK for malicious file detection, see Malicious File Detection.

• To modify the periodic scan policy for CSPM, see Set and run a check policy.

• To modify the scan policy for agentless detection, see Agentless detection.

• To modify the log types ingested by CTDR, see Connect services to CTDR.

• To modify the access configuration for an application protection policy, see Protection policy management.