Consulting in the box or through a partner: how services are sold in 2026 compliance plans

Software collects evidence. People decide scope, write the policies that fit the company, prepare staff for auditor interviews and manage the audit. How a vendor sells that human work changes what its price covers, and it is the criterion on which the vendors in our census differ most.

Model 1: consulting inside a plan

Scytale's pricing page lists two startup bundles with consulting:

• Build DFY ("Done for you", which Scytale labels Most popular): Platform, LaunchReady Consulting and a Pen Test (Web App, Black Box).
• Build Stronger: Platform, StayReady Consulting and a Pen Test (Gray Box).

Its compliance experts page describes a dedicated compliance expert who "manages the entire audit-readiness process", weekly meetings with that expert, and says Scytale takes over management of the audit process with the customer's chosen auditor. Build Starter, the entry bundle, lists the platform and one framework, with add-ons.

This is the row where Scytale scores highest in our census. It is also a row where prices matter: Scytale publishes none, so the value of the bundle can only be judged from a quote.

Model 2: services through partners

Vanta's Essentials plan lists "Access to expert partners for additional compliance services", and Vanta's service provider page describes vCISOs, MSPs and MSSPs. Drata cites 1300+ partners (channel, technology and auditors), with vCISO partners providing leadership.

In this model the platform price and the services price come from different companies. That can be flexible, because you pick the partner, but it means two contracts and two quotes to compare.

Model 3: support and auditor access

Sprinto's Foundation lists support 24x5 by standard email and in-app, plus audit management, Sprinto network auditor access and bring your own auditor. Secureframe's Fundamentals lists access to the Secureframe Audit Partner Network. Neither lists a consulting service in a plan. For teams with an in-house security lead, support and auditor access may be all the human help needed.

Model 4: the auditor as the provider

Thoropass describes itself as auditor-led, with in-house auditor support, and offers automation and the audit from one company. It publishes no plans, so what the support covers is a quote question. Scrut's startup page mentions expert guidance and a playbook, without tying it to a published plan.

What this means for a comparison

Two quotes can differ by the cost of a consultant and still look like platform quotes. Before comparing, put every vendor's human help on the same line:

• Is consulting included, and what does it cover: readiness, policies, audit management?
• Is there a named person, and how often do you meet?
• If services come from a partner, who is the partner and what is their price?
• Is a pen test part of the same contract?

If one vendor bundles consulting and another does not, add a partner's services quote to the second before comparing totals. The quote guide has a one-page scope for this.

Who needs which model

A company with no security staff and a first audit deadline gets the most from services inside the plan, because someone else carries the project. A company with a security lead may prefer a platform with strong limits and support, and buy help only where needed. Set "Need expert or consulting services" to Yes in the calculator to see how each vendor's published plans respond.

Questions that reveal the model

If a pricing page is unclear, three questions usually reveal which model a vendor uses: who writes our policies, who attends the auditor's kickoff, and who we call when a control fails. The answer will be the vendor's staff, a partner's staff or your own team, and each has a different price.

The takeaway

"Includes expert help" means different things on different pricing pages. Read which model a vendor uses, then price the same human work across every quote.