Scrutineer.ai
All posts
Comparison

Panorays Pricing and What Each Bundle Costs

Panorays pricing is quote-only across three bundles. The median buyer pays about $21,700 a year, reported $12,000 to $34,900. What moves the quote.

By the Scrutineer team

October 2026 · 8 min read

Try it while you read

No account, nothing to install.

Pick a framework or a vendor and run a scrutiny. You get per-control statuses, the evidence behind each one, and a prioritized gap list.

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

Panorays does not publish a price. Its pricing page sells three bundles, Inventory, Assessment and Monitoring, and every one of them ends in a request for a quote. Recorded purchase data on Vendr, last updated February 2026, puts the median Panorays contract at $21,700 a year, with a reported low of $12,000 and a high of $34,900. Treat those as reported figures and confirm your own number with Panorays.

That median is useful, but it hides the thing that decides your contract. Panorays says its pricing "is based on your security risk strategy and the types of assessments you require." In practice that means the number moves with how many third parties you assess each year and which bundle you need, not with a seat count. This guide lays out what is public, what buyers report paying, where the published figures contradict each other, and how to walk into the sales call with a number of your own.

How much does Panorays cost?

Panorays costs a median of about $21,700 a year, based on purchase data Vendr last updated in February 2026, with reported contracts running from roughly $12,000 to $34,900. Panorays itself publishes no list price. It quotes each customer based on the bundle, the number of third parties in scope and the assessment types you run, and add-ons such as DORA support are priced on top.

For a US mid-market program assessing a few dozen critical suppliers a year, the low-to-median band is a reasonable planning range. A program that wants continuous monitoring across several hundred vendors, plus the assessment workflow, should expect to sit above the median, and possibly well above the top of that range.

Panorays pricing plans and bundles

The Panorays pricing page is organized by what you want to do with third-party risk rather than by size. It lists three bundles, each quote-only, and shows a feature comparison between them. We read the page in October 2026.

BundleWhat Panorays says it is forPublished priceWho it fits
Inventory"Centralize third-party cyber risk for full visibility"Quote onlyTeams that do not yet know who all their vendors are
AssessmentPeriodic evaluation of third parties, at onboarding and for existing suppliersQuote onlyPrograms that send and score security questionnaires
Monitoring"Optimize cyber risk for ongoing threat monitoring"Quote onlyPrograms that want an external, continuous signal on vendors
DORA supportAdd-on for the Assessment and Monitoring bundlesQuote onlyFirms with EU financial entities in the group

The DORA line is worth a note for US buyers. DORA is an EU regulation. If you are a US company with no EU financial entity in scope, you can leave that add-on off the quote entirely, and you should ask for it to be removed if it appears.

What buyers report paying for Panorays

Because there is no list price, recorded purchases are the best public evidence. Here is what Vendr shows, and the problem with it.

FigureReported valueSource and caveat
Median annual contract$21,700Vendr, last updated February 2026
Reported low$12,000 a yearVendr, same page
Reported high$34,900 a yearVendr, same page
Estimated small deployment, about 50 to 150 vendors$30,000 to $60,000 a yearVendr deployment estimate, which does not agree with the range above
Estimated mid-tier deployment, about 150 to 500 vendors$60,000 to $150,000 a yearVendr deployment estimate
Implementation fee$5,000 to $40,000Vendr, described as often waived or reduced on multi-year terms

The two halves of that table contradict each other. A median of $21,700 cannot sit below the floor of the "small deployment" estimate. Our reading: the recorded contracts are mostly smaller programs, while the deployment estimates describe what a larger vendor count would cost. So if you are budgeting for 50 vendors or fewer, the recorded range is your guide. If you plan to put hundreds of suppliers under monitoring, plan from the deployment estimates and expect the quote to land there. Directory listings that show a Panorays starting price of a few thousand dollars "per feature" give no basis for the figure, so we would not budget on them.

