What did the bundles look like, and what replaced them?
On 29 September Scytale sold Build Starter (one framework plus add-ons), Build DFY (platform, LaunchReady Consulting and a web app black box pen test) and Build Stronger (StayReady Consulting and a gray box pen test), plus Scale and Enterprise. Now there are three cards. Build lists the Scy Agent, automated evidence collection, pre-built policies and controls, risk assessment, a Trust Center, user access reviews, vendor management, open API access and MCP. Scale adds AI third-party risk management, AI-assisted evidence review, a customized risk program, advanced policy approvals, an advanced Trust Center, customized control management, multiple entities and AI governance. Enterprise is everything in Scale for teams with an established GRC program.
Where did the consulting go?
Into a section called "GRC expert services" underneath the plans: dedicated GRC expertise, guidance through audit readiness and after the audit, readiness assessment, gap analysis and control implementation. The compliance experts page still describes a dedicated expert with weekly meetings who manages the audit. What the page no longer says is which plan includes that expert. For a switcher, that is the first question for the call, because the switching help criterion is where Scytale scores highest on our weights.
What is now an add-on?
Penetration testing, on every plan, with one retest on Build and unlimited retests on Scale and Enterprise. Cloud assessment, on every plan. SOX-ITGC, on Scale and Enterprise. Custom frameworks appear as an add-on in the feature table. If you are leaving a platform because a customer asked for a pen test, the bundle that used to answer that is gone; ask for the add-on price.
What limits does the page publish now?
More than before. AI evidence reviews: 100, 500 and 2,000 a year by plan. Agentic questionnaire responses: 30, 150 and 1,000 a year. Managed security questionnaires: none on Build, 100 on Scale, 500 on Enterprise. MCP credits: 1,000, 10,000 and 50,000 a month. The headcount bands themselves are limits. Our switch planner uses plan limits to warn you when a target plan will not hold your headcount or questionnaire volume, and these are now in it.
What changed in the finder?
One score. Pricing transparency for Scytale moves from one point below Vanta to level with it, because the page now publishes headcount bands and allowances in the way Vanta, Drata and Sprinto do. Scytale's framework, integrations, audit, trust center and AI scores are unchanged: the pages behind them did not change. The AI policy generator, which we noted as coming soon, is now listed on every plan; it was already counted in Scytale's AI score as described, so the score holds. Totals on the ranking page are recomputed. Other vendors' pages were not re-read for this post.
What should a switcher do?
If you are moving to Scytale: get the expert services and the pen test as separate quote lines, confirm the headcount band, and check the questionnaire allowance against last year's volume. If you are moving from Scytale: the plan you are on may no longer exist by name, so ask for the mapping to Build, Scale or Enterprise before you compare renewal against a rival quote.
What else should a switcher know?
What are Scytale's plans in November 2026?
Build (under 150 employees), Scale (150 to 1,000 employees) and Enterprise (1,000+), each sold through a demo. GRC expert services and penetration testing are listed separately.
Did Scytale's score change on this site?
Pricing transparency rose one point because the page now publishes headcount bands and annual allowances. No other criterion changed.
Which sources did we use?
Source: Scytale pricing page (metadata modified 6 November 2026) · read 2026-11-10
Source: Scytale compliance experts page · read 2026-11-05