Google Cloud Model Armor: Pricing, Tiers and What's Actually Covered
Google Cloud native prompt-injection, jailbreak, sensitive-data and grounding filter. Free up to 2M tokens per month as a standalone service, or 3 billion tokens a month if you already subscribe to Security Command Center Premium or Enterprise. Sensitive Data Protection inside Model Armor carries no additional charge.
Where this rate sits
Position bar across the cluster of vendors with a paid published rate. Open-source and free-tier offerings are excluded so the bar reflects only commercial published prices.
Model Armor sits at $0.1. Cheapest paid published rate is Bedrock Guardrails at $0.08. Dearest is Model Armor at $0.1. Across 2 vendors with a paid published rate.
Pricing tiers
Verbatim from the Model Armor pricing page on 2026-09-23. Quote-only tiers are surfaced as such, never with an inferred price.
| Tier | Price | Free allowance | Notes |
|---|---|---|---|
| Standalone (first 2M tokens/month) | Free / million tokens | 2,000,000 tokens/month | No cost up to allowance |
| Standalone (above 2M tokens/month) | $0.1 per million tokens | - | A token is four UTF-8 characters excluding whitespace |
| With Security Command Center Premium or Enterprise, subscription | $0.1 per million tokens | 3,000,000,000 tokens/month | Subscription tiers include 3 billion tokens a month at no cost, 1,500 times the standalone allowance |
| With Security Command Center Premium, activated per organization or project | $0.1 per million tokens | 2,000,000 tokens/month | Pay-as-you-go activation carries the same 2M allowance as standalone |
Source: https://cloud.google.com/security-command-center/pricing | Verified 2026-09-23
OWASP LLM Top 10 coverage
What Model Armor defends against, as claimed on its product pages and security documentation. Coverage flags are binary: an item is listed only if the vendor names the attack class explicitly.
- LLM01 Prompt injection
- LLM02 Sensitive information disclosure
- LLM03 Supply chain
- LLM04 Data and model poisoning
- LLM05 Improper output handling
- LLM06 Excessive agency
- LLM07 System prompt leakage
- LLM08 Vector and embedding weaknesses
- LLM09 Misinformation
- LLM10 Unbounded consumption
Hidden costs
Beyond the line-item price, every runtime AI guardrail carries operating costs the vendor page does not surface. Plan for these in any board paper.
- Per-call latency overhead. Guardrail check sits in the request path; budget 50 to 300 ms extra per LLM call.
- False-positive remediation. Allocate engineering time to tune policies after every guardrail rule change.
- Logging and retention. Guardrail decisions need to land in your SIEM. See siemcostcalculator.com.
- On-call coverage. Treat AI security alerts like SOC alerts. See securityoperationscost.com.
What Model Armor is best for
Google Cloud native prompt-injection, jailbreak, sensitive-data and grounding filter. Free up to 2M tokens per month as a standalone service, or 3 billion tokens a month if you already subscribe to Security Command Center Premium or Enterprise. Sensitive Data Protection inside Model Armor carries no additional charge.
Model Armor pricing FAQ
Common questions about Google Cloud Model Armor, answered from the verified figures above. Every answer restates a value from the pricing table, not an inferred one.
How much does Google Cloud Model Armor cost?
Google Cloud Model Armor is priced per million tokens. The cheapest published rate is $0.10 per million tokens (after 2M free monthly). Full per-scope rates are in the pricing-tier table above, taken from the vendor's own pricing page and verified 2026-09-23.
Does Google Cloud Model Armor have a free tier?
Yes. Google Cloud Model Armor has a "Standalone (first 2M tokens/month)" tier at no charge, with a free allowance of 2,000,000 tokens/month. See the pricing table above for the paid scopes.
Does Google Cloud Model Armor defend against prompt injection?
Yes. Google Cloud Model Armor explicitly names OWASP LLM01 prompt injection among the attack classes it covers.