:Pay-as-you-go onboarding policies and billing

Host and container security

After you enable and authorize the service, the host and container security feature of Security Center automatically assigns a protection level to all servers under your Alibaba Cloud account: either Host Protection or Hosts and Container Protection.

Later, you can change the protection level assigned to a server on the Security Center consoleOverview page by using the Quota Management entry. For more information, see Manage host and container protection levels.

Newly added hosts are assigned to the Unprotected protection level by default. We recommend that you use the Quota Management feature to configure the automatic protection level for newly added hosts.

Serverless security

After you enable and authorize the service, the Serverless security feature of Security Center automatically authorizes all Serverless assets under your Alibaba Cloud account.

Later, you can manage the authorization status of assets on the Security Center consoleAssets > Serverless Asset page. For more information, see Manage Serverless asset authorization.

Application protection

After you enable and authorize the service, the application protection feature of Security Center automatically enables full protection (Java processes only) and onboards using the slow rollout method.

Malicious file detection SDK

After you enable and authorize the malicious file detection feature, the system automatically creates and enables a default detection policy named Auto_Create_Config. To modify the policy, navigate to the Malicious File Detection > OSS File Check tab, and click Policy Management in the Policy Configuration section to view and modify the policy. The policy details are as follows:

• Detection scope: All OSS buckets under your Alibaba Cloud account.

• Detection objects: All newly added or updated files after the feature is enabled.

• Execution cycle: Once per day.

• Detection method: No decompression or decryption by default.

Cloud security posture management (CSPM)

• Users who have never enabled the CSPM periodic scanning policy:

  • Scan frequency: Once per day. The specific scan time is randomly generated by the system.

  • Scan scope:

    The system checks for common high-risk configuration issues in security best practices, including misconfigured security protection settings, exposed high-risk ports, public network access via whitelists, public read/write access to data, and risks related to identity authentication and privileged permissions. These checks help improve the security of cloud products and the cloud platform.

    You can view the default scan check items in the Policy Management panel on the Risk Governance > CSPM page of the Security Center console. The selected check items represent the scan scope of the recommended strategy.

• Users who have previously enabled the CSPM periodic scanning policy:

  • Scan frequency: Consistent with the historical configuration.

  • Scan scope: The union of the historically configured check items and the check items included in the recommended scan scope described above.

Vulnerability remediation

• After you enable and authorize the service, the vulnerability remediation pay-as-you-go feature is activated.

• Security Center configures an automatic vulnerability remediation strategy. Every day between 00:00 and 06:00, it automatically remediates high-severity vulnerabilities on all affected assets (including newly added hosts). Before remediation, a snapshot is created and retained for one day. For more information, see Automatic vulnerability remediation.

Agentless detection

• Scan frequency: Once every 5 days.

• Scan scope: All machines, with Default Scan for New Assets selected by default.

Agentic SOC

After you enable and authorize the service, the Agentic SOC feature of Security Center automatically connects to the following Alibaba Cloud services and log sources.

Anti-ransomware

Regularly backs up important file paths on servers. If a ransomware attack occurs, you can use the backup files for fallback recovery. To adjust the protection scope, go to the anti-ransomware policy management page.

Log analysis

Security Center logs are delivered to the log store. By default, logs in mainland China are delivered to China (Shanghai), and logs outside mainland China are delivered to Singapore.

Basic service fee

When you enable any pay-as-you-go feature of Security Center, the system charges a basic service fee. The billing rules are as follows:

• Billing method: Billed based on the duration for which the pay-as-you-go service is enabled.

  Important

  The minimum billing unit is one hour. If the duration is less than one hour, it is billed as one hour.

• Billing cycle: Billed daily.

• Price: USD 0.0072 per hour.

Host and container security

After you enable pay-as-you-go for host and container security, charges are calculated based on the number of servers assigned to the protection level and the actual protection duration (calculated only when the agent is online), billed per second and settled on a daily basis.

Serverless security

erverless security uses a pay-as-you-go, tiered pricing model based on cumulative monthly usage. Billing starts after you activate and authorize your serverless assets.

Application protection

After you enable pay-as-you-go for application protection, the system counts the number of online instances per minute (0–60 seconds) and charges USD 0.0002 per instance per minute, billed on a daily basis.

Malicious file detection SDK

The Malicious file detection SDK feature is billed based on the number of files scanned. After you enable pay-as-you-go for malicious file detection, charges are USD 0.0002 per scan, billed on a daily basis.

Cloud security posture management (CSPM)

• Authorization: The billing unit for paid cloud security posture management (CSPM) features. One authorization is consumed for each successful billable operation (scan, verification, or remediation) on an asset instance.

  For example, if you have 10 products, each with 15 instances, and you use 5 check items to scan all instances, the task will consume 10 * 15 * 5 = 750 authorizations.

• Asset instance: A specific cloud resource, such as an OSS bucket or an ECS security group.

• Check item: Check items are categorized as free or paid.

  • Free check items: The Cloud Service Configuration Risk feature provides some free check items for basic risk awareness. You can perform an unlimited number of scans and verifications, and authorizations are consumed only for repairs.

    Important

    Users who authorized CSPM (formerly cloud product configuration check) before July 7, 2023, can continue to receive the number of free check items corresponding to their Security Center edition (Anti-virus: 80+, Advanced: 90+, and Enterprise/Ultimate: 250+) until their current edition expires.

  • Paid check items: You must purchase the corresponding edition or separately enable the CSPM service. The fees are included in the edition's service or consume authorizations.

Security Center provides 80+ check items free of charge. Free check items are not counted toward scan usage. For the full list of check items in the recommended scanning strategy, see the CSPM periodic scanning recommended strategy section.

