Market log recap: compliance announcements from December 2025 to September 2026
Short answer
This recap covers dated items from December 2025 to September 2026 in our market log: Comp AI's $34M Series A, Scytale's AI third-party risk launch and recognitions, and four AICPA and Journal of Accountancy items on SOC engagements. None changed a published price in our census.
By The Cost Desk, Compliance Pricing · Published 2026-09-29 · Updated 2026-09-29 · 3 min read
MARKET LOG
This note recaps the dated items in our market log, which covers announcements from December 2025 to September 2026. It is written on 2026-09-29, the day we read the pricing pages, and groups the items by theme. The log holds only items we found on the pages we read; other vendors' announcements were not in that material, so their absence says nothing about their activity.
Funding
- 2026-09-17: Comp AI announced a $34M Series A, reported by TechCrunch and shown in a banner on Comp AI's site. Comp AI is not in our census lineup, but its pricing page is one of the clearest statements of what compliance vendors price on: frameworks, company size, timeline, and audit and security needs. It says it does not hide a rate card but presents it on a 20-minute call.
Funding does not change a published price, but it is worth knowing when you negotiate a multi-year term with any vendor.
Product launches
- 2026-09-15: Scytale announced an AI Third-Party Risk Management launch, listed on its security and news page.
Third-party risk tooling appears on several plan cards in the census: Drata's GRC Enterprise lists Agentic TPRM Assessment, Secureframe's Complete lists advanced third-party risk management, and Sprinto's Foundation lists vendor risk. If third-party risk is in your scope, ask each vendor which tier includes it.
Recognitions
- 2026-07-21: Scytale reported Frost & Sullivan 2026 Global Customer Value Leadership recognition.
- 2026-02-27: Scytale reported being a G2 Best Software Award winner in GRC.
- 2025-12-09: Scytale reported being named AWS Rising Star Partner of the Year (Technology), EMEA.
We list recognitions as the vendor reports them. They are not part of our scores, and we do not use review-site ratings.
Auditor and standards guidance
Four dated items from the AICPA and the Journal of Accountancy are relevant to anyone buying a SOC 2 audit. We recorded titles and dates only and list them as general reading, not as commentary on any vendor:
- 2026-02-01: "Promises of 'fast and easy' threaten SOC credibility", Journal of Accountancy.
- 2026-04-13: "Business arrangements with SOC tool providers", AICPA Ethics Staff Insights.
- 2026-04-30: "The risks of quick-turn SOC engagements and what CPAs should know", Journal of Accountancy podcast.
- 2026-05-14: "AICPA guides peer reviewers to address SOC 2 risks", Journal of Accountancy.
For buyers, the practical checks are simple: confirm the auditor is a licensed CPA firm enrolled in AICPA peer review, and ask how the audit firm is kept separate from the tool vendor. The auditor independence guide turns these into questions for a quote.
What did not change
None of these items changed a published price in our census. On 2026-09-29, Secureframe's Fundamentals was still the one published figure, at "Starting at $7,500/year", and the other six vendors still required a quote.
Reading the log
The market log lists every item with its date and source link, newest first. We add items when we re-read vendor pages. When a pricing page changes, the change goes into the census data and every total recomputes.
What to watch next
The items most likely to change a budget are pricing page edits, new plan tiers and changes to how audits are arranged. When we next read the pages, those go into the census data, and the date on each page tells you when its facts were last read.
The takeaway
Ten months of announcements, and the price picture is the same: one published figure, six quotes. The useful signal for a budget is the auditor guidance, which says what to check before paying for an audit.