Technical evaluation

vCISO Lite versus Thoropass

Head-to-head on the overlap — compliance automation — and an inventory of what each ships past it. Thoropass’s Connected Audit bundles the platform with an in-house audit firm; vCISO Lite ships the platform and keeps the customer’s choice of auditor open via firm.vcisolite.com.

Prepared: 2026-09-07
Method: Capability walk against published product docs, live product surfaces, industry-press coverage, funding disclosures, and vendor pricing pages.
Sources: thoropass.com, vcisolite.com product surfaces, PRNewswire (rebrand coverage), EIN Presswire (ISO 42001 announcement), Crunchbase (funding), G2 + Capterra + TrustRadius (aggregated ~549 reviews), soc2auditors.org, public customer disclosures. See §10.
Corrections: Both vendors invited to review. Send corrections to /contact; the “Prepared” date above is bumped on any material update.

On this page · 10 sections

TL;DR

Findings§1

Where Thoropass leads

Connected Audit — bundled platform + in-house audit firm. Licensed auditor delivering audits, supported by their own platform.^[1] The only vendor in this competitive set that bundles the auditor.
High-touch expert-advisory support. G2 support-quality score 9.6/10; reviews across G2, TrustRadius, and Capterra describe it as “like hiring a dedicated compliance officer.”^[2]
ISO 42001 certification (October 2024). Third-party-verified AI-management-system certification per their own press release.^[3] Single-source; verifiable via the ISO registry.
Public customer-review track record. ~1,000 customers globally; 4.7/5 across 549+ verified reviews on G2, Capterra, TrustRadius.^[4] vCISO Lite hasn’t been publicly reviewed at comparable scale.

Where vCISO Lite leads

On the overlap (compliance automation)

Framework mapping model. 250+ frameworks cross-mapped to 1,468 controls via the Secure Controls Framework, vs Thoropass’s ~25+ catalog (SOC 1/2, ISO 27001/27701, GDPR, PCI DSS, HIPAA, HITRUST e1/i1/r2, CMMC L1/L2, NIST 800-53/800-171, DORA, NIS 2, FERPA, ISO 9001, C5, CIS v8, CSA STAR, Cyber Essentials).^[5]
Custom framework support. Customers add their own frameworks and cross-map to SCF without waiting on the product team.
Cryptographically signed evidence graph. Per-event Ed25519 signatures, RFC 3161 timestamps, offline verifier binary — see use case · docs.vcisolite.com. Thoropass ships an audit log; not a tamper-evident graph.
Auditor-side surface (preserves customer’s choice of auditor). firm.vcisolite.com is a full auditor workspace — any audit firm the customer selects logs in, sees signed evidence, and signs attestations directly. Thoropass routes to their in-house firm.
Continuous maturity monitoring. Program maturity scored continuously with trajectory over time — regression surfaces the day it starts, not at the annual audit.

Beyond compliance automation (Thoropass does not compete)

Cyber risk quantification. FAIR-derived Monte Carlo, expected-annual-loss, loss-exceedance curves, native. Thoropass does not ship CRQ.
Third-party incident response. DC-TPIR / Refraction re-derives conditional $-exposure hourly during a live vendor breach. Thoropass ships vendor questionnaires; no incident-time math.
Vendor concentration analysis. Herfindahl-Hirschman scoring across the vendor inventory. Thoropass shows a list, no concentration math.
M&A cyber diligence. CCOD for buy-side (5-day pre-signing) and portco-side (quarterly board reporting) via the 5-pillar QCD methodology. Thoropass does not operate in M&A.
BIA and scenario rehearsal. BIA, dependency-graph mapping, ORE scoring, scenario rehearsal on top of DORA / NYDFS / NIST CSF RC framework coverage. Thoropass ships DORA framework coverage (added 2025-06) but doesn’t publish BIA scoring or scenario-rehearsal workflows.
KRI automation. Continuous Key Risk Indicators with threshold alerting and drill-down to evidence. Thoropass does not ship KRIs.
Governed autonomous operations. Trustworthy Autonomy™ (public beta, July 2026): every autonomous action runs through an explicit, scoped, signed authority grant. Thoropass does not ship an agent-governance product.
MCP tool graph. Titanium exposes 100+ evidence-backed tools via Model Context Protocol to LLM clients. Thoropass ships an MCP server (July 2026); vCISO Lite differentiates on signed authority grants + evidence integrity over the MCP surface.
Board-ready reporting. Templated quarterly packet with narrative synthesis, CRQ figures, and scenario overlays — not just exportable dashboards.
vCISO advisory on Ultra+ tiers. CISO consulting on Ultra (4h/mo) and a dedicated vCISO Advisor on Enterprise — strategic security advisory, distinct from Thoropass’s compliance-program advisory.
Published pricing. Starter $3,228/yr billed annually ($299/mo). Thoropass is quote-only.

