The Security Command Center Premium tier is available as a fixed-price subscription option.

Fixed-price subscription offers a predictable price with no overages or retro-charges. Pricing is based on the forecasted spend on Google Cloud services (not including Google Cloud Marketplace purchases or any Google Premium Support or other Google-provided professional services).

If your total annual Google Cloud spend or spend commitment exceeds $15 million, contact your sales representative or Google Cloud partner to discuss the pricing options available to you.

If your total annual Google Cloud spend or spend commitment is less than $15 million, the annual cost of the Google Cloud component is calculated as follows:

• If you do not have a Google Cloud spend commitment, the cost of the subscription is 5% of your projected annualized run rate of Google Cloud spend based on your current spend levels. The subscription can be purchased for a one-year term.
• If you do have a Google Cloud spend commitment, the cost of the subscription is 5% of the larger of the following:
• Your committed annual spend for Google Cloud services
• Your projected annualized run rate of Google Cloud services spend, based on your current spend levels, adjusted for projected growth.

You can attach the subscription to your new spend commitment contract, or add it to an existing one. In both cases, the subscription must be for a minimum of 12 months, but the term can be as long as the remaining time on the commitment contract. If you entered into a new spend commitment contract within the last 12 months, you may request to extend the subscription beyond the end of the commitment contract by up to 12 months. However, if your current annualized run rate is more than your next period's spend commitment, you can purchase the subscription only up to one year at a time.

The minimum annual cost of a Security Command Center Premium subscription is $15,000.

To purchase a subscription, contact a Google Cloud sales specialist or your Google Cloud partner.

For project-level activations of Security Command Center Premium tier with pay-as-you-go pricing, the charges are based on the usage of certain Google Cloud services within the project.

The following table lists the Google Cloud services, the rates, and the usage metrics that will determine the charges for project-level activations of Security Command Center Premium tier with pay-as-you-go pricing.

As an example, assume that you used the following Google Cloud services during a month:

• 50,000 vCPU hours across a variety of machine types and across various regions.
• 100 BigQuery editions slots for compute (analysis).
• 5 million Class A operations in Cloud Storage.

Based on the preceding usage, the charges for the Security Command Center Premium tier for the month would be calculated as follows:

• 50,000 vCPU-hours * $0.0071 = $355.
• 100 slots * $0.00548 * 730 [average hours in a month] = $400.
• 5,000,000 operations * $0.002/1,000 = $10
• Total cost = $765.

The Security Command Center Enterprise tier is available as a fixed-price subscription.

Fixed-price subscription offers a predictable price with no overages or retro-charges. It has two components: a price to monitor your Google Cloud environments and a price to monitor other cloud environments.

The price for your Google Cloud environments is based on the forecasted spend on Google Cloud services (not including Google Cloud Marketplace purchases Premium Support or other Google-provided professional services).

If your total annual Google Cloud spend or spend commitment exceeds $15 million, contact your sales representative or Google Cloud partner to discuss the pricing options available to you.

If your total annual Google Cloud spend or spend commitment is less than $15 million, the annual cost of the Google Cloud component is calculated as follows:

• If you do not have a Google Cloud spend commitment, the cost of the subscription is 5% of your projected annualized run rate of Google Cloud spend based on your current spend levels. The subscription can be purchased for a one-year term.
• If you do have a Google Cloud spend commitment, the cost of the subscription is 5% of the larger of the following:
• Your committed annual spend for Google Cloud services
• Your projected annualized run rate of Google Cloud services spend, based on your current spend levels, adjusted for projected growth.
• You can attach the subscription to your new spend commitment contract, or add it to an existing one. In both cases, the subscription must be for a minimum of one year, but the term can be as long as the remaining time on the commitment contract. If you entered into a new spend commitment contract within the last 12 months, you may request to extend the subscription beyond the end of the commitment contract by up to 12 months. However, if your current annualized run rate is more than your next period's spend commitment, you can purchase the subscription only up to one year at a time.

The price to monitor your other clouds is based on the size of the other cloud environments relative to the size of the Google Cloud environments. Environment size is measured by the number of assets that are being monitored by Security Command Center. You have the ability to control the number of assets being used in other clouds to maintain this ratio.

The following table shows the size designations and the corresponding subscription fee of the other clouds component.

For example, suppose that the price of your Google Cloud component is $100.00. For the other clouds component, you chose the medium tier. In this case, the price of your other clouds component is $10.00 (10% of $100.00).

The minimum annual cost of a Security Command Center Enterprise subscription is $15,000.

To purchase a subscription, contact a Google Cloud sales specialist or your Google Cloud partner.

Regardless of which tier or activation level you choose, you can incur additional charges that are not directly attributed to Security Command Center, including—but not limited to—the following:

• Any costs associated with additional paid scanners like Sensitive Data Protection or a third-party partner scanner that adds data to Security Command Center. You will be billed by the scanner provider based on their usage fees.
• Any costs associated with resources that are scanned by vulnerability scanners, such as Web Security Scanner, as explained in the following section. Artifact Analysis scanning does not increase resource costs for Artifact Registry or Google Kubernetes Engine (GKE).
• Any costs associated with the ingestion and storage of log data. For more information, see Cloud Logging pricing.

Model Armor is included in Security Command Center Enterprise and Premium tiers. Model Armor can also be purchased and used separately.

Generative AI models break down text and other data into units called tokens. Model Armor uses the total number of tokens in AI prompts and responses for pricing purposes.

Model Armor uses the same token definition as Google Cloud Vertex AI: four characters (using UTF-8 code points) per token excluding white space. This token definition applies to all prompts and responses screened by Model Armor.

Security Command Center includes Model Armor with a predefined number of tokens per month at no additional cost. The use of Model Armor beyond this no-cost monthly allocation is billed separately. See the following table for detailed pricing.

Model Armor can also be used without Security Command Center Premium or Enterprise tiers. In this standalone scenario, there is no cost for using Model Armor up to 2 million tokens per month. Use of Model Armor beyond this no-cost monthly allocation is billed at a rate of $1.50 per million tokens.

For the Premium and Enterprise tiers, certain vulnerability scans that some built-in vulnerability detection services perform can increase the resource costs that are incurred by the scan targets. Artifact Analysis scanning of Artifact Registry does not increase resource costs, and there should be no indirect charges associated with these scans.

These indirect charges are not identified in billing as being associated with Security Command Center or its services.

The built-in Web Security Scanner service can perform these scans.

Examples of the charges that can be incurred at the scan target include the following:

• Incremental usage of App Engine, Compute Engine, and Google Kubernetes Engine.
• Incremental bandwidth (traffic) charges.

The actual amount of traffic generated from a scan depends on the application and the number of URLs, event handlers, forms, and parameters.

For this reason, the Security Command Center services are optimized to keep traffic to a minimum. For example, by default, the scan rate of Web Security Scanner is throttled to approximately 15 queries per second (QPS), with slight variations in the rate due to the asynchronous nature of many web applications. Currently, a large scan stops after 100,000 test requests, not including requests related to site crawling. Site crawling requests are not capped.

Any increase in network egress traffic that might be caused by vulnerability scans is dependent on the number of endpoints and hosted applications at the scan target, because each endpoint or application requires a separate scan.

You can incur charges associated with the ingestion and storage of data from other clouds.

Multicloud support is included with the Enterprise tier.