Compare · Pillar

Free vs. paid security assessment — what you actually get

A comparison of SecurityStack Free ($0) and the $49 one-time unlock. By Arien Seghetti · Updated July 2026.

SecurityStack's Free tier shows you the methodology on unlimited tools with no exports. Unlocking for $49 adds AI-generated recommendations and PDF plus PPTX outputs. Both are per-assessment, not subscriptions — and going from Free to unlocked is lossless.

The short version

• Free ($0). You see the Cyber Defense Matrix 2.0 rendered against your stack. You do not get a document to send to anyone.
• Unlock ($49). You get the full matrix, the AI-generated recommendations, and two exports — a PDF executive report and a PPTX board deck.

Free — who it's for and what it shows

The Free tier is a faithful demonstration, not a crippled trial. It runs the same five-phase questionnaire, applies the same CAN-vs-IS coverage engine, and renders the same 7×9 Cyber Defense Matrix you would see once unlocked. The only deliberate limits are the absence of PDF and PPTX exports and the absence of AI-generated recommendations. Everything else — the matrix, the coverage percentages, the gap summary, the CAN-vs-IS comparison — renders in full, on unlimited tools.

The Free tier is designed for three kinds of users. First, security leaders who want to see the methodology on their own stack before paying. Second, consultants and internal-audit teams evaluating whether to bring the platform into a client engagement. Third, organizations that genuinely do not need an export yet — they want a permanent coverage record for their own reference. For all three, the Free tier is a complete product, not a sales funnel.

There is no credit card required, no trial clock, and no auto-upgrade. Assessments stay open indefinitely. You can return six months later, update your tool list, and watch the matrix re-render.

Unlock ($49) — who it's for and what unlocks

Unlocking is a one-time, per-assessment purchase and is where most paying customers land. It adds four capabilities that turn the assessment from a visualization into a deliverable.

Custom tool mapping. A mid-market program typically runs between 25 and 60 distinct tools, often climbing into the 80s for security-heavy industries or post-acquisition stacks. Unmatched tools can be self-mapped via a provisional-mapping flow that feeds directly into the coverage engine.

AI-generated "Do This Now" recommendations. The coverage engine identifies gaps. The AI layer turns those gaps into prioritized, business-language recommendations — with the "You Already Own the Fix" moves surfaced first, new purchases second, and consolidation opportunities third. Every recommendation includes a specific next step and an owner-role hint drawn from the questionnaire.

PDF executive report. Eleven sections covering coverage summary, the matrix, detailed gap analysis, 30/60/90 day roadmap, spend-at-risk analysis, and a plain-language executive summary. Cached by assessment hash so it regenerates only when your answers change. This is the artifact most CISOs send to their CEO or audit committee.

PPTX board deck. Five to six slides, board-ready, covering the same findings compressed to talking-point density. Used at quarterly risk committee reviews and in procurement justification meetings.

At $49 per assessment, unlocking is a fraction of the cost of a comparable consulting engagement. The unfair advantage is the vendor database that powers the CAN layer — 27 years of field judgment encoded as capability mappings. The software is the delivery mechanism.

The decision matrix

Three scenarios that cover most buyers.

The unlock path is lossless

Starting on Free and unlocking later is the recommended path for most buyers. Every tool you enter, every questionnaire answer you record, and every provisional mapping you submit on the Free tier carries forward unchanged when you unlock. The matrix re-renders with the full feature set against your existing data — there is no re-entry, no re-computation penalty, and no data loss.

There is no downgrade flow and none is needed. Because pricing is per-assessment, unlocking one assessment does not obligate you to unlock the next. Run this year's assessment free if your stack has not meaningfully changed, and unlock the year you need the full report. Each assessment is a separate transaction.

Frequently asked questions