Thoropass is a compliance-automation product bundled with an in-house audit firm — genuinely differentiated from every other vendor in this set. vCISO Lite is a security & cyber-risk platform of which compliance automation is one surface; it keeps the customer’s choice of auditor open via firm.vcisolite.com. The decision starts with the auditor question, not the platform question.

Pick Thoropass when the buyer is a first-time SOC 2 / ISO 27001 organization with no incumbent audit-firm relationship AND wants one vendor for both readiness tooling and the audit itself. G2 rates their support 9.6/10 across 200+ reviews.

Pick vCISO Lite when the buyer has an incumbent auditor they intend to keep, OR when the work is broader: cyber risk quantified in dollars for a board, vendor-incident exposure computed within hours, M&A cyber diligence, BIA + scenario rehearsal on top of DORA / NYDFS, or framework coverage beyond Thoropass’s ~25+ catalog (250+ via SCF). Pricing published starting at $3,228 / yr billed annually.

Neither Thoropass nor any other vendor in the category ships a formal third-party incident response engine that re-computes $-exposure hourly during a live vendor breach — vCISO Lite does, via DC-TPIR productized as Refraction. Detail in §4.1.

Scope & evaluation criteria

Boundaries§2

In scope

Buyer profile: Companies at 25–500 employees carrying compliance, vendor risk, cyber-risk, and (frequently) M&A cyber-diligence workloads without a full-time in-house CISO or GRC lead.
Evaluation frame: Ten capability categories the buyer is evaluating BOTH tools for, plus Thoropass’s Connected Audit (bundled in-house audit firm) as a distinctive-to-Thoropass row. Not: everything each product does.
Comparison basis: Published product documentation, live product surfaces, public pricing where disclosed, vendor-published customer disclosures, industry-press coverage (PRNewswire, EIN Presswire), funding-round disclosures (Crunchbase), and multi-platform review aggregation (G2, Capterra, TrustRadius, soc2auditors.org). Not: vendor-sponsored bakeoffs or internal-only NDA material.

Out of scope

Audit-firm quality comparison: This page evaluates the compliance-automation PLATFORM. Thoropass’s in-house audit firm quality vs the customer’s incumbent audit firm is a separate evaluation that requires audit-firm-specific reference calls.
SI/consulting overlays: Both vendors have partner ecosystems that add capability at additional cost. This page evaluates in-product capability only.
Roadmap: Only shipped, generally-available capability is compared. Beta and private-preview capabilities are footnoted where public.

Capability coverage

Fourteen capabilities§3

Amber = Thoropass ships it. Teal = vCISO Lite ships it. Split = both ship it (weighted when one is materially stronger). Hover a hex for the mechanism detail.

Capability deep-dives

How each side implements it§4

Five capabilities, one spec-card per side. Same slots on both cards so the reader can eye-compare row by row. Framework decomposition lives in §5.

§4.1

Vendor risk & third-party incident response

Both platforms ship the static assessment primitives. The differences show up when a critical vendor discloses a live breach and the buyer needs a defensible $-exposure figure the same hour.

Thoropass

Static questionnaire + continuous scanning.

Inputs: SIG / CAIQ / custom questionnaires · ongoing external scan of vendor domains (TLS, headers, breach signals).
Outputs: Weighted questionnaire scoring · risk-tier assignment · monitoring alerts.
Evidence: Assessment records · tiered vendor inventory.
Fails when: A critical vendor discloses a breach — no in-platform response, buyer works the exposure question outside the platform.

vCISO Lite

Same static-assessment primitives, plus DC-TPIR conditional-exposure engine for live incidents.

Inputs: Same questionnaire + scanning primitives · plus a formal dependency graph mapping vendors to business functions.
Outputs: Conditional $-exposure re-derived hourly during an incident · cheapest-mitigation naming.
Evidence: Signed exposure trace in the evidence graph · DC-TPIR methodology published on /briefs-and-specs.
Fails when: Vendor hasn't disclosed the incident — the engine has nothing to re-derive against.

§4.2

Connected Audit (bundled platform + in-house audit firm)

The honest differentiator. Thoropass is the only vendor in this set that bundles the auditor with the platform; vCISO Lite keeps the customer's audit-firm choice open by construction.

Thoropass

Platform + in-house audit firm bundled in a single engagement.

