Compliance + security, in one platform
Bring evidence, policies, penetration tests, and security findings together. Run the program with your team, or let Sythe handle the evidence work and scoped testing.
Need SOC 2? See managed scope & pricing30 minutes to discuss your systems, scope, and deadline.
See the platform
Explore the workspace, inspect the evidence, and see the auditor handoff. Real platform screens with sample data. No email required.
Your team: assign owners, collect records, and keep the business information accurate.
Start with the work that needs attention. The workspace brings assigned actions, policy reviews, and evidence status together so your team can decide what to address next.
Actual platform components with fictional sample data. Screens show separate examples, including multiple frameworks; the platform plan includes one framework. Click an image to enlarge it.
Real teams. Work you can inspect.
Jarred, Andrew, and their team are trusted partners - extensive penetration testing, code analysis, and security reviews that protect our users. We share a vision of prioritizing customer security above all else.
EchoWinSythe Labs was great to work with. Extremely knowledgeable, responsive, and trustworthy. I'd recommend them to anyone looking for security or penetration testing.
Maru AIThe strategic security recommendations from Sythe Labs have been invaluable. Their expertise helped us put real protection in place while keeping us moving fast.
Naked DenverChoose how you work
Run compliance and track penetration testing in the platform. Add operator-led services or cloud security to fit your team.
Warlock · Your team runs the program
One workspace for your compliance program and security testing engagements.
$499/month
Testing services are scoped and priced separately.
Platform + Sythe operators
Keep your engineers focused on delivery. We coordinate evidence and carry out scoped security testing.
$20,000/year
Agreed asset limits. Additional frameworks and services quoted separately.
Knell · Ongoing cloud visibility
Find exposed resources and attack paths to your data across your connected cloud providers.
$20 / user / month
A separate cloud-security subscription.
Test once. Keep testing. Stay on top of findings.
Need a report for a buyer or a release? Testing starts at $3,000. Track the engagement, findings, and report in the platform. No annual managed plan required.
Plan repeated human-led testing around your releases and changing attack surface. We agree targets, cadence, and retests with you. Ongoing programs are quoted to scope; continuous does not mean unlimited testing.
Turn scan results into prioritized work. Review findings, recommended fixes, and resolution status. The managed plan includes 12 scan runs per year against an agreed host scope; additional coverage is scoped separately.
Knell scans your connected cloud environments daily and maps attack paths to your data. Track exposure between testing engagements with a separate cloud-security subscription.
Choose who runs the work.
One organization, one compliance framework, up to 25 employees.
Your team runs compliance.
Your team collects and reviews evidence, assigns owners, and prepares the auditor package in the platform.
Managed evidence work, hands-on penetration testing, scan execution, independent audit fees, advisory, remediation, and monitoring are separate services.
Start with a walkthrough. We confirm your scope and assign the plan before billing begins. Larger teams and additional frameworks need a quote.
See the platformRequest a platform walkthroughFor companies under $5M revenue or 50 staff. One compliance framework is included.
Sythe runs evidence operations.
Your team supplies business context and approves policies. Sythe requests and reviews evidence, prepares materials, and follows up.
Additional frameworks: +$3,000 / yr.
The SOC 2 Type I, Security-only bundle includes the independent auditor fee. Type II audits, additional audit criteria, and other certification fees are quoted separately.
Discuss managed compliance (opens Google Calendar in a new tab)Each year includes 2 scoped penetration tests, one scoped retest per test, 2 risk assessments, and 12 vulnerability scan runs. Asset and host limits are agreed before work starts. Schedule testing within the service year, subject to availability.
Sythe operators request and review evidence, prepare materials, and follow up in the platform. You supply business information and approve your organization's policies. Routine clarification, corrections, and supported platform integration repairs are included.
The SOC 2 Type I, Security-only bundle is $20,000/year total, including the $3,000 independent auditor fee. Sythe coordinates preparation and the audit through the platform. The independent auditor performs the audit and issues the report. Type II audits and additional criteria are quoted separately.
Ongoing security monitoring and incident response are additional services. We recommend fixes; hands-on changes to your systems require a separate implementation scope.
Strategic compliance advice and expressly delegated decisions use a vCISO retainer at $250/hour, with hours approved in advance. Kickoff and pentest scoping and closure meetings are included. Other routine delivery happens in the platform; recurring consulting meetings are extra.
Enterprise: Custom. Over $5M revenue or 50 staff.
Talk to us (opens Google Calendar in a new tab)Managed security plans have no per-seat platform fees. One compliance framework is included; additional frameworks are annual add-ons. Standalone pentests are priced per engagement; Knell subscriptions use per-user pricing.
Repeated human-led testing around your systems and releases. Agree the targets, cadence, and retest allowance before work starts.
The managed plan includes two scoped pentests per year. A continuous program with additional coverage is quoted separately.
