Pricing
Priced by cloud environment, not per user
Unlimited users on every plan. You pay for the cloud environments you protect — measured in CEUs. Start free for 30 days, no credit card.
Starter
For small teams that need visibility into their cloud posture.
- Unlimited users
- Built-in controls (AWS + Azure)
- SSO (SAML) & SCIM
- Findings, dashboards & export
- Posture score by framework
- Email support
Professional
For security teams that need custom controls and integrations.
- Everything in Starter, plus:
- Custom controls (Rego / OPA)
- Standard API & webhooks
Business
For teams running many environments that need scale and support.
- Everything in Professional, plus:
- Enhanced API & webhooks
- Priority support
Enterprise
For organizations and MSSPs with many accounts and custom needs.
- Everything in Business, plus:
- Custom cadence & SLAs
- Dedicated support
- Annual contract
Prices in USD, per month. Billing by bank transfer. Custom OPA controls from Professional. SSO (SAML) and SCIM are available on every plan.
Try it free for 30 days — no credit card
Your trial includes 2 CEUs and 250 AI credits. Connect a cloud account and see your posture before you pay anything.
The unit
What's a CEU?
A Cloud Environment Unit is how NimbusGuard meters usage — one CEU is roughly one cloud environment (an AWS account or an Azure subscription), sized by how many resources it holds:
CEUs are pooled across your whole tenant, and users are always unlimited. Need more than your plan includes? Add CEUs at your plan's per-CEU rate.
Provisioned cloud resources across the ~85 types we inventory — compute (EC2, VMs), storage (S3 buckets, storage accounts), databases (RDS, SQL), networking (security groups, NSGs, load balancers), identity (IAM users & roles), KMS / Key Vault keys, serverless (Lambda, Functions) and clusters (EKS, AKS).
High-cardinality child objects: individual S3 objects, log & invocation events, CloudWatch metrics, API calls and IAM policy statements. A bucket with a million objects is still one resource.
Estimate your CEUs
How many cloud environments do you have, by size?
An estimate — final CEUs depend on your actual resource counts.
Add-ons & usage
Extend any plan only when you need to. Everything below is optional.
Additional CEU
$59 / $55 / $49Beyond your plan's included CEUs
Starter / Professional / Business, per CEU / mo
AI credit packs
$99 · $449 · $799Recurring monthly allowance
1k · 5k · 10k credits / mo · resets each period
CWPP (workload protection)
from $9–$15Container & workload scanning, per protected workload / mo
Graduated bands · not included in core plans
Exposure Validation (EASM)
Contact usExternal attack surface + human-approved, controlled pentest
Available on request
Threat Modeling (advanced)
Contact usAttack paths, cut points & threat scenarios
Available on request
Managed Cloud Security
from $999 / moOptional hands-on help — sales-arranged, not self-serve
Guided Remediation from $399/mo · contact us · not required to run the product
"Managed Cloud Security" and "Remediation Support" are optional, bounded engagements — not a 24/7 SOC or MDR service.
Frequently asked questions
How am I billed — per user or per finding? +
Neither. You're billed by CEU (Cloud Environment Unit) — roughly one cloud environment sized by resource count. Users are unlimited on every plan, and we never charge per finding or per control run.
Which resources count toward a CEU? +
CEUs are sized by your managed cloud resources — the things you provision (compute, storage, databases, networking, identity, keys, serverless and clusters). High-cardinality child objects are excluded: individual S3 objects, log or invocation events, CloudWatch metrics, API calls and IAM policy statements. A bucket with a million objects is still one resource.
How do I pay? +
Billing is by bank transfer (wire) today. Prices are listed monthly in USD; annual contracts are available on Enterprise.
Is there a free trial? +
Yes — 30 days with 2 CEUs and 250 AI credits, no credit card required. Connect a cloud account and see your posture before committing.
Which clouds do you support? +
AWS and Azure, with a broad built-in control catalog and your own custom controls in Rego. GCP is on the roadmap.
Can I write my own controls? +
Yes, from the Professional plan up. Author custom controls in Rego (Open Policy Agent), test them against sample data, and publish.
What about workload protection (CWPP)? +
CWPP is available as an optional add-on, priced per protected workload by graduated bands. It scans container images and workloads across ECS, EKS, AKS and Docker hosts. It isn't bundled into the core plans — add it when you need workload scanning.
Do you offer pentesting or attack-surface management? +
Yes. Exposure Validation (external attack surface, real vulnerability scanning, and controlled exploitation only after explicit human sign-off) and advanced Threat Modeling are available on request. They aren't in the standard tiers yet — contact us for access and pricing.