Scytale's startup bundles are gone. Build, Scale and Enterprise, decoded for a first audit
5 min read
Scytale now sells Build for companies under 150 employees, Scale for 150 to 1,000 and Enterprise above that, each through a demo. The done-for-you bundle that packaged consulting and a pen test with the platform no longer appears; GRC expert services are listed separately and penetration testing is an add-on on every plan. For a startup, Build is the plan to read, and the expert is now a question for the call rather than a line on the card. Our August note on startup bundles is kept as a record of what the page said then.
What does Build include?
The Scy Agent, automated evidence collection for audit readiness, pre-built policies and controls, a risk assessment, a Trust Center, user access reviews, vendor management, open API access and MCP. The feature table adds allowances: 100 AI evidence reviews a year, 30 agentic questionnaire responses a year, 1,000 MCP credits a month, and penetration testing as an add-on with one retest. Managed security questionnaires, the policy reviewer agent, the vendor security assessment agent, custom controls and continuous vendor risk monitoring are marked as not on Build.
Where did the expert go?
To a section headed "GRC expert services" underneath the plans: dedicated GRC expertise, guidance throughout audit readiness and post-audit, readiness assessment, gap analysis and control implementation. The compliance experts page still describes a dedicated expert with weekly meetings who takes over the audit. What the pricing page no longer says is which plan includes that person. For a first-time buyer with nobody on the team to own the programme, that is the first question to ask, and we have put it at the top of Scytale's tool fit page.
What about the pen test?
It is an add-on on every plan now. Build DFY and Build Stronger used to list a black box or grey box pen test as included. If a customer asked you for a pen test alongside the SOC 2, price it as a separate line and compare it with a standalone tester. Thoropass still describes pen testing on its platform; Vanta, Secureframe and Comp AI do not describe one on the pages we read.
Did the price appear?
No. Every plan ends in "Book a demo". The page does publish the headcount bands and the annual allowances, which is more than it published in September, and the allowances tell you when you will outgrow Build: a company answering more than 30 questionnaires a year with the agent, or reviewing more than 100 pieces of evidence with it, is being pointed at Scale.
What changed in the ranking?
Two of Scytale's seven scores. Pen testing in the package moves down one band, from included to add-on, because the bundle that included it is gone. Pricing transparency moves up slightly, from 2.2 to 2.6, because the page now publishes headcount bands and allowances. Expert guidance, where Scytale leads, is unchanged: the compliance experts page is the same. The new total is on the first-audit ranking. The other four tools' pages were not re-read for this post.
What should a founder do?
Read Build, not Scale. Ask three things on the call: whether the dedicated expert comes with Build or is quoted on top; the add-on price for a pen test; and what happens to the price when you cross 150 employees. Then run the same three questions past Vanta and Secureframe, whose entry plans we decoded in August.
Sources
- Scytale pricing (modified 2 November 2026)Source: scytale.ai · Read 2026-11-05
- Scytale compliance expertsSource: scytale.ai · Read 2026-11-05
- Thoropass homepageSource: thoropass.com · Read 2026-11-05
Questions founders ask
Is Scytale Build DFY still available?
Not on the pricing page as of November 2026. The page lists Build, Scale and Enterprise, with GRC expert services and penetration testing as separate items.
Which Scytale plan is for a startup?
Build, described as for companies under 150 employees. It includes the Scy Agent, evidence collection, policies and controls, a Trust Center and MCP, with annual allowances on AI evidence reviews and questionnaire responses.