Every developer on Ultimate who never opens a security dashboard is paying triple for the same merge request
GitLab sells Premium and Ultimate per seat per year, every active contributor consumes a seat, and the gap between the two tiers is where enterprise money quietly leaks. The structural decision is tier mix rather than discount, because Ultimate runs roughly three times the Premium rate while the features that justify it concentrate in security and compliance roles rather than across the developer population.
Prepared by Redress Compliance · August 10, 2026 · DevOps advisory. Based on 10 to 14 DevOps platform negotiations including GitLab, 2024 to 2025.
Executive summary
Ultimate runs about three times Premium, and only 20 to 40 percent of users exercised the features that justify it. Premium is the working tier for most development teams, covering pipelines, code review, and project management.
Ultimate adds advanced security scanning, compliance frameworks, and portfolio management at roughly triple the rate, and in our file those capabilities were used mostly in security and compliance roles. A blended contract delivered the same security outcomes for 25 to 40 percent less.
Seat counts included 10 to 15 percent inactive contributors, service accounts, and departed users at every first renewal proposal we audited.
Every user with contributor access consumes a seat, including bots and approvers unless deliberately excluded, so the audit routinely cuts a tenth of the estate before any negotiation begins.
Export the member list with last activity dates, flag anyone inactive for ninety days, every service account, and every reviewer who needs visibility rather than contribution.
A scoped written competitor quote moved GitLab pricing 20 to 35 percent, and no other lever came close.
The platform consolidation pitch is strongest when nobody prices the components, so pricing the equivalent stack from the main alternative, in writing and scoped to your estate, is the single most effective instrument in this category.
A verbal reference does nothing, because the account team is pricing the probability that you would act rather than the possibility.
Uncapped true ups land at list and erase the discount you negotiated. Growth arrives at true up, so fix the true up rate at your negotiated discount and define the measurement window in the order form rather than relying on goodwill.
The AI add on is a separate meter that prices per seat on top of the platform tier, which means enthusiasm can quietly add 20 to 40 percent to the bill: pilot with a measured cohort before any estate wide commitment, and keep it off the platform renewal schedule.
The spend components and the move for each
| Component | Meter | Buyer move |
|---|---|---|
| Premium seats | Per user per year | Default tier for most teams |
| Ultimate seats | Per user per year, roughly 3x | Scope to security and compliance need |
| AI add on | Per seat on top of the tier | Pilot, then license measured adopters |
| Compute minutes | Consumption | Monitor runners, cache aggressively |
| Storage | Consumption | Lifecycle artifacts and registries |
Tier mapping is a people exercise rather than a platform one, which is exactly why the vendor resists it. Quotes tend to resist tier mixing within a single group structure, and enterprise agreements accommodate it when pushed, so the segmentation has to be argued rather than configured.
Scope Ultimate to the projects carrying regulatory or security mandates and the negotiation reframes itself from a discount conversation into a scoping one, which is a much better conversation to be having.
Simplicity is the vendor's saving, not yours: an estate wide top tier is administratively tidy and commercially expensive, and the premium is justified user by user rather than estate by estate.
The seat audit, before the negotiation
- Export the member list with last activity dates, then flag everyone inactive for ninety days, which is the cheapest reduction available and needs no argument.
- Identify service accounts, since automation identities can often be restructured off billable seats entirely rather than counted as contributors.
- Scope the reviewers. Stakeholders who need visibility rather than contribution can sit at lower access levels that do not consume a full seat.
- Map which users actually run security dashboards, compliance pipelines, and portfolio views, because that cohort is the honest Ultimate population.
- Open the negotiation with the cleaned list and the tier mapped cohorts, rather than with a discount request, since the audit alone cut 10 to 15 percent of seats before pricing was discussed.
The vendor negotiation kit
The seat audit method, the blended tier model, the true up cap language, and the competitive anchoring that moves a DevOps platform renewal.
Get the kit →Stacking the levers into real movement
Three levers stack into 25 to 40 percent of movement in a typical renewal, and the order matters because each earns the credibility for the next.
The seat audit comes first, because it is unarguable: inactive contributors, service accounts, and departed users are a data finding rather than a negotiating position, and opening with a cleaned list establishes that you know your own estate better than the account team does.
The blended tier model comes second, mapping the Ultimate premium to the named cohorts that genuinely exercise security scanning, compliance frameworks, and portfolio management, and contracting that split explicitly rather than relying on an informal understanding.
