Print / Save PDF

Tool cost (compliance-automation platforms)

12-month contract prices in USD unless noted. “AWS MP” means an AWS Marketplace listing whose “Sold by” is the vendor. Vendors with no amount on pages checked today are omitted here (including Comp AI, Scytale, Hyperproof, Anecdotes, 6clicks, TrustCloud, Cypago, Noru, Zania, Akitra, Complyance, Trustero, GetTeddy, Hybridity and KaitoSec). Strike Graph is omitted because the public pricing page’s tier-to-price mapping was unclear on 20 Oct 2026.

Compiled from published prices on 20 Oct 2026; real quotes vary. Automation platform entry points on AWS Marketplace and vendor pages: about USD 7,500–15,000/yr for the lowest listed package or platform (Secureframe, Sprinto and Episki $7,500 base; Thoropass $8,700; Vanta $14,000; Drata and Scrut $15,000). Framework add-ons are extra where listed.

Vanta AWS Marketplace also lists modules (Trust Center $6,000; TPRM up to 50 vendors $13,600; Questionnaire Automation $10,000 / Advanced $16,000; Trust Center Advanced $10,000; Customer Trust Management $22,250; AWS FTR Module $7,500) on the same listing. Episki optional modules are listed in the “what it covers” cell. Drata’s own pricing pages returned 403 (Cloudflare) on 20 Oct 2026, so Drata amounts come from AWS Marketplace only.

Related: Vanta alternatives · Secureframe alternatives · Sprinto alternatives · SOC 2 automation buyer’s guide.

Estimator (your selections only)

Tick published line items from the tables on this page. The total is only the sum of those published figures. No invented defaults.

Audit cost

None of the Agent Index directory firms were found publishing SOC 2 or ISO 27001 client fees on the pages checked for this update. Three other firms publish SOC 2 prices on their own sites; they are not in our auditors directory and their licences are unverified here, so those rows are omitted. Thoropass publishes a “SOC2 Audit subscription, starting at” $5,800 on AWS Marketplace (see the tool-cost table). Accredited ISO 27001 certification bodies that publish a client fee were not found today.

Pentest cost (vendor-published)

None of these vendors were checked against the Agent Index auditors directory. Amounts are vendor-published. Compiled from published prices on 20 Oct 2026; real quotes vary. Pentest per app or test: $3,500–$12,500 (web app), min–max of the listed published prices on this page. Related: agentic pentesting comparison (listings, not these fee tables).

Pentest-Tools.com publishes scanning-tool subscriptions (not manual pentests) and is omitted from this table. Invadel also lists API ($4,000 / $6,000 / $9,500) and mobile ($6,000 / $8,500 / $14,000) on the same pricing page.

Team time and timelines

• SOC 2 Type 2 covers controls “throughout a specified period”. Type 1 “does not contain an opinion on the operating effectiveness of controls nor a detailed description of tests”. Source: AICPA TSC ¶.11 (archived AICPA PDF).
• Observation window: AICPA language is “throughout a specified period”. No AICPA statement on a minimum length was found (not published in the sources checked). A firm-published example is “typically three to twelve months” (Vigil Assurance).
• ISO certification cycle (3-year cycle with surveillance audits): not published on a free official page fetched for this update. Left out.
• Platform or audit “weeks to SOC 2”: not collected. These are marketing claims, so they are left out.
• Internal team time: not published in the sources used here.

Related: SOC 2 auditor FAQ · audit-prep templates · after the audit · auditors directory · which framework to look into.

FAQ

Are these typical market prices?

No. They are only figures vendors published on the pages cited, checked 20 Oct 2026. Real quotes vary by scope, headcount and add-ons. Agent Index does not sell or rank these services.

Why are SOC 2 audit firm prices missing?

Three firms publish SOC 2 fees on their own sites. None is in the Agent Index auditors directory, and their licences were not independently verified for this update, so those rows are omitted.

What is the AICPA minimum observation period for SOC 2 Type 2?

No AICPA statement on a minimum length was found in the sources checked on 20 Oct 2026. AICPA language is “throughout a specified period”. We do not claim a minimum, or that none exists. One firm-published example is “typically three to twelve months” (Vigil Assurance).

How long will my SOC 2 or ISO certification take?

Not published here. Platform or audit “weeks to SOC 2” marketing claims were not collected. The ISO 3-year certification cycle sits in ISO/IEC 17021-1, which is sold, not a free official page fetched for this update, so it is left out.

Is the estimator a quote?

No. It only adds the published line items you select. There are no default amounts and no invented ranges beyond the min–max of those listed prices.

Sources

1. AICPA, 2017 Trust Services Criteria (March 2020 update), ¶.11 — Type 2 covers controls throughout a specified period; Type 1 does not contain an opinion on operating effectiveness nor a detailed description of tests. https://web.archive.org/web/20230905175109id_/https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-2020.pdf
2. Vigil Assurance SOC 2 page (firm-published): Type II covers “a defined period, typically three to twelve months”. https://www.vigilassurance.com/services/attestservices
3. Agent Index dataset v0.1.27. https://theagentindex.io/agents.json
4. Drata published price — USD 15,000 / 12 months. https://aws.amazon.com/marketplace/pp/prodview-3xw4sjqv2pb22
5. Drata published price — USD 25,000 / 12 months platform fee + USD 7,500 per framework. https://aws.amazon.com/marketplace/pp/prodview-3ubrmmqkovucy
6. Episki published price — USD 7,500 / year (required base). https://episki.com/pricing
7. Fidureon published price — From SEK 7,495 / month, excl. VAT. https://fidureon.com/pricing
8. Scrut Automation published price — USD 15,000 / 12 months. https://aws.amazon.com/marketplace/pp/prodview-fz4mb7o7dzj4i
9. Secureframe published price — Starting at $7,500/year. https://secureframe.com/pricing
10. Secureframe published price — USD 7,500 platform + USD 7,500 first framework / 12 months. https://aws.amazon.com/marketplace/pp/prodview-7cpg4l6nufwgq
11. Sprinto published price — USD 7,500 + USD 2,000 / 12 months. https://aws.amazon.com/marketplace/pp/prodview-ixyb464cbjkam
12. Thoropass published price — USD 8,700 / 12 months. https://aws.amazon.com/marketplace/pp/prodview-3fqzxq4nazmgu
13. Thoropass published price — USD 5,800 / 12 months. https://aws.amazon.com/marketplace/pp/prodview-3fqzxq4nazmgu
14. Vanta published price — USD 14,000 / 12 months. https://aws.amazon.com/marketplace/pp/prodview-5ophamrbfxt44
15. Vanta published price — USD 23,000 / 12 months. https://aws.amazon.com/marketplace/pp/prodview-5ophamrbfxt44
16. Vanta published price — USD 21,500 / 12 months. https://aws.amazon.com/marketplace/pp/prodview-5ophamrbfxt44
17. HackNow published price — From $5,000 per application. https://hacknow.com/pricing/
18. Intruder published price — $3,500 per test. https://www.intruder.io/pentest-pricing
19. Invadel published price — Web app S $5,200. https://invadel.com/pricing/
20. Invadel published price — Web app M $7,800. https://invadel.com/pricing/
21. Invadel published price — Web app L $12,500. https://invadel.com/pricing/
22. PenTestHQ published price — $3,999 single test. https://www.pentesthq.com/pricing

Prepared by Agent Index (Heritage Services). Last reviewed 20 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.