Standalone cloud-security subscription. Cloud posture with attack paths to your data. Daily scans across 9 providers.
Delivered through the platform. No annual managed plan required.
Small apps with straightforward workflows. ~2-week manual pentest with findings and recommended fixes. Confirm dates and retest scope before booking.
Premium $7,000 / test. Multi-module platforms with deeper access control and data models. ~4-week manual pentest.
Security testing and compliance delivery.The annual base plan is $20,000 for eligible companies, including one compliance framework. Each additional framework is $3,000 per year. Agree the targets and coverage before signing. Ongoing monitoring, incident response, advisory, and implementation are additional services.
Manual testing of agreed targets, with findings, recommended fixes, and a scoped retest. Implementing fixes is separate.
See the process12 scan runs per service year against an agreed host scope, with triaged findings and recommended next steps.
An organization-wide baseline and an update each year, within agreed scope. Use the assessments to prioritize risks and decide what needs treatment.
Upload vendor documents and ask questions about them. The assistant references supporting material and flags missing information. Your team decides whether to approve the vendor; human review is separately scoped.
Operators prepare and track evidence in the platform. One framework is included in the annual plan. The SOC 2 Type I, Security-only bundle includes the independent auditor fee. Type II audits, additional audit criteria, and other certification fees are quoted separately.
See the processCompliance consulting, remediation planning, and delegated approval management through a vCISO retainer at $250/hour, with hours approved in advance.
We validate technical work. You approve your policies. Delegated approvals require a separately scoped vCISO retainer.
Meet your operators.
Co-founder & CTO · Boulder, CO
Jarred leads technical strategy, product architecture, and security engineering at Sythe Labs. He leads penetration testing and turns findings into improvements to the platform and its controls. His work on the platform focuses on automating evidence collection and control evaluation.
Co-founder & CEO · Boulder, CO
Andrew leads company strategy, client relationships, and the compliance platform at Sythe Labs. He serves as CISO on client engagements, covering architecture reviews, vendor assessments, and board reporting. He oversees delivery across engagements, from scope and timelines through final deliverables.
| Task | Agent | Named operator, US-based |
|---|---|---|
| Pull evidence from live systems | Yes | No |
| Map controls across frameworks | Yes | No |
| Draft policies and procedures | Yes | No |
| Answer security questionnaires | Yes | No |
| Review technical controls | No | Yes |
| Judge exploitability | No | Yes |
| Confirm pentest findings | No | Yes |
| Review supporting evidence | No | Yes |
Every operator is a US-based Sythe Labs employee. We never outsource, subcontract or offshore any part of the work.
Organize controls, evidence, policies, and review work for your selected frameworks.
Link controls to framework requirements and reuse supporting evidence where the requirements overlap.
Pulled from live system state and reviewed for sufficiency and freshness.
Drafted against the environment you actually run, versioned, and routed for approval.
Track the scope, owner, and completion status of an agent task.
Review the action, target, and outcome recorded for agent requests that use a tracking key.
Sythe operators review technical controls and findings. Your team approves its policies unless approval is explicitly delegated under a vCISO retainer.
Integrations · Run Sythe Labs where you already work.
Know what you're buying.
Sythe Labs brings controls, evidence, policies, risk records, and audit preparation into one workspace. Your team runs these workflows on the Platform plan. Managed compliance adds operator-led evidence coordination and scoped security testing. Your team can see owners, status, and the records supporting each control.
See how compliance delivery worksThe $499/month Platform plan does not include independent audit fees. The SOC 2 Type I, Security-only bundle is $20,000/year total, including the $3,000 independent auditor fee. Sythe coordinates preparation and the audit through the platform. The independent auditor performs the audit and issues the report. Type II audits and additional criteria are quoted separately.
Review SOC 2 scope and pricingEach year includes 2 scoped penetration tests, one scoped retest per test, 2 risk assessments, and 12 vulnerability scan runs. Asset and host limits are agreed before work starts. Schedule testing within the service year, subject to availability.
Compare managed and standalone servicesOn the Platform plan, your team collects and reviews evidence, follows up with owners, and prepares the auditor package. With managed compliance: Sythe operators request and review evidence, prepare materials, and follow up in the platform. You supply business information and approve your organization's policies. Routine clarification, corrections, and supported platform integration repairs are included. Your team implements recommended changes unless implementation is separately scoped. Readiness depends on your systems, evidence, and agreed audit scope; buying the platform does not guarantee an audit result.
Plan for a customer's SOC 2 requestYes. Standalone penetration testing starts at $3,000 per engagement for small applications with straightforward workflows. We agree the assets, testing dates, deliverables, and retest scope before work starts. No annual managed plan is required.
Review the penetration testing processA 30-minute Google Meet with Andrew Roe to discuss your scope, deadlines, and the next steps. No form required to see available times.