Compliance in the shell. Not in a six-figure contract.
Skip the $10K/year GRC platform and the part-time compliance consultant. Run one CLI command, ship a SOC 2-ready PR, and use a real free Starter package that doesn't run out before your first customer audit.
$0
Starter
30s
First scan
13
Frameworks mapped
0
Consultants needed
What you get on day one
One-command scanning
npx @cveriskpilot/scan picks up your dependencies, secrets, and IaC drift. No agents, no SaaS account required for the open-source CLI.
Compliance mapped automatically
Every finding routes to NIST 800-53, SOC 2, CMMC, FedRAMP, ASVS, and SSDF controls — the 6 frameworks your earliest enterprise prospects will ask about.
CI/CD-native
Drop a 10-line GitHub Action into your repo. PRs get a compliance verdict, criticals block merge, SARIF flows into the Security tab.
Audit-ready outputs
Open cases become POAM entries with control IDs and milestone dates. Export the POAM as CSV, JSON or XLSX, or an executive summary as PDF, the moment a prospect requests their security questionnaire.
No vendor lock-in
CLI is Apache-2.0 on npm. Self-host the scanner forever. Create a free account only when you want AI triage, the dashboard, or the full 13-framework catalog.
Founder-priced
Starter includes 50 AI triage calls and 3 scan uploads a month, unlimited local CLI scans, and all 13 frameworks during the alpha. Audit Readiness at $149/mo when you need 1,000 calls, AI chat and unlimited uploads.
From zero to compliance evidence in an afternoon
Step 01
Install
npx @cveriskpilot/scan@latest. Runs locally, no signup. Outputs JSON, SARIF, or human-readable.
Step 02
Wire into CI
Paste the GitHub Action snippet into .github/workflows/. Every PR now has a compliance check.
Step 03
Sign up free
Send CLI results to the Pipelines page with an API key, or upload scanner files to get cases, AI triage and per-framework posture scores.
Step 04
Ship the security packet
When a prospect asks for SOC 2 evidence, export the POAM (CSV, JSON or FedRAMP-format XLSX) and an executive summary PDF; audit-log export is available on paid plans.
Compliance shouldn't be the reason you can't close enterprise.
Start with the free CLI. Upgrade only when an enterprise customer pushes you past the limits — by then you'll already be making revenue.