Because often those security features come with a lot of excess infrastructure and architecture/re-engineering requirements. Would you prefer we lifted the fee for everyone including small businesses who don't need it to keep the margins we've got?<p>I agree it's silly binding features to tiers, for example having to buy an Enterprise license to get MFA is ridiculous (looking at you _every_ Oracle competitor). You _should_ be able to pay a per-seat, per-resource or flat fee to get each additional feature. Security isn't for Enterprise only.<p>I'll give you some fair examples:<p><i>Audit logs</i>: Every action every user makes on the platform, usually for a fixed period - often between 2 and 7 years. For thousands of users, or in publicly shared websites or end-user-customer-facing websites, this can be hundreds or millions of extra users all generating hundreds and thousands of logs each per year. And if we add any more features to the platform? The problem compounds, and it gets more expensive to support the additional resources. We also have to integrate with every SIEM or partner with a third-party to expose the functionality, none of which use the cheap "bulk data export" option but incrementally export logs continuously using shitty CRUD API's we developed for the front-end. God help us all if I chose AWS and I don't get to meet with someone who reports to Bezos to negotiate a deal. I'm gonna get screwed.<p><i>SSO/SAML integration</i>: For a subset of our customers, say 5%, we have to allow and cater for the design of major IdP's. Even billion dollar companies like Slack can't cater for the design of Google Groups and integrate with them properly, how the fuck am I with my mere 100-person engineering team supposed to cater for each and every IdP and weird implementation they require? Great, now I've got to retrofit my architecture to support design choices made by companies who only care about authentication and RBAC of a very generic company structure. They don't need to cater for everyone, but now <i>I do</i>?<p><i>MFA/2FA</i>: Now I have to add support for either email or SMS because "hardware tokens are too hard" or "we need a backup option for if I lose my phone", and a whole 24/7 operational process to support it because every now and then that shitty cell tower in Turkey or New Zealand goes down and that one, critical SVP at their holiday home can't login. Great, my support staffing costs have gone up exponentially, and it's only to cater the 2% of dinosaur executives that can't figure out how a fucking Yubikey works without calling me for support like I'm their fucking grandkid.<p>None of this is easy. It's all hard because tech's expensive, process is expensive and most importantly people are expensive.<p>Anyone who questions Enterprise SaaS software costs in 2022 doesn't understand the end-to-end cost of running and supporting Enterprise software. There's no such thing as a free meal, just because you're used to paying $2/mo for your shitty personal blog which integrates with all the modern security features you've come to expect at an Enterprise, doesn't mean it'll translate to your custom Enterprise CRM or your wacko-Enterprise integration.