CSPM supports both subscription (prepaid) and pay-as-you-go billing models. The specific pricing is as follows:

• Subscription: Unit price × Number of authorized instances (purchase quantity for CSPM) × Subscription duration (based on the Security Center instance subscription duration).

  Number of authorized instances	Price (USD/scan)
  0–100,000	USD 0.0009/scan
  100,001–500,000	USD 0.00069/scan
  Greater than 500,000	USD 0.000625/scan

• Pay-as-you-go: Tiered pricing based on the number of authorized instances, billed on a daily basis.

  Number of authorized instances	Price	Cost calculation formula (Z = number of authorized instances used per day, in scans)
  0–100,000	USD 0.0009/scan	USD 0.0009 × Z (USD)
  100,001–500,000	USD 0.0007/scan	USD 0.0009 × 100,000 + USD 0.0007 × (Z − 100,000) (USD)
  Greater than 500,000	USD 0.00045/scan	USD 0.0009 × 100,000 + USD 0.0007 × 400,000 + USD 0.00045 × (Z − 500,000) (USD)

Vulnerability remediation

After you enable pay-as-you-go for vulnerability remediation, charges are USD 0.3 per remediation, billed on a daily basis. For more information, see Vulnerability remediation pricing details.

Agentless detection

• Agentless detection scan fee

  • Billing method: Pay-as-you-go.

  • Billing cycle: Daily.

  • Unit price: USD 0.03/GB.

  • Billable usage: Calculated based on the actual data volume of the scanned images, not the total disk capacity.

• ECS resource usage fees

  Important

  We recommend that when you configure host detection tasks, you select Retain Only At-risk Image. The system then automatically deletes risk-free images after the scan to reduce storage costs. For the specific procedure, see Retention time configuration.

  • Image fees: The detection task creates an image for the server. You are charged for the image based on its usage capacity and duration. These fees are charged by ECS. For more information, see Image billing.

  • Encrypted disk scanning resource fees: To scan ECS encrypted disks, we create the following resources in your account for each scan. Some resources incur a small fee and are released immediately after the scan completes.

    • ECS instance: When you select Service Key encryption for the ECS encrypted disks to be scanned, we create a preemptive ECS instance for encrypted disk scanning. These fees are charged by ECS. For more information, see Instance type billing.

    • VPC instance: A Virtual Private Cloud (VPC) instance named alibaba-cloud-security-scan-vpc. Creating this instance does not incur any fees.

    • vSwitch instance: A vSwitch instance named alibaba-cloud-security-scan-subnet. Creating this instance does not incur any fees.

Agentic SOC

Agentic SOC is billed based on the log volume of connected services and the data capacity stored in Log Management.

• Subscription:

  • Log Ingestion Traffic: Tiered pricing is used. The minimum purchase is 100 GB/day, with a step size of 100 GB/day. The prices are as follows (where X is the traffic ingested per day):

    • X = 100 GB: USD 0.45 per GB per day.

    • 200 GB <= X < 9,999,999,999 GB: USD 0.42 per GB per day.

  • Log Storage Capacity: USD 100 per 1,000 GB per month. A minimum of 1,000 GB is required, with a step size of 1,000 GB.

  • Intelligent Usage Analysis:

    • The minimum purchase quantity is 100 GB per day. The purchase quantity does not support auto-filling and must match the Log Ingestion Traffic.

    • Pricing: USD 9.6 per 100 GB per day.

      Note

      Usage resets at midnight daily. After exceeding the limit, the system automatically applies rate limiting.

  • Number of Managed Instances:

    • Minimum purchase is 10 instances per month, with a step size of 10 instances per month.

    • USD 1.434 per instance per month.

      Note

      Each instance is counted only once. Duplicate entries are automatically removed.

• Pay-as-you-go: Tiered pricing based on the daily log volume from connected services. The daily bill is the sum of charges across all usage tiers.

  Important

  The minimum billing unit is 1 GB. If the data volume is less than 1 GB, it is billed as 1 GB.

  Log ingestion traffic tier	Price	Fee calculation formula (Y is the traffic ingested per day in GB)
  1 to 10 (GB/day)	USD 2.20/GB	2.2 × Y (USD)
  11 to 50 (GB/day)	USD 1.6/GB	2.2 × 10 + 1.6 × (Y - 10) (USD)
  51 to 100 (GB/day)	USD 1.4/GB	2.2 × 10 + 1.6 × 40 + 1.4 × (Y - 50) (USD)
  >100 (GB/day)	USD 1.2/GB	2.2 × 10 + 1.6 × 40 + 1.4 × 50 + 1.2 × (Y - 100) (USD)

Anti-ransomware

Billed based on the backup file size and storage duration. The price is USD 0.00013 per GB per hour.

Log Management

Billed based on the daily cumulative storage volume (GB). The price is USD 7.2 per 1,000 GB.

Can I modify the recommended strategies after enabling them?

Yes. You can modify the recommended strategies for each feature on their respective management pages.

• To change the protection level assigned to a server, see Manage host and container protection levels.

• To modify the authorization status for Serverless assets, see Manage Serverless asset authorization.

• To modify the default detection policy of the Malicious file detection SDK for OSS files, see Configure the default detection policy for Malicious file detection SDK.

• To modify the CSPM periodic scanning policy, see Configure CSPM periodic scanning policy.

• To modify the Agentless detection scanning policy, see Configure Agentless detection scanning policy.

• To modify the log types connected to Agentic SOC, see Configure Agentic SOC log connections.

• To modify the onboarding configuration for application protection, see Configure application protection onboarding.