The most granular rate card in the category
Most GRC platforms publish one or two dimensions and point you at a salesperson for the rest. Strike Graph publishes six priced lines and a per-unit overage rate, and hedges none of them.
Strike Graph on AWS Marketplace: the published dimensions
checked July 2026
Every figure below is priced per 12-month contract, read off the listing itself.
| Dimension, as listed | Listed price |
|---|---|
| Scale | $18,000 |
| CMMC Bundle | $14,000 |
| MedDev | $12,000 |
| Tier 1 framework | $3,000 |
| Tier 2 framework | $5,000 |
| Tier 3 framework | $8,000 |
Listed on AWS Marketplace (prodview-wcymbit6244v6), checked July 2026. AWS shows no price-effective date on the pricing tab, so the check date is the provenance. These are the dimensions the listing publishes separately; it publishes no combined figure, so add only the lines your own scope needs. A marketplace list price is a real public fact; what the vendor actually sells at is not something we know.
Usage above the included allowance is listed at $1 per unit. What the unit is, the listing does not say, which is the one place this rate card leaves a question open. The structure is described on Strike Graph's own site at strikegraph.com.
It is worth pausing on how unusual this is. Strike Graph is a smaller name than Vanta or Drata and it publishes considerably more. There is no starting-price wording anywhere on the listing and no private-offer redirect, where Vanta, Drata and Scytale all carry one or the other. On the evidence of the listings alone, this is the least opaque pricing in the category.
The framework ladder, and what it does not say
Frameworks are priced in three published tiers: $3,000, $5,000 and $8,000. That is a different model from Drata's flat fee, where every framework costs the same, and it says something real: at Strike Graph, frameworks are not interchangeable cost units, and a heavier one costs more.
What the listing does not publish is which framework sits in which tier. So you can read the ladder without being able to find SOC 2 on it, and the cost of your specific programme is not derivable from the rate card. That is the gap to close in a quote, and it is a narrow, specific question rather than an open-ended one, which is a better place to start than most vendors leave you.
Two vertical bundles nobody else publishes
Strike Graph lists a CMMC Bundle at $14,000 and a MedDev bundle at $12,000, both below the Scale price. No other listing in this comparison publishes a vertical bundle at all.
For a defence contractor facing CMMC, or a medical-device company, that is a rare thing: a published, fixed, checkable number for a compliance programme in a vertical where pricing is usually entirely opaque. What each bundle actually includes is not on the listing, so this page will not describe the contents, and that is the first question to ask. But the price is real and public, which is more than the alternatives offer.
Why this page does not rank Strike Graph on price
Strike Graph's listing publishes no employee band for any of its dimensions. Every other comparison this site makes between platforms rests on the band the listing states: Secureframe, Sprinto and Drata publish at roughly 100 employees; Vanta and Scrut publish at roughly 20. Without a band, the Scale figure cannot be placed against any of them, because a price for an unstated number of people is not comparable to a price for a stated one.
So the honest position is that Strike Graph publishes the most and can be ranked the least. That is an irritating result and it is the correct one. The platforms comparison sets out what every listing publishes with its band attached, and is explicit about which comparisons the sources actually support.
What the listing does not tell you
No employee band on any dimension, which is the biggest gap. No tier contents, so the framework ladder cannot be applied to a specific framework. No bundle contents. No definition of the overage unit. And no renewal escalator, which no vendor publishes.
There is no audit line on the rate card, and there should not be, because no GRC platform sells the SOC 2 examination. That is a separate CPA engagement, quoted against your scope, and no firm publishes a rate card for it. The audit firms guide covers what actually moves that number.