Vendor risk management platforms that publish their pricing
Short answer: almost none of them. As of September 2026, of the major vendor risk and compliance platforms, ZeroRisk publishes a full price list; the rest of the field — Vanta, Drata, OneTrust, Bitsight, ProcessUnity, SecurityScorecard — sells behind a demo call with no list price on the site. This article is openly self-interested (we are the outlier and we think it is a feature), but the facts are checkable in one browsing session, and the buying advice holds whoever you choose.
The state of play
Checked against each vendor's public website, September 2026:
| Platform | List pricing on website? | What the pricing page says instead |
|---|---|---|
| ZeroRisk | Yes — full tiers | $149–$899/mo by tier, vendor packs $15/vendor/mo, custom enterprise. Published, including a machine-readable version. |
| Vanta | No | Request a demo; pricing scoped per company |
| Drata | No | Book a demo; custom quotes |
| OneTrust | No | Contact sales; modular enterprise quoting |
| Bitsight | No | Request pricing |
| ProcessUnity | No | Request a demo |
| SecurityScorecard | No | Free tier exists; paid plans via sales |
If a vendor has published prices since this was checked, good — the table is dated for exactly that reason, and we will happily update it. Any specific figure you hear for the sales-led platforms is an estimate from someone's negotiation, not a list price, and should be labeled that way in your budget doc.
Why vendors hide pricing
Steel-manning the sales-led model, because it is not irrational:
- Price discrimination works. A quote scoped to your headcount, vendor count and desperation captures more revenue per deal than a list price ever can.
- Complex deals exist. Enterprise deployments with SSO, custom integrations and professional services genuinely vary; a one-size list price would misprice the edges.
- Sales process control. No price on the site forces the conversation, and the conversation is where enterprise software gets sold.
All true. And all of it is optimized for the vendor's revenue, not your evaluation. Note what the model does to you: you cannot budget without entering a sales cycle, cannot compare three tools without three discovery calls, and the person who eventually approves your spend gets a number that arrived by negotiation rather than by menu.
Why we publish
The compliance market sells trust — audit trails, signed verdicts, no surprises. We think the pricing page is part of that claim: a vendor whose first interaction with you is a hidden number is telling you how the relationship will run. Publishing also forces discipline on us — the price has to make sense to a stranger without a pitch attached — and it lets the large majority of buyers who are not edge cases self-serve the comparison. The one real cost of publishing is that competitors can see it too. We can live with that; apparently it is harder the other way around.
What vendor risk management actually costs
With the published data point on the table: ZeroRisk runs $149/month (Starter: one framework, 10 vendors) through $399 (Growth) and $899 (Business: five frameworks, 150 vendors) to custom enterprise with CRA included — annual billing, vendor packs at $15/vendor/month, no per-seat licenses. Full detail on the pricing page.
For the sales-led platforms, honest guidance rather than fake precision: buyer-reported ranges for mid-market deployments typically start in the low five figures per year and climb with modules and vendor count — but every such figure is an unsourced estimate until it is on your quote. Budget rule of thumb: whatever the license, the bigger line is internal hours, so weigh who does the assessment work — your team inside their tool, or the platform itself. That comparison is where cheap tools get expensive.
How to use pricing transparency in your evaluation
- Get the published price first. It anchors the negotiation for everything else — sales-led vendors price against alternatives, and now you have one in writing.
- Make hidden-price vendors quote in week one. If the number only arrives after three calls, that is a process designed to sunk-cost you.
- Insist estimates are labeled. Your budget document should distinguish list prices from negotiated guesses; auditors of a different kind read those documents later.
- Compare at your real vendor count, including next year's. Per-vendor economics diverge sharply between platforms at 50+ vendors.
- Read the pricing page as a product signal. Clarity there predicts clarity in the contract, the export, and the renewal.
For what the software should actually do once the price is settled, our supplier risk management buying guide covers the evaluation itself — monitoring cadence, evidence trails, framework mapping, and the questions to ask on the demo.