✦ Start with a Risk-Free Assessment Request Now →
🔐 CISO Blueprint by Threatly

Enterprise Security.
SMB Price.

A structured governance framework — guardrails, geo-residency, privacy controls, and security posture — designed for growing companies without a full security team. Powered by Threatly's Fractional CISO expertise.

Tier 1

Foundations

For early-stage SMBs establishing their first security baseline. Policies, controls, and basic compliance posture.

$149
/ month · billed monthly
*Limited time offer
Includes up to 25 users. Additional seats at $4/user/mo.
What's included
  • ✓ Security policy library (15+ templates)
  • ✓ Risk register — starter framework
  • ✓ Data classification tagging (Public / Internal / Confidential)
  • ✓ Acceptable use & BYOD policies
  • ✓ Basic incident response playbook
  • ✓ Vendor risk questionnaire (standard)
  • ✓ Annual review reminders & policy versioning
  • ✗ Geo-residency controls
  • ✗ Regulatory mapping (GDPR, CCPA, etc.)
  • ✗ vCISO advisory hours
Start Free Trial
Most Popular
Tier 2

Governance Core

The full CISO Blueprint for growing SMEs. Guardrails, geo-residency, privacy controls, and audit-ready reporting.

$399
/ month · billed monthly
*Limited time offer
Includes up to 100 users. Additional seats at $3.50/user/mo.
Everything in Foundations, plus:
  • ✓ Full guardrails framework — AI, data, and access controls
  • ✓ Geo-residency mapping — data flow & jurisdiction controls
  • ✓ GDPR + CCPA + PDPA privacy compliance templates
  • ✓ Security awareness training modules (quarterly)
  • ✓ SOC 2 Type I readiness checklist & gap analysis
  • ✓ Phishing simulation campaigns (2x/year)
  • ✓ Third-party risk tier scoring
  • ✓ Audit-ready evidence pack (auto-generated)
  • ✓ Incident response simulation (tabletop, 1x/year)
  • ✓ vCISO advisory: 2 hours/month
Start Free Trial
Tier 3

Enterprise Shield

For regulated industries or companies with complex supply chains, board-level reporting, and advanced compliance mandates.

Custom
Contact us for pricing
Unlimited users. Custom SLA and onboarding.
Everything in Governance Core, plus:
  • ✓ Custom regulatory mapping (HIPAA, PCI-DSS, ISO 27001)
  • ✓ Dedicated vCISO — 8 hours/month
  • ✓ Board-ready security reporting (quarterly)
  • ✓ Advanced geo-residency — multi-jurisdiction overlays
  • ✓ Penetration test coordination & remediation tracking
  • ✓ Zero-trust architecture blueprint
  • ✓ M&A security due diligence framework
  • ✓ Supplier / third-party audit workflows
  • ✓ Custom policy authoring service
  • ✓ Priority incident response retainer
Contact Us

Modular Add-ons

Extend your plan with targeted capabilities as your risk profile grows.

🌍
Geo-Residency Expansion
Add jurisdiction-specific data residency controls for EU, APAC, LATAM or additional regulatory zones beyond your base plan.
$79 / region / month
🤖
AI Guardrails Module
Purpose-built policy framework for AI/LLM tool governance — acceptable use, model risk, data leakage controls, and auditability.
$99 / month
🔍
Privacy Impact Assessments
On-demand DPIA and PIA assessments for new products, features, or third-party integrations requiring privacy analysis.
$249 / assessment
📋
Compliance Certification Prep
Structured readiness program for SOC 2 Type II, ISO 27001, or HIPAA — gap analysis, evidence collection, and auditor liaison.
$499 / month (3-mo min)
🎯
Phishing Simulation +
Continuous monthly phishing and social engineering simulations with per-employee scoring and manager dashboards.
$49 / month
👤
vCISO Hours Block
Purchase additional advisory hours for board prep, investor DD, regulatory engagement, or incident support.
$250 / hour (block of 4)

Built for real regulatory environments. Threatly's CISO Blueprint maps to leading frameworks and regional privacy laws — so your governance posture is defensible, not decorative.

GDPR CCPA SOC 2 ISO 27001 HIPAA PCI-DSS NIST CSF PDPA

Frequently Asked Questions

Everything you need to know before getting started.

Can I upgrade or downgrade my plan at any time? +
Yes. You can move between tiers at any time without losing your policy library, risk register, or audit evidence. Upgrades take effect immediately; downgrades apply at the next billing cycle.
What does "geo-residency controls" actually include? +
Geo-residency controls include data flow mapping by jurisdiction, policy templates for cross-border data transfers, SCCs and adequacy decision tracking, and recommendations for storage architecture aligned to regional laws (e.g., EU data staying in EU-based infrastructure).
What are "AI Guardrails" — do I need them? +
If your team uses any AI tools (ChatGPT, Claude, Copilot, etc.), you have data leakage and acceptable-use risk. AI Guardrails gives you a formal policy framework, employee guidelines, and auditability controls so you can use AI tools confidently without exposing sensitive business or customer data.
Is there a free trial? +
Yes — both Foundations and Governance Core offer a 14-day free trial with full access to the plan's feature set. No credit card required. Enterprise Shield trials are structured as a scoped onboarding engagement — contact us to arrange.
What payment methods are accepted? +
We accept all major credit cards, ACH transfers, and wire transfers for annual enterprise agreements. Invoicing is available for plans over $500/month. All payments are processed securely through Stripe.
How does the vCISO advisory work? +
vCISO hours are scheduled sessions with a senior Threatly security advisor — not a ticketing queue. Sessions can be used for board prep, investor due diligence, regulatory engagement, policy reviews, or incident response. Hours do not roll over but can be topped up via the vCISO Hours Block add-on.
Can I cancel my subscription at any time? +
Yes. Cancel anytime and your account remains active through the end of the billing period. Your policy library and audit evidence packs are exportable in full — you own your data.
How does the risk-free assessment work? +
Our complimentary security posture assessment includes a 30-minute discovery call, an evaluation of your current posture across key domains, and a prioritized findings report with recommendations. No commitment to purchase — it helps you understand where you stand.