Priced by audit outcome14-day trial
Pick the audit you're preparing for.
Each package turns scanner output into control-mapped findings and an audit-ready POAM for a specific assessment. Start free, trial Audit Readiness, or scope a CMMC Level 2 assessment with our team.
Starter
Individual practitioners evaluating on real data
$0forever, no credit card
See which controls your scan findings threaten, and what your team should learn next.
All 13 frameworks during the alpha
- 50 AI triage calls / month
- 3 scan uploads / month
- Unlimited local CLI scans
- POAM export (CSV, JSON, XLSX)
- Training recommendations from your findings
- Community support
Most teams start here
Audit Readiness
Small GRC and security teams preparing for a commercial audit
$149/ month, 14-day trial
Walk into your SOC 2, HIPAA or PCI DSS audit with a POAM already built and training evidence tied to real findings.
SOC 2HIPAAPCI DSSISO 27001NIST CSF 2.0
- 1,000 AI triage calls / month
- Up to 5 users
- Unlimited scan uploads
- Findings mapped through their CWE to your framework controls
- POAM export (CSV, JSON, XLSX)
- Learning paths, knowledge checks and a team training dashboard
- Training assignments, completion tracking and auditor evidence export
- AI chat on your workspace data
- Jira and ServiceNow ticket push
- Email support
Federal Assessment
Defense contractors and federal suppliers handling CUI
Scopedper assessment boundary
Get to a defensible CMMC Level 2 or FedRAMP-style POAM before your assessment.
CMMC Level 2NIST 800-171NIST 800-53FedRAMP
- Everything in Audit Readiness
- CMMC Level 2 self-assessment workflow and SPRS estimate
- FedRAMP-style POAM generation
- CMMC AT.L2 training evidence (3.2.1–3.2.3) via the awareness path
- Case approval workflow for risk decisions
- SSO, set up with our team
- Built by a 100% Veteran Owned company
Partner
MSSPs, vCISOs and assessment firms
20–30%recurring revenue share
Deliver compliance-mapped vulnerability reports and findings-driven training across your client base.
All 13 frameworks
- Manage multiple client organizations
- Recurring commission on referred customers
- Client-ready POAMs and compliance impact reports
- Run findings-driven training paths across client organizations
- Partner onboarding with our team
All packages include unlimited local CLI scans. Run without an API key, the CLI reports the core 6 frameworks; add an API key from any package to see all 13.
Self-serve plans
What Starter and Audit Readiness include.
Starter runs on the Free plan and Audit Readiness on the Pro plan. Federal Assessment and Partner are scoped with our team.
| Feature | Free Free | Pro $149/mo · 14-day trial |
|---|---|---|
| Users | 1 | 5 |
| Monthly uploads | 3 | Unlimited |
| AI triage calls | 50/mo | 1,000/mo |
| AI chat (uses AI calls) | ||
| Compliance frameworks (during the alpha) | 13 | 13 |
| API access | ||
| Risk-based AI triage routing | ||
| POAM export (CSV, JSON, XLSX) | ||
| Jira and ServiceNow ticket push | ||
| SLA policies | ||
| Webhook endpoints with signed test delivery | ||
| Report schedules (automated delivery planned) | ||
| Outbound webhook event delivery | Planned | Planned |
| Automation rules | Planned | |
| Email support |
- Why packages instead of plans?
- Teams buy CVERiskPilot to get through a specific audit, so we price by that outcome. Starter and Audit Readiness are self-serve and run on the Free and Pro plans. Federal Assessment is scoped per assessment boundary because CMMC Level 2 and FedRAMP-style POAMs depend on how much of your environment handles CUI or federal data. Partner pricing for MSSPs and assessment firms is a 20–30% recurring revenue share; resellers can buy at the wholesale rate.
- What does the Federal Assessment package include?
- Everything in Audit Readiness, plus the CMMC Level 2 self-assessment workflow with an SPRS estimate, FedRAMP-style POAM generation, the case approval workflow for risk decisions, and SSO set up with our team. CMMC status as of October 2026: Phase 2 assessments are suspended pending DoW review. Self-assessments and SPRS affirmations still apply. Contact us to scope your assessment boundary.
- Is there a free tier?
- Yes. The Free plan includes 50 AI triage calls and 3 scan uploads per month, unlimited local CLI scans, POAM export as CSV, JSON or XLSX, and, during the alpha, mapping to all 13 compliance frameworks in the web app. No credit card required.
- What is AI chat?
- AI chat is a conversational interface inside your workspace where you can ask questions about your vulnerability data — 'Which findings are KEV-listed?', 'What's my HIPAA compliance score?', 'Show me critical findings from last week.' It answers from your organization's data only. It is included with Pro, and each message uses one of your monthly AI calls.
- How does AI triage pricing work?
- Each AI triage call returns a priority, recommended action, reasoning and confidence score for one finding; its compliance impact comes from the finding's CWE mapping. Free gets 50 calls/month and Pro gets 1,000. Routine findings go to a fast external model, and high-stakes or low-confidence cases escalate to larger external models under the same safety policy.
- What's the difference between Starter and Audit Readiness?
- Audit Readiness runs on the Pro plan ($149/mo) for teams that need higher volume: 1,000 AI triage calls a month instead of 50 and unlimited scan uploads instead of 3 a month. Audit Readiness also adds up to 5 users, AI chat, Jira and ServiceNow ticket push, webhooks, custom SLA policies and email support. Both get the same risk-based triage routing, POAM export and, during the alpha, all 13 frameworks.
- Is there a Pro trial?
- Yes. The public Pro path currently starts with a 14-day trial during signup. Free remains available with no credit card required, and Pro is the fastest path if you already know you need more triage volume.
- Can I upgrade or downgrade at any time?
- Yes. Upgrades take effect immediately with prorated billing. Downgrades take effect at the end of your current billing period. To move from a self-serve package to Federal Assessment or Partner, contact our team.