Inputs: Two-entity structure: Thoropass, Inc. (platform) + Laika Compliance, LLC dba Thoropass Assurance (CPA firm) — separate legal entities under common ownership, AICPA-registered, peer-review passing through Jan 2025.
Outputs: SOC 1/2 reports issued by Thoropass Assurance (AICPA § 1.295.145 clearance with safeguards); ISO 27001 certificates issued by third-party accredited CBs (BSI, Schellman) per ISO/IEC 17021-1 § 5.2.5.
Evidence: Signed engagement letter + SOC/ISO report from bundled firm.
Fails when: Buyer has an incumbent auditor they intend to keep · or governance (PE, public-company audit committee) requires third-party independence-in-appearance.

vCISO Lite

Platform + auditor-side surface for the customer's chosen audit firm.

Inputs: Customer selects their own auditor · auditor onboarded to firm.vcisolite.com workspace · signed evidence graph available to the auditor by construction.
Outputs: Audit firm signs attestations directly against the graph · no artifact reconciliation across two vendors.
Evidence: firm.vcisolite.com engagement records · signed attestations in the evidence graph.
Fails when: Buyer has no incumbent auditor AND wants one vendor to own both platform + audit — Thoropass's bundle is a cleaner fit.

§4.3

M&A cyber diligence

Thoropass

Not shipped. No sell-side, buy-side, or portco-side M&A cyber-diligence capability in-product. PE / IB buyers typically overlay a Kroll / Deloitte / boutique diligence firm.

vCISO Lite

Cyber Cost of Deal (CCOD) + 5-pillar Quantitative Cyber Diligence (QCD).

Inputs: Target's attack surface · vendor concentration · data sensitivity · insurability · remediation-cost baseline.
Outputs: CCOD as a dollar figure decomposed into Risk Cost + Remediation Cost · portco quarterly delta.
Evidence: Buy-side pre-signing packet (5-day surface) · portco quarterly board packet · sponsor-level portfolio view for cross-holding concentration risk.
Fails when: Target hasn't cooperated on data-room access — pillars fall back to signal-only estimation.

§4.4

Advisory model

Thoropass has iterated longer on high-touch compliance-program support (G2 9.6/10). vCISO Lite ships a different discipline: strategic security advisory, not compliance-program management.

Thoropass

Expert compliance-program advisory bundled in the Connected Audit.

Inputs: Assigned compliance-program specialist · G2 support-quality score 9.6/10 across 200+ reviews.
Outputs: Compliance-program management · audit readiness · policy walk-throughs · "how do I pass this audit."
Evidence: Customer-review theme across G2, Capterra, TrustRadius: "like hiring a dedicated compliance officer."
Fails when: Heavy advisory dependency can slow turnaround as the organization grows (surfaced in some customer reviews).

vCISO Lite

CISO consulting on the Ultra tier (4h/mo); Enterprise includes a dedicated vCISO Advisor — strategic security advisory.

Inputs: Ultra/Enterprise practitioner assigned at account signup · direct platform access for the vCISO.
Outputs: Attested policies · scenario runs against the buyer's own posture · quarterly board packet drafts.
Evidence: Advisor's actions traced in the evidence graph · attested artifacts referenced by name.
Fails when: Buyer on Starter / Growth / Business — CISO consulting is Ultra and Enterprise only.

§4.5

Pricing model & sales motion

Thoropass

Quote-only bundle: platform + audit scope + framework count + company size.

Inputs: Buyer's headcount · framework mix · required audit report · procurement cycle.
Outputs: Bundle quote after ~2–3 week sales cycle (demo → scope → bundle quote including audit).
Evidence: Signed engagement letter covering both platform + audit.
Fails when: CFO wants to size the deal without a sales cycle — no published price to work against · buyer with incumbent auditor is paying for a slot they won't use.

vCISO Lite

Published tiers, direct-sold to end-buyers.

Inputs: Buyer's plan tier (Starter / Growth / Business / Ultra / Enterprise).
Outputs: Signed order form referencing the /pricing published rate · monthly or annual billing · auditor sourced separately.
Evidence: Public /pricing page + terms-of-service; Starter $3,228/yr billed annually ($299/mo).
Fails when: Buyer wants one vendor to own platform + audit — that's Thoropass's bundle, not vCISO Lite's shape.

Framework & control coverage

Framework depth§5

Thoropass publishes ~25+ frameworks curated for the reports their in-house audit firm delivers. vCISO Lite ships 250+ frameworkscross-mapped to 1,468 controls via the Secure Controls Framework. Thoropass’s narrower catalog is a deliberate product decision — deeper per-framework automation, narrower breadth.

