Pricing · GRC Acceleration using Client Vision · 2026 list prices
Client Vision is free to start and a complete compliance program from $499 a month. The Snapshot gives leadership a defensible read in ten business days. Managed by 3HUE puts a named vCISO and scoped programs in the same workspace. Every number on this page is a list price; what moves it is written next to it.
01 · Client Vision · run it yourself
The workspace is free. Paid plans add the scanning, the risk operations and the maintained governance content a program needs, in one price per organization. Billed annually; monthly available.
Free
Start hereAssurance
Most programsAssurance Multi
Several frameworksAI use, model and governance signals reported beside the cyber estate: up to 100,000 ingested traces and 500 evaluation runs a month, 90-day retention, evaluations on your own model keys. Included in every Snapshot engagement.
OT asset monitoring, authorized adversary assessment, an extra governance pack on Assurance, or a larger capacity option beyond the starter allowance are priced on a call until each is generally available.
Capacity+ adds $299/mo to either plan for up to 10 cloud accounts and 10,000 resources. AI Signals Scale is $599/mo for 500,000 traces, 2,500 runs and 12-month retention. Beyond that is scoped. We warn before a limit and ask before adding capacity: no overages, no silently paused monitoring.
Allowances are launch values, reviewed against measured cost after the first ninety days; a change applies at renewal, never mid-term. Client Vision is powered by the AiVRIC platform. One license, billed once: a plan bought here is the same tenant a Managed program runs in, and an organization that already holds an AiVRIC subscription never pays for it twice. Plans cover readiness; they do not include the CPA audit, the C3PAO assessment, legal advice or consulting hours.
02 · Snapshot · know where you stand
The AI & Security Risk Posture Snapshot: four phases, a written readout leadership can act on, and your own Client Vision tenant live from day one.
Continue into Managed by 3HUE within 60 days and the full $4,950 is credited against year one of the program: the tenant, the baseline and the plan are its first month. Keep the workspace on any Client Vision plan either way; the output is yours.
Scope: one business unit, one AI program. More units or AI systems, or a regulated governance review, are scoped on the call.
03 · Managed by 3HUE · we run it with you
A named vCISO takes the seat. Each program is scoped in your client operating plan with its own runbook, and all of it runs in the Client Vision plan you already hold, so nothing is billed twice.
Monthly cadence, risk appetite and information security policy published in the workspace, the quarterly board pack (ROAR and GROC), and the audit liaison when the auditor arrives. About six hours a month at the starting price; more hours at the list rate.
| Program | What it runs | List price | Monthly equivalent |
|---|---|---|---|
| RMPRisk Management Program | Risk identification and treatment tracking, the risk register and POA&M, periodic executive reporting. Supports ISO 31000, NIST RMF, NIST CSF, COSO ERM. | $18,840 / yr | $1,570 |
| CIRPCyber-Incident Response Program | IR program and playbook maintenance, regulatory change integration, remediation tracking; 60 consulting hours a year. Incident command at the list rate when it happens. | $23,100 / yr | $1,925 |
| ISPInformation Security & Privacy Program | ISMS governance, SoA and scope maintenance, System Security Plan upkeep, continuous ISO 27001 / 27701 alignment; 40 consulting hours a quarter. | $61,600 / yr | $5,133 |
| VCPVendor Compliance Program | Per-vendor monitoring, assessment coordination, compliance status and governance reporting, tiered by criticality. Volume pricing from ten vendors. | $1,155 to $5,775 / vendor / yr | $96 to $481 per vendor |
| SEASecure Engineering & Architecture | Hands-on remediation: cloud and identity hardening, control implementation, architecture reviews, vulnerability management, across Azure, AWS, GCP, M365 and Kubernetes. | $385 / hr, scoped | by plan |
Assurance $499 + vCISO $2,450 + RMP $1,570
$4,519/moMulti $699 + vCISO $2,450 + ISP $5,133 + RMP $1,570 + CIRP $1,925
$11,777/mo listHealthcare, financial services and defense programs that take the seat with ISP, RMP and CIRP together are scoped as a bundle.
from $7,950/mo + planSide by side
Optional add-on for Managed
When the program has to stand up fast, the Foundation build front-loads the engineering: a fixed 30-day term with forty hours of hands-on work alongside the vCISO, with the policy, register and control baseline published in your workspace at the end of it.
Pricing questions
So the first call is about your program. Assurance at $5,988 a year sits well under the published entry listings of the compliance platforms it is compared with, and it includes the risk operations and governance content most of them sell separately. The seat and every program carry the same list rate as the rate card, so a quote is a sum you can check.
Hosted scanning beyond the one-domain snapshot, AI Signals usage, governance packs, and consulting. It is a real workspace, not a trial: your records, your export, no clock. Paid plans unlock monitoring, automation and the maintained content; they never hold your data hostage.
Both, and they are different things. Every scan is cross-walked to eight frameworks (SOC 2, ISO 27001, NIST CSF 2.0, PCI DSS 4.0, CIS AWS and Azure, NIS2, GDPR) at no charge; that is the technical control mapping inside the scanner. A governance pack is the maintained program content for running a framework end to end: policies, workflows, evidence requirements, approvals and framework-specific reporting. Assurance includes one pack; Multi includes all six. The EU AI Act is run as a Managed program with AI Signals rather than a pack.
Against Managed, yes: continue within 60 days and the full $4,950 is credited to year one, because the tenant, the baseline and the plan the Snapshot produces are the program's first month. It is not credited against a self-serve plan; the written readout stands on its own and is yours either way.
Assurance and Multi include up to 3 cloud accounts (AWS accounts, Azure subscriptions or GCP projects, plus one Microsoft 365 tenant) and 2,500 monitored resources, scanned daily with twelve months of findings history. AI Signals includes 100,000 traces and 500 evaluation runs a month with 90-day retention. We warn at 80% of an allowance and ask before adding capacity; nothing is silently paused and nothing is billed as an overage. Capacity+ ($299/mo) takes a plan to 10 accounts and 10,000 resources, AI Signals Scale ($599/mo) to 500,000 traces, 2,500 runs and twelve months of retention, and anything larger is scoped on a call.
No. Client Vision is powered by the AiVRIC platform and a subscription is one license, billed once. Managed by 3HUE is priced as the seat and the programs on top of the plan you hold, whichever storefront you bought it from.
Yes. Free, Assurance and Managed are the same workspace, so moving up is a scope change, not a migration. Many clients start free, run the Snapshot, buy Assurance, and add the seat when an audit or a board asks for more than the team can carry.
Free has none. Paid plans are annual, or month to month at $599 (Assurance) and $839 (Multi). The Snapshot is one-time. The vCISO seat has a 90-day minimum, then 30 days' notice; programs are annual subscriptions. The Foundation build is a fixed 30-day term.
The workspace takes minutes. Fifteen minutes is enough to choose the rest; we respond within one business day.