GRC
$49 / $99 / $179/ mo
Tiered by framework count: 1, up to 3, or all 12. Policies and the risk register are included in every tier.
Pricing
Prices you can see
Working list prices for quoting. Billing is by invoice, not in-app checkout. Annual prepay saves about two months. Add-ons are enabled by CyberEnforced after you are invoiced.
Free
$0
Real scanning before anyone asks you to pay.
- Up to 2 domains (subdomains free and uncounted)
- Up to 2 public IPv4 addresses, one scan per IP every 24 hours, schedulable
- Manual Scan now, once per domain per day
- Score, findings, remediation guidance
- CSV/PDF export and shareable report links
Pro
$29/ mo
Unlimited domains and the operations layer.
- Unlimited domains
- Up to 25 public IPv4 addresses, on-demand and scheduled daily scans, branded CSV/PDF export, CISA.gov KEV correlation
- Scheduled daily scans
- Certificate validity tracking (issuer, expiry, days remaining)
- Change digest: new/worse findings, score up/down, expiring TLS and WHOIS, new subdomains
- Extra scan checks (CAA, DKIM, MTA-STS, DNSSEC, HTTPS redirect, and more)
- 90-day scan history and last-vs-now score
- Slack, Teams, or generic webhook alerts on new medium+ findings
- Read-only API access and due-date reminders
- Annual: $290/yr, about two months free
Add-ons (on Pro)
Scanning is the prerequisite. GRC, Vendor Security, and Training do not stand alone. Reach out after you have an account and we invoice, then enable the module.
Vendor Security
$19/ mo
Flat add-on for the vendor inventory, reviews, and optional risk link.
Training & Awareness
$19+/ mo
Up to 10 seats included, then $2 per seat/mo. Assign catalog courses and track completion.
Best value
Compliance Suite
$229/ mo
Pro plus all-12-framework GRC, Vendor Security, and Training in one plan, our recommended “everything” bundle, about 7% under à la carte. Annual: ~$2,290/yr.
What this is not
- GRC evidence is a notes field, with no automated collection from AWS, Okta, or GitHub.
- Plans and add-ons are invoiced; there is no self-serve card checkout in the product.
- Built for SMBs and MSPs serving them, not as an enterprise attestation platform.
For how billing works inside an account, see the billing guide.