What moves a Panorays quote

  • The number of third parties in scope. This is the biggest lever. A vendor list only grows, so ask what the price becomes at the next band before you sign.
  • Which bundle. Assessment and Monitoring together cost more than either alone, and many programs only need one in year one.
  • Assessment volume. Running full questionnaires on every supplier every year is expensive in any tool. Tiering vendors first, so only critical and high-risk suppliers get the full assessment, cuts both the quote and the work. Our guide to vendor tiering covers the criteria.
  • Add-ons. DORA support is the published one. Ask whether anything else on your quote is an add-on.
  • Term length. Vendr reports 15 to 25 percent off list on annual deals with a competitive evaluation, and 20 to 35 percent on two- or three-year terms. Read those as negotiation reports, not promises.

Is Panorays worth the price?

For an organization whose main problem is a large, under-documented supplier base, it can be. Panorays combines a vendor's questionnaire answers with externally observed attack-surface data on one record, weights findings by how much the relationship matters to your business, and maps the suppliers behind your suppliers. Those are real capabilities, and they are hard to rebuild in a spreadsheet.

It is a weaker fit when the question your customers and auditors ask is about your own controls. Panorays scores other companies. It does not map your own controls to SOC 2 or ISO 27001 or gather the evidence your auditor will ask for, so a team that buys it usually still pays separately for its own compliance program. Our Panorays alternative page sets out where Panorays wins and where a combined tool fits better, and the third-party risk management software pricing page compares what every major TPRM platform bills on.

Panorays pricing vs Scrutineer pricing

QuestionPanoraysScrutineer
Are prices public?No, every bundle is quote onlyYes, all three plans are on the pricing page
Reported or listed annual costMedian about $21,700, reported $12,000 to $34,900Risk+ (TPRM) at $2,500 a month, or $15,000 a year
What sets the price?Bundle, third parties in scope, assessment types, add-onsA flat plan price, vendor risk scoring not metered per vendor
Your own SOC 2, ISO 27001 and HIPAA readinessNot includedIncluded in every plan
External attack-surface ratings of vendorsA core strengthNot offered; vendors are assessed from evidence and questionnaires
Nth-party supplier discoveryYesFourth parties tracked from vendor disclosures, not discovered from the internet

The honest summary: if outside-in scanning of hundreds of vendors is the requirement, Panorays does something we do not. If the requirement is assessing vendors from their evidence and proving your own controls to auditors and customers on one budget, a published flat price is easier to plan around than a quote.

Panorays vs CyberGRX on cost

Buyers who search for Panorays pricing often have CyberGRX on the same shortlist. CyberGRX is now part of ProcessUnity, and like Panorays it quotes rather than publishes. The difference is the model: an exchange of pre-completed vendor assessments versus a platform that runs your own assessments and monitoring. Our ProcessUnity pricing breakdown covers that side, and the TPRM software comparison puts the two next to each other.

How to get an accurate Panorays quote

  1. Count your third parties and tier them. Decide which tiers need a full assessment, which need only monitoring, and which need neither.
  2. Pick the bundle you need in year one. Adding a bundle at renewal is easier than paying for one you do not use.
  3. Ask Panorays to show every add-on as a separate line, and remove DORA support if you have no EU financial entity in scope.
  4. Ask for the price at the next vendor band, the implementation fee and the renewal uplift cap in writing. Then put those terms where your team will actually see them at renewal: a contract management system that flags the notice window keeps a 3 to 7 percent annual escalator from rolling in unchallenged.
  5. Get at least one competing quote. Vendr's own negotiation notes say a named alternative is one of the strongest levers on price.

If you would rather see a flat-priced option work before you talk to anyone, run a vendor assessment in the demo at the top of this page. It scores a sample vendor the same way it would score yours.

See Scrutineer scrutinize your posture

Connect your stack, and Scrutineer maps your controls to SOC 2, ISO 27001, HIPAA, GDPR and PCI, collects evidence automatically and returns a readiness report with per-control statuses, linked evidence and a prioritized gap list. AI scrutinizes, you decide.

Scrutinize on real evidence, not stale spreadsheets

Scrutineer maps your controls to SOC 2, ISO 27001, HIPAA, GDPR and PCI, collects evidence automatically and scores vendor risk continuously, and returns a readiness report with a prioritized gap list. AI scrutinizes, you decide.

Automated evidence · Per-control statuses · Prioritized gap list

Mapped controls · evidence-linked rationale for every status · an accredited auditor issues the attestation.