vciy
Plans & Service Tiers

Know before they ask.

Every plan reads every CVE page and every receipt without an account. Plans differ in how much of what you run is watched, and in who can prove what you decided.

Start Practitioner, $20 a month Or check your software free first

What is a stack? A stack is a watchlist: the products you run, named once, so you hear when a CVE touches one of them.

Community
$0
No card, no account for reading
Know if it touches you.
For anyone who lands on a CVE page. Start by checking what you run.
  • Every CVE page, every receipt and the version check, without an account.
  • Paste what you run and see every record that touches it, without an account.
  • With a free account: one stack, three products watched, sitreps by email, a weekly all-clear.
  • Every product you paste is watched free for your first 14 days, with no card.
  • 100 decision records, readable by link.
  • 25 briefs a month. API at 100 calls an hour.
  • 3 public-repo scans a month, summary only.
Check your software
No account to check. Sign in when you want to keep something. Or explore a CVE.
Practitioner
$20 a month
Cancel anytime
Know before they ask.
When you run more than three products, or bring in colleagues.
For the practitioner and the small team.
  • Three stacks, three seats, unlimited products per stack.
  • Sitreps to Slack, Teams, Jira and webhooks, each with the ticket paragraph and the proof link. See a sitrep
  • GitHub sync keeps the stack true. Re-paste merges.
  • Unlimited decision records, searchable history, bound-record export, retro view.
  • Unlimited briefs. API at 1,000 calls an hour.
  • Public-repo scans: Unlimited, full list.
  • More stacks or seats: $9 a month each.
Start Practitioner
Yearly carries a 30 day money back guarantee.
Advisor
$125 a month
Cancel anytime
Many stacks, one desk. Your advice on the record.
When you run clients' stacks under your name, every month.
For vCISOs, MSSPs, fractional security leads and product security teams who answer for stacks that are not their own.
  • Ten stacks, each with its own register and its own sitrep feed.
  • Sitreps and a monthly report per stack under your name, sent to the client. See a client report
  • Client-facing proof links: the record you choose, shared to a named reader.
  • The advice record: dated proof of what you told which client, and when.
  • Everything in Practitioner. Three seats; more stacks or seats at $9 a month each.
Start Advisor
Yearly carries a 30 day money back guarantee.
Custody
$10,000 a year
Billed yearly
Hand it to the auditor.
When an auditor samples your exceptions.
For whoever signs the exception and answers the sample.
  • Unlimited stacks, ten seats. Everything in Advisor.
  • Records nobody can delete or edit, including you. Changes are versions.
  • Access history: who opened which record, and when.
  • Auditor grant: the reviewer opens the sampled record themselves; a dated receipt and their attestation join the chain. See the auditor's view
  • Live identities from your OpenTelemetry pipeline, so the stack is what actually runs.
  • A setup session with the builder and a quarterly evidence scorecard. See a scorecard
Book an evidence review
Ready to buy now? Custody is also available by card, $10,000 a year.
Or write to sales@vciy.com. 30 day money back on the first term.

Advisor is the desk tool for running clients' stacks under your name. To rebrand and redistribute briefs to up to 20 clients, see the Provider licence.

Practitioner and Advisor grow by the stack or the seat. Custody is not more capacity. It is custody of the record, for the person who has to show an auditor who decided, when, and on what.

Every difference, in one place

Reading is free everywhere. What is counted is stacks, seats, channels and custody. Decision records are never counted above Community.

 CommunityPractitionerAdvisorCustody
Watching
Stacks watched13, more at $910, more at $9Unlimited
Products per stack3UnlimitedUnlimitedUnlimited
Seats13, more at $93, more at $910, more on request
Sitrep channelsEmailEmail, Slack, Teams, Jira, webhookEmail, Slack, Teams, Jira, webhookEmail, Slack, Teams, Jira, webhook
Weekly all-clearIncludedIncludedIncludedIncluded
Decision Watch: alerts held while your call holds, and an alert when it breaksIncludedIncludedIncludedIncluded
Smarter alerts: preferences read by vciy's own model, "Not relevant to us"IncludedIncludedIncludedIncluded
Keeping the stack trueRe-pasteGitHub sync, re-pasteGitHub sync, re-pasteOpenTelemetry live identities, GitHub sync
Records
Decision records100UnlimitedUnlimitedUnlimited
HistoryReadable by linkKept, searchableKept per stack, searchableKept team-wide, searchable
Bound-record exportNoIncludedIncludedIncluded, team-wide
Retro viewNoIncludedIncludedIncluded
Investigations, found by your whole organisationIncluded, within your recordsIncludedIncludedIncluded
Investigation: automated deep code analysis$49.99 per run$49.99 per run$49.99 per run$49.99 per run
Investigation: send me an expertContact usContact usContact usContact us
Insurance renewal reportNoIncludedIncludedIncluded
Auditor sample packNoOne pack of up to 5 CVEsOne pack of up to 5 CVEsIncluded
Briefs25 a monthUnlimitedUnlimitedUnlimited
Public-repo scans3 a month, summary onlyUnlimited, full listUnlimited, full listUnlimited, full list
API100 calls an hour1,000 calls an hour1,000 calls an hourAs licensed
Speaking for others
Reports per stack under your nameNoNoMonthly, sent to the clientMonthly, sent to the client
Client-facing proof linksNoNoIncludedIncluded
Custody
Records nobody can delete or editNoNoNoIncluded
Access historyNoNoNoIncluded
Auditor grant with attestationNoNoNoIncluded
Setup session and quarterly scorecardNoNoNoIncluded
Where it runsvciy cloudvciy cloudvciy cloudvciy cloud
Support, answered by a personIncludedIncludedIncludedIncluded

A sitrep fires on a new CISA KEV listing, a changed CISA deadline, a change in public exploitation status, or exploit probability crossing 10%, 50% or 90% in either direction. A source republishing a value it already holds is not a move. The weekly all-clear is an email that says nothing moved on what you watch, sent only when vciy has checked every public change that week against your watches.

On your hardware

On-Prem is everything in Custody, on your hardware. It is $50,000 a year for production. The index, the weights and the validation harness run on your network, feed and updates included, and nothing leaves it. The evaluation runs on your hardware first, at $25,000, and comes off your first production year.

Start a private evaluation

Monthly plans cancel anytime and stay active to the end of the billing period. Yearly plans are billed once and carry a 30 day money back guarantee, no questions. Custody is billed yearly.

Decision records freeze source facts beside your verdict and rationale, and take their date from our server. Briefs are not part of the frozen evidence. Exploit probability comes from FIRST's EPSS model. The scorecard reports coverage and record completeness; it never scores your exposure.

Full plan terms: Terms of Service.