Plans & Features
AutoCISO has four plans. Each plan includes everything in the plan before it.
| Plan | Built for |
|---|---|
| Free | Getting a first picture of who has access to what: employee directory, asset inventory, access audits, ghost-account detection, the AI assistant |
| The Seed | Running access governance: joiner and leaver workflows, the review queue, CISO reports, the vCISO Workspace, exports, the Partner Portal |
| The Growth | Getting certified: ISO 27001 workspace, risk management, compliance cockpit, supply chain security, audit trail, single sign-on, automated evidence |
| The Scale | Operating at scale: privacy operations, continuous control monitoring, board reporting, audit simulator, HIPAA, certificate management |
Docs pages say “requires The Growth plan or higher” when a feature starts at The Growth. Your current plan, usage and the same comparison are in the user menu → Billing & Subscription → Plan & Usage.
Feature comparison
| Feature | Free | The Seed | The Growth | The Scale |
|---|---|---|---|---|
| Applications (assets) you can track | 15 | 150 | 500 | Unlimited |
| Access audits per month | 10 | 60 | 500 | 2,000 |
| AI assistant requests per month | 30 | 200 | 1,000 | 4,000 |
| Core | ||||
| Employee directory & CSV import | ✓ | ✓ | ✓ | ✓ |
| Asset & SaaS app inventory | ✓ | ✓ | ✓ | ✓ |
| Access inventory & identity mapping | ✓ | ✓ | ✓ | ✓ |
| Ghost account detection | ✓ | ✓ | ✓ | ✓ |
| License waste calculator | ✓ | ✓ | ✓ | ✓ |
| Access relationship graph (visual map) | ✓ | ✓ | ✓ | ✓ |
| Security health dashboard | ✓ | ✓ | ✓ | ✓ |
| Team members & role-based access | ✓ | ✓ | ✓ | ✓ |
| AI | ||||
| AI assistant & MCP tools for every feature in your plan | ✓ | ✓ | ✓ | ✓ |
| Evidence capture | ||||
| Manual screenshot & evidence upload | ✓ | ✓ | ✓ | ✓ |
| Browser extension | — | ✓ | ✓ | ✓ |
| Workflows | ||||
| Offboarding Command Center | — | ✓ | ✓ | ✓ |
| Joiners & leavers lifecycle workflows (JML) | — | ✓ | ✓ | ✓ |
| Jira & Slack remediation tasks | — | ✓ | ✓ | ✓ |
| Manual review queue (approve / reject / remap) | — | ✓ | ✓ | ✓ |
| Export | ||||
| CSV & PDF export for all reports | — | ✓ | ✓ | ✓ |
| Detection | ||||
| Service account & NHI detection | — | ✓ | ✓ | ✓ |
| Zombie Hunter (activity-signal correlation) | — | — | ✓ | ✓ |
| Toxic combinations & SoD conflict detection | — | — | ✓ | ✓ |
| Audit | ||||
| Audit runner (CSV-based access validation) | — | ✓ | ✓ | ✓ |
| Audit trail | — | — | ✓ | ✓ |
| Reporting | ||||
| CISO security intelligence reports (10 reports + PDF) | — | ✓ | ✓ | ✓ |
| vCISO Operating System (phased roadmap, AI insights, monthly KPI summary) | — | ✓ | ✓ | ✓ |
| Compliance & offboarding violations dashboard | — | ✓ | ✓ | ✓ |
| Advanced CISO reports (UAR, privileged delta, security debt, dept risk) | — | — | ✓ | ✓ |
| Risk Management workspace, register, budgets, and AI-guided intake | — | — | ✓ | ✓ |
| Partners | ||||
| Partner Portal — vCISO portfolio management for multiple client orgs | — | ✓ | ✓ | ✓ |
| Partner compliance posture overview across client portfolio | — | — | — | ✓ |
| Automation | ||||
| Automated evidence collection | — | — | ✓ | ✓ |
| Encrypted credential store for integrations | — | — | ✓ | ✓ |
| Public API (API tokens on the REST API) | — | ✓ | ✓ | ✓ |
| Compliance | ||||
| Privacy operations workspace (RoPA, DPIA, DSAR readiness, DPO Cockpit) | — | — | — | ✓ |
| Compliance Cockpit (unified posture score, coverage matrix) | — | — | ✓ | ✓ |
| Multi-framework crosswalk engine (objectives, crosswalks, framework selector) | — | — | ✓ | ✓ |
| Certification body directory & selection guide | — | — | ✓ | ✓ |
| ISO 27001 compliance workspace (scope, gap analysis, risk register, SoA, policies, roadmap, access reviews, backup tests, internal audit, management review) | — | — | ✓ | ✓ |
| HIPAA BAA & evidence collection | — | — | — | ✓ |
| Enterprise | ||||
| Supply Chain Security — SBOM inventory, vulnerability findings, and vendor risk registry | — | — | ✓ | ✓ |
| Compliance framework export (PDF/XLSX) | — | — | — | ✓ |
| Continuous control monitoring | — | — | — | ✓ |
| Auditor-first compliance portal (external auditor access) | — | — | — | ✓ |
| Board & executive reporting | — | — | — | ✓ |
| Audit Simulator mode (pre-audit rehearsal) | — | — | — | ✓ |
| Certificate management & public verification page | — | — | — | ✓ |
| Single Sign-On (SAML / OIDC) | — | — | ✓ | ✓ |
The table is built from the same plan catalogue the console uses, so it always matches Billing & Subscription.
What happens at a plan boundary
- In the console, menu items for features outside your plan show a lock and a tooltip such as Requires The Growth. Opening the page shows the plans that include it and a View Plans link.
- Over the REST API, an endpoint for a feature outside your plan answers
402 FEATURE_GATED; the error names the lowest plan that includes it. See When a gate refuses and Errors & rate limits. - Over MCP, tools for features outside your plan are not listed at all. See Scope is not entitlement.
- Monthly limits (audits, AI assistant requests) reset each calendar month. The console warns you as you approach a limit.
Change your plan
Owners change the plan in the user menu → Billing & Subscription. Upgrades take effect immediately, for the console, the API and MCP alike — existing API tokens do not need to be re-issued.
Last reviewed: 2026-10-08
Was this page helpful?