Thoropass^[5]

SOC 1

SOC 2

ISO 27001

ISO 27701

PCI DSS

HIPAA

HITRUST

CMMC L1

CMMC L2

NIST 800-53

NIST 800-171

DORA

NIS 2

FERPA

ISO 9001

CIS v8

CSA STAR

GDPR

Cyber Ess.

vCISO Lite

CIPA

COPPA

NYDFS 500

CMMC L1

CMMC L2

CMMC L3

800-171r3

CSA CCM v4

NIST CSF 2.0

FERPA

PCI DSS 4

ISO 27001

SOC 2

HIPAA

GDPR

GLBA

FedRAMP

CJIS

COBIT

HITRUST

NIST 800-53

NIST 800-53r5

ISO 27002

ISO 27017

ISO 27018

ISO 27701

ISO 22301

SOC 1

SOC 3

StateRAMP

CIS Controls

CIS Bench

MITRE ATT&CK

NIST 800-63

NIST 800-172

FFIEC CAT

HITECH

SWIFT CSCF

ENISA NIS 2

DORA

NIS 2

CCPA

LGPD

PIPEDA

TX-RAMP

IRAP

BSI C5

TISAX

CSA STAR

PCI PIN

Pricing & sales motion

How each is bought§6

Two facing pricing stacks — the way a CFO reads a comparison. Amber column is Thoropass; teal column is vCISO Lite.

Thoropass

Quote-only

Bundle: platform + audit scope + framework count + company size

Sales channel: Direct sales
Target buyer: First-time SOC 2 / ISO 27001 orgs (25–500 employees)
Product SKUs: Connected Audit bundle · platform + in-house audit firm
Audit firm engagement: Included · Thoropass Assurance (Laika Compliance, LLC)
Contract length: Annual minimum · scoped to audit-cycle length
Framework add-on: Framework count factored into bundle quote
Scaling dimension: Company size + audit scope
Advisory hours: Expert compliance-program advisory bundled (G2 9.6/10)^[2]
Onboarding: Implementation + first-audit expert guidance
Trust Center: Included
Sales cycle: ~2–3 weeks (demo → scope → bundle quote including audit)

vCISO Lite

$0 / yr

Starter · billed annually ($299/mo) · published on /pricing

Sales channel: Direct · optional white-label
Target buyer: Mid-market with incumbent auditor + PE portcos (25–500 employees)
Product SKUs: Published tiers on /pricing (Starter → Enterprise)
Audit firm engagement: Separate · customer sources their own audit firm via firm.vcisolite.com
Contract length: Annual or monthly · no multi-year lock required
Framework coverage: 250+ framework catalog on every plan; Starter 3 active assessments, higher tiers scale coverage
Scaling dimension: Plan tier, not org headcount
Advisory hours: CISO consulting on Ultra (4h/mo); Enterprise dedicated vCISO Advisor · strategic security advisory
Onboarding: Dedicated onboarding available as an add-on
Trust Center: Not offered at time of comparison
Sales cycle: Zero · self-serve from published tier

Integration surface

Native connectors§7

Top-15 SMB integrations by usage frequency. Thoropass’s catalog is not published as a count; coverage below is inferred from customer-review references and their public docs. See vCISO Lite’s full integration catalog.

Integration	Thoropass	vCISO Lite
AWS	Native	Native
GCP	Native	Native
Azure	Native	Native
Okta	Native	Native
Google Workspace	Native	Native
Microsoft 365	Native	Native
GitHub	Native	Native
GitLab	Native	Native
Bitbucket	—	—
Jira	Native	Native
Slack	Native	Native
Jamf / Kandji (MDM)	Native	Native
CrowdStrike	—	—
Datadog	—	Native
Snowflake	—	Native
Total published integrations	Not disclosed as a specific count	~90

Deployment, data, extensibility

Platform architecture§8

Attribute	Thoropass	vCISO Lite
Service model	SaaS multi-tenant + in-house audit firm	SaaS multi-tenant · optional white-label Silver surface
Data residency	US (primary)	US (primary)
Tenant isolation	Logical (row-level org scoping)	Logical (row-level org scoping)
Public API	REST	REST + MCP (Model Context Protocol) tool graph · OpenAPI 3.0
SSO / SCIM	SAML 2.0 · OIDC · SCIM 2.0	SAML 2.0 · OIDC · SCIM 2.0
Audit-trail model	Event log · exportable	Ed25519-signed per-event chain · RFC 3161 timