AI coding tools, IDE extensions, and npm packages now show up on machines far outside engineering. License contributing developers on the full platform, and protect everyone else with Dev Machine Guard and Secure Registry at half the price.

Volume discounts available for teams with more than 100 developers

150 contributing developers on Enterprise$2,400 /mo

850 additional devices on Dev Machine Guard$6,800 /mo

Company of 1,000, fully covered$9,200 /mo

Not sure which plan fits?

Start free in minutes and see StepSecurity across your developer machines, CI/CD pipelines, and repositories. Talk to our team anytime for help choosing.

Start Free Request a Demo

Compare plans

The platform, product by product.

CI/CD Security

Harden-Runner runtime security plus governance, policies, and secrets hygiene for your pipelines.

Features	Community	Enterprise
Harden-Runner network and runtime monitoring: every network call, process, and file write correlated to the exact workflow step	✓	✓
Job-level network baselines with anomaly detection, how the tj-actions attack was caught	✓	✓
Egress filtering: block unknown outbound calls at the DNS and network layers	✓	✓
Detect tampering of source code and build artifacts during the build	✓	✓
Runtime insights per workflow run: processes, file writes, outbound destinations	✓	✓
Real-time detection alerts	✓	✓
GitHub-hosted runners on GitHub Cloud, public repositories	✓	✓
Private repositories and GitHub Enterprise Server		✓
Self-hosted runners: VMs, bare metal, ARC Kubernetes clusters		✓
GitLab CI and Azure DevOps pipelines		✓
Workflow run policies: block runs that use compromised actions or attempt secret exfiltration		✓
Actions governance: inventory, security scores, and an approval flow for third-party actions		✓
StepSecurity Maintained Actions: drop-in replacements for risky third-party actions	✓	✓
Actions secrets hygiene: unrotated, unused, and OIDC-replaceable secrets called out		✓

Secure Registry

A policy gate in front of public registries. One rule holds on laptops and in CI.

Features	Dev Machine Guard	Enterprise
Cooldown periods: hold newly published versions for a window you set	✓	✓
Compromised version blocking from StepSecurity threat intelligence	✓	✓
Typosquat protection: lookalike packages never resolve	✓	✓
Org-wide package and version blocklists with one rule	✓	✓
One policy for developer machines and CI/CD	✓	✓
Developers are not blocked: installs succeed with safe versions, logged as Modified	✓	✓
Policy Evaluations log with source attribution: the device or the workflow run behind every request	✓	✓
Run as the upstream of JFrog Artifactory, Sonatype Nexus, or Google Artifact Registry	✓	✓

Code Repo Security

Screen the next PR. Harden the last thousand repos.

Features	Community	Enterprise
GitHub Checks on every pull request, no new tool for developers to learn		✓
Block PRs that pull in compromised package versions		✓
Enforce cooldown periods before new releases are adopted		✓
Posture controls checked daily: branch protection, required reviews, admin enforcement, with guided fixes		✓
Orchestrate Security: define a policy once, StepSecurity opens the fix PRs across every repo	✓	✓
Pin GitHub Actions to commit SHAs across all repos	✓	✓
Set least-privilege GITHUB_TOKEN permissions automatically	✓	✓
Roll out secure Dependabot configs org-wide	✓	✓
Dependency intelligence: answer “are we affected?” with one query across the org		✓
GitHub Apps and PAT visibility: find overprivileged access		✓

Dev Machine Guard

Everything on the machine that can run code, inventoried and controlled.

Features	Dev Machine Guard	Enterprise
AI coding agent inventory: Claude Code, Codex, Cursor, Ollama, and more	✓	✓
MCP server discovery: every server, which AI tools registered it, which devices run it	✓	✓
IDE extension monitoring with risk scores: VS Code, Cursor, JetBrains, Windsurf, and Open VSX	✓	✓
npm and Python packages on disk, checked continuously against threat intelligence	✓	✓
Suspicious file detection with rules maintained by StepSecurity	✓	✓
Device attribution: “which machines have it?” is a query, not a survey	✓	✓
Device Policy: approved extension sets enforced through your MDM	✓	✓
Threat intel detections: know which machines are affected within minutes	✓	✓
Agentless deployment via Intune, SCCM, or Jamf on macOS, Windows, and Linux	✓	✓
Signed and verified loader: Ed25519 manifest and SHA-256 checks before anything executes	✓	✓

Platform & Support

Features	Community	Dev Machine Guard	Enterprise
Centralized Threat Center for full visibility		✓	✓
Actionable threat intelligence across npm, PyPI, actions, and extensions		✓	✓
API access	✓		✓
Support	Community	Priority	Priority

Frequently Asked Questions

How is each license counted?

The Enterprise license is priced per contributing developer: anyone who has contributed to repositories secured by StepSecurity in the last 90 days. The Dev Machine Guard license is priced per device: every machine enrolled through your MDM counts as one, the same way endpoint security tools like CrowdStrike are licensed.

Do developers need a separate Dev Machine Guard license?

No. The Enterprise license includes Dev Machine Guard and Secure Registry for every contributing developer. The $8 per device license covers the machines of everyone else, such as data scientists, analysts, and anyone with development tools on their machine.

Can I buy Dev Machine Guard on its own?

Yes. If you want device and registry protection without the CI/CD and code repo products, license Dev Machine Guard at $8 per device per month across your whole company. Secure Registry is included.

Can I use StepSecurity with private repositories?

Yes. Private repositories are included in the 14-day free trial, and you can start immediately with no sales call. Start free.

Do you offer volume discounts for large teams?

Yes! We offer significant volume discounts for teams with large developer counts. Our pricing becomes very competitive for organizations with hundreds or thousands of developers. Contact us for a custom quote.

How can I terminate my subscription?

You can terminate your subscription anytime by sending us an email at info@stepsecurity.io.

Start in audit mode today

See what your workflows and developer machines are actually doing before you enforce anything.

Start Free Request a Demo