The competitive quote comes third and does the heaviest lifting, because a scoped written alternative moved pricing 20 to 35 percent in our file while no other single lever approached it.
And the platform consolidation pitch that underpins the top tier case is strongest precisely when nobody has priced the components separately.
Two contract terms belong in the same conversation. Cap the true up rate at your negotiated discount with a defined measurement window in the order form, because growth otherwise lands at list and quietly erases the reduction you just won.
And keep the AI add on on its own pilot driven schedule rather than letting it bundle into the platform renewal by default, since it meters per seat on top of the tier and can add 20 to 40 percent to the platform bill on enthusiasm rather than on measured adoption.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across DevOps platform engagements, 2024 to 2025
The standard pitch says estate wide top tier simplifies governance and unlocks the security platform, so the upgrade pays for itself. We disagree. In roughly 7 of the 10 to 14 DevOps deals we advised, the features that mattered were exercised by a fifth to two fifths of licensed users:
Reduction delivered by a blended contract achieving the same security outcomes as an estate wide top tier deployment.
Pricing movement from holding a scoped competitor quote in writing, the strongest single lever in this category by a distance.
Three patterns recurred: estates licensing the top tier across the whole population while the justifying features were exercised by 20 to 40 percent of users, seat counts including 10 to 15 percent inactive contributors, service accounts, and departed users at every first renewal proposal audited.
And buyers holding a scoped written competitor quote moving pricing 20 to 35 percent.
The buyer side move is to map feature usage to named cohorts and pay the premium only where it is consumed. The tier gap is the invoice, and simplicity is the vendor's saving rather than yours. The wider programme sits with Vendor Shield.
Your first five moves
- Run the seat audit before any pricing conversation, since it cut 10 to 15 percent of seats at every first renewal proposal we audited and requires no negotiation at all.
- Map which named cohorts actually run security, compliance, and portfolio features, because the top tier premium is justified user by user rather than estate by estate.
- Contract the blended tier explicitly, top tier for mandated projects and the working tier elsewhere, rather than relying on an informal understanding that evaporates at renewal.
- Get a scoped competitor quote in writing, which moved pricing 20 to 35 percent in our file, because a verbal reference prices as a possibility rather than a probability.
- Cap the true up rate at your negotiated discount and keep the AI add on separate, on its own pilot schedule, so neither growth nor enthusiasm reprices the platform at list. Vendor Shield runs the audit and the renewal with you.
Frequently asked questions
How does GitLab pricing work?
Premium and Ultimate sell per user per year, and every active contributor consumes a seat, including bots and approvers unless deliberately excluded. Ultimate runs roughly three times the Premium rate.
Enterprise discounts track seat volume and term, but the structural decision is tier mix rather than the discount percentage applied to it.
Does the whole estate need Ultimate?
In our file, rarely. The features that justify Ultimate, meaning advanced security scanning, compliance frameworks, and portfolio management, were exercised by 20 to 40 percent of licensed users, concentrated in security and compliance roles.
A blended contract delivered the same security outcomes for 25 to 40 percent less than estate wide top tier licensing.
What does a seat audit typically find?
Inactive contributors, service accounts, and over tiered developers. At every first renewal proposal we audited, seat counts included 10 to 15 percent inactive users, automation identities, and departed staff.
Export the member list with last activity dates, flag ninety day inactivity, and check whether reviewers need contribution access or only visibility.
Will the vendor agree to mixed tiers?
Quotes tend to resist tier mixing within one group structure, but enterprise agreements accommodate it when pushed. Scope the top tier to projects with regulatory or security mandates and contract the split explicitly.
Simplicity is the vendor's saving rather than yours, so the segmentation has to be argued rather than assumed to be unavailable.
What is the strongest negotiating lever?
A scoped competitor quote in writing, which moved pricing 20 to 35 percent in our file. No other lever came close in this category, because the platform consolidation pitch underpinning the top tier case is strongest exactly when nobody has priced the components separately.
A verbal reference achieves very little by comparison.
How should the AI add on be handled?
As a separate meter on its own schedule. It prices per seat on top of the platform tier, so estate wide enthusiasm can add 20 to 40 percent to the platform bill without a measured adoption case.
Pilot with a defined cohort, license the measured adopters, and keep it out of the platform renewal by default.
Why do true up terms matter so much?
Because growth lands at true up and uncapped true ups land at list price, which quietly erases the discount you negotiated.
Fix the true up rate at your negotiated discount and define the measurement window in the order form rather than relying on goodwill, since the people applying it at renewal are rarely the people who agreed it.
