When a vendor publishes no plans: a buyer's playbook, with Scrut and Thoropass as examples

Two vendors in our census publish no plans at all. On our price clarity scores, which measure what is published and not product quality, Scrut ranks 7 and Thoropass 6 of 7 on the price transparency ranking, and 7 and 5 on what the price buys. This note is about how to evaluate a vendor like that without guessing.

What each one publishes

Scrut:

The pricing URL returned "Page Not Found" on 2026-09-29.
The home page states 2,500+ customers, 70+ frameworks and 10M+ assets monitored; the startup page says 60+ frameworks.
It describes agentic AI "Teammates": an Onboarding Analyst, Policy Architect, Evidence Collector, Internal Auditor, Risk Analyst, Vendor Risk Analyst and Security Analyst, usable inside the Scrut Platform or an MCP-compatible client.
The startup page mentions expert guidance, a playbook and a Unified Control Framework.
The site offers a Compliance Cost Calculator.

Thoropass:

The /pricing URL shows no prices and redirects to home page content.
It describes itself as "Auditor-Led. AI-Powered." and says it is trusted by more than 1,000 organizations.
It offers automation and the audit from one company, with an audit and assessment offering led by an audit partner.
The platform includes IT security audit, penetration testing, vulnerability scanning and compliance automation.
Its integrations are described as vetted and approved by auditors, without a count.

Step 1: turn the facts into a scope

Use what they publish to decide what to ask. With Thoropass, the natural scope is platform plus audit plus pen test, because that is the offer. With Scrut, the scope starts with frameworks and which Teammates you want, because those are the published building blocks.

Step 2: ask for plans, not just a price

A single price for a vendor with no plans tells you little about renewal or growth. Ask for the plan structure in writing: tiers, what each includes, and the limits (frameworks, headcount, questionnaires, support) that move you between them. That gives you the same information the other five vendors publish.

Step 3: ask the questions the missing page would answer

For Scrut:

Is pricing based on frameworks, employees or assets?
Which Teammates are in the base price?
How is the external audit arranged, and who pays the auditor?
What does the Compliance Cost Calculator assume?

For Thoropass:

Is the audit priced with the platform or separately?
Which frameworks does the audit team cover for us?
Is the pen test in the same contract?
How is the audit team kept separate from the platform team?

The last question applies to any vendor that introduces or provides the auditor; the auditor independence guide explains why.

Step 4: compare on the same scope

Once you have written plans and a quote, put them in the same table as the vendors with published plans. The multi-compare shows the published side for all seven; your quotes fill in the rest.

What the scores do and do not say

Scrut and Thoropass score low here because little is published about price. Thoropass scores highest in the census on the audit and pen test path, because audit and testing come from the same company. A low price clarity score is a reason to ask more questions, not a verdict on the product.

Why this matters at renewal

A vendor without published plans can also change terms at renewal without a public reference point. Ask for the renewal price, or a cap on renewal increases, in the first contract. That protects the budget in year two as much as the first quote protects year one.

The takeaway

When a vendor publishes no plans, build the plan list yourself from what they do publish, and ask for it back in writing before comparing prices.