Credential monitoring pricing: what it costs and what you are paying for

Credential monitoring watches public and underground data for login credentials that belong to your company: employee email addresses with passwords from breach dumps, combolists, and the stealer logs produced by infostealer malware. When a match appears, you find out before someone tries the password against your mail, VPN or SaaS logins.

People searching for the price of this usually want two numbers: what it costs, and whether it is worth it for a company of their size. This guide answers both, with the SCRYPEX numbers stated outright and the rest of the market described as accurately as public pages allow.

What you are actually paying for

Four things set the price of credential monitoring, and they explain most of the spread between vendors.

• Data sources. Breach dumps are the floor: everyone has them. The difference is infostealer logs, which contain fresh, working credentials with the exact login URL the victim's browser saved, and which turn over daily. Coverage of stealer logs is the single biggest driver of both cost and usefulness.
• Scope. Most vendors count something: domains, employees, brands, or seats. For a company with one or two domains this should be cheap; it becomes expensive when a vendor only sells in enterprise bundles.
• Alerting and context. A raw feed of matches is noise. The value is in deduplication, telling you whether a password is still in use, scoring it against your password policy, and routing the alert to the person who can reset the account.
• What surrounds it. A leaked password is dangerous in proportion to what it unlocks. Vendors that also map your external attack surface can tell you that the leaked credential belongs to an admin panel that is reachable from the internet. That correlation is where most of the risk reduction is.

How vendors charge

Three models cover nearly every product on the market:

1. Quote-only enterprise platforms. Digital risk protection suites such as ZeroFox and rating platforms such as SecurityScorecard publish no prices; their public pages offer bundles or packages with a “request pricing” button, scoped by brands, domains, executives, takedowns or monitored organizations. See our dated comparisons for ZeroFox and SecurityScorecard.
2. Published tiers aimed at a different job. Some vendors publish prices for one product and not another. UpGuard, for example, publishes Vendor Risk from $1,750 per month billed annually but prices its attack-surface product on request (comparison). Vulnerability scanners such as Intruder charge a base fee plus a fee per target and do not list credential monitoring at all (comparison).
3. Flat monthly plans with the price on the page. This is the SCRYPEX model, described below.

What SCRYPEX charges

Credential monitoring is part of the Business plan at $349 per month (or $3,490 per year, two months free), for up to 5 root domains and 300 monitored assets. It includes:

• Credential breach monitoring for your domains, including infostealer-log matching
• Dark web exposure detection and ransomware threat-actor monitoring
• Password-policy credential scoring, so a weak reused password ranks above a strong unique one
• Public code and secret exposure monitoring
• Everything in Starter: attack surface mapping, misconfigurations, email security, lookalike domains, CISA KEV tracking, and the weekly threat summary email
• Real-time critical alerts, REST API, and 60-day findings history

Pro at $699 per month raises the limits to 15 root domains and 1,000 assets and adds advanced attack-path scoring, outbound integrations (Jira, Slack, Microsoft Teams, ServiceNow) and scheduled reports. Starter at $179 per month does not include credential monitoring. Every plan has a 14-day trial with no credit card. Full details are on the pricing page.

Is it worth it for a company your size?

The honest answer depends on one fact you can check for free: whether your domain already appears in breach data. Run the credential exposure checker. If it shows zero accounts, you are in a good position and the case for continuous monitoring is about staying there. If it shows dozens, some of those passwords are being tried against your logins right now, and the question becomes how quickly you want to know about the next one.

Two more free checks tell you how much a leaked credential would unlock: the free external scan shows what your domain exposes to the internet, and the email security grader shows whether your domain can be spoofed to phish your own staff for more credentials.

Questions to ask any vendor before you pay

• Do you cover infostealer logs, and how fresh are they?
• Do you tell me whether a leaked password is still in use, or just that it leaked?
• What is the unit of pricing, and what happens when I add a domain or ten employees?
• Can I see my exposure before signing anything?
• Is the price on your website?

Related reading: what leaked credentials are and what dark web monitoring actually covers.