Pricing · GRC Acceleration using Client Vision · 2026 list prices
Client Vision is free to start and a complete compliance program from $499 a month. The Snapshot gives leadership a defensible read in ten business days. Managed by 3HUE puts a named vCISO and scoped programs in the same workspace, priced to your program. Seven questions build a pricing page that is yours to keep for 90 days.
Two minutes, no account. Your page lists every line with its list price and rolls straight into the first call.
01 · Client Vision · run it yourself
The workspace is free. Paid plans add the scanning, the risk operations and the maintained governance content a program needs, in one price per organization. Billed annually; monthly available.
Free
Start hereAssurance
Most programsAssurance Multi
Several frameworksAI use, model and governance signals reported beside the cyber estate: up to 100,000 ingested traces and 500 evaluation runs a month, 90-day retention, evaluations on your own model keys. Included in every Snapshot engagement.
OT asset monitoring, authorized adversary assessment, an extra governance pack on Assurance, or a larger capacity option beyond the starter allowance are priced on a call until each is generally available.
Capacity+ adds $299/mo to either plan for up to 10 cloud accounts and 10,000 resources. AI Signals Scale is $599/mo for 500,000 traces, 2,500 runs and 12-month retention. Beyond that is scoped. We warn before a limit and ask before adding capacity: no overages, no silently paused monitoring.
Allowances are launch values, reviewed against measured cost after the first ninety days; a change applies at renewal, never mid-term. Client Vision is powered by the AiVRIC platform. One license, billed once: a plan bought here is the same tenant a Managed program runs in, and an organization that already holds an AiVRIC subscription never pays for it twice. Plans cover readiness; they do not include the CPA audit, the C3PAO assessment, legal advice or consulting hours.
02 · Snapshot · know where you stand
The AI & Security Risk Posture Snapshot: four phases, a written readout leadership can act on, and your own Client Vision tenant live from day one.
Continue into Managed by 3HUE within 60 days and the full $4,950 is credited against year one of the program: the tenant, the baseline and the plan are its first month. Keep the workspace on any Client Vision plan either way; the output is yours.
Scope: one business unit, one AI program. More units or AI systems, or a regulated governance review, are scoped on the call.
Sample reports · demo data
Three documents from the Big Venture Incorporated demo workspace. Nothing to fill in; every figure is sample data.
Snapshot readout
AI & Security Risk Posture Snapshot
What leadership receives on day ten: the posture score, the findings that matter, the AI governance read and the sequenced 90-day plan.
Quarterly board pack
Security posture, quarter in review
The GROC briefing a Managed by 3HUE client’s board sees each quarter: one score, the risks that moved, the decisions the board owns.
POA&M export
Plan of Action & Milestones
Every open deficiency with its control, owner, milestones and due date, exported from Client Vision the way an auditor or assessor receives it.
03 · Managed by 3HUE · we run it with you
A named vCISO takes the seat. Each program is scoped in your client operating plan with its own runbook, and all of it runs in the Client Vision plan you already hold, so nothing is billed twice. Managed pricing depends on the seat size, the programs and the number of entities, so it is built for you: answer seven questions and your pricing page lists every Managed line with its list price.
Monthly cadence, risk appetite and information security policy published in the workspace, the quarterly board pack (ROAR and GROC), and the audit liaison when the auditor arrives. The seat is sized by entities and frameworks; the regulated, multi-entity bundle takes the seat with ISP, RMP and CIRP together.
| Program | What it runs | Billing |
|---|---|---|
| RMPRisk Management Program | Risk identification and treatment tracking, the risk register and POA&M, periodic executive reporting. Supports ISO 31000, NIST RMF, NIST CSF, COSO ERM. | Annual, by runbook |
| CIRPCyber-Incident Response Program | IR program and playbook maintenance, regulatory change integration, remediation tracking; 60 consulting hours a year. Incident command at the list rate when it happens. | Annual, by runbook |
| ISPInformation Security & Privacy Program | ISMS governance, SoA and scope maintenance, System Security Plan upkeep, continuous ISO 27001 / 27701 alignment; 40 consulting hours a quarter. | Annual, by runbook |
| VCPVendor Compliance Program | Per-vendor monitoring, assessment coordination, compliance status and governance reporting, tiered by criticality. Volume pricing from ten vendors. | Per vendor, per year |
| SEASecure Engineering & Architecture | Hands-on remediation: cloud and identity hardening, control implementation, architecture reviews, vulnerability management, across Azure, AWS, GCP, M365 and Kubernetes. | Hourly, scoped |
Assurance + the vCISO seat + RMP, run by runbook with the quarterly board pack.
Price this →Multi + the seat + ISP, RMP and CIRP together, one operating plan.
Price this →Healthcare, financial services and defense programs that take the seat with ISP, RMP and CIRP together are scoped as a bundle.
Price this →Side by side
Optional add-on for Managed
When the program has to stand up fast, the Foundation build front-loads the engineering: a fixed 30-day term with forty hours of hands-on work alongside the vCISO, with the policy, register and control baseline published in your workspace at the end of it.
Pricing questions
So the first call is about your program. Client Vision plans and the Snapshot are list prices on this page. Managed by 3HUE depends on the seat size, the programs and the entities in scope, so its prices are built for you: the builder lists every Managed line with its list price on a page you keep for 90 days, after a quick work-email check.
Hosted scanning beyond the one-domain snapshot, AI Signals usage, governance packs, and consulting. It is a real workspace, not a trial: your records, your export, no clock. Paid plans unlock monitoring, automation and the maintained content; they never hold your data hostage.
Both, and they are different things. Every scan is cross-walked to eight frameworks (SOC 2, ISO 27001, NIST CSF 2.0, PCI DSS 4.0, CIS AWS and Azure, NIS2, GDPR) at no charge; that is the technical control mapping inside the scanner. A governance pack is the maintained program content for running a framework end to end: policies, workflows, evidence requirements, approvals and framework-specific reporting. Assurance includes one pack; Multi includes all six. The EU AI Act is run as a Managed program with AI Signals rather than a pack.
Against Managed, yes: continue within 60 days and the full $4,950 is credited to year one, because the tenant, the baseline and the plan the Snapshot produces are the program's first month. It is not credited against a self-serve plan; the written readout stands on its own and is yours either way.
Assurance and Multi include up to 3 cloud accounts (AWS accounts, Azure subscriptions or GCP projects, plus one Microsoft 365 tenant) and 2,500 monitored resources, scanned daily with twelve months of findings history. AI Signals includes 100,000 traces and 500 evaluation runs a month with 90-day retention. We warn at 80% of an allowance and ask before adding capacity; nothing is silently paused and nothing is billed as an overage. Capacity+ ($299/mo) takes a plan to 10 accounts and 10,000 resources, AI Signals Scale ($599/mo) to 500,000 traces, 2,500 runs and twelve months of retention, and anything larger is scoped on a call.
No. Client Vision is powered by the AiVRIC platform and a subscription is one license, billed once. Managed by 3HUE is priced as the seat and the programs on top of the plan you hold, whichever storefront you bought it from.
Yes. Free, Assurance and Managed are the same workspace, so moving up is a scope change, not a migration. Many clients start free, run the Snapshot, buy Assurance, and add the seat when an audit or a board asks for more than the team can carry.
Free has none. Paid plans are annual, or month to month at $599 (Assurance) and $839 (Multi). The Snapshot is one-time. The vCISO seat has a 90-day minimum, then 30 days' notice; programs are annual subscriptions. The Foundation build is a fixed 30-day term.
The workspace takes minutes. Fifteen minutes is enough to choose the rest; we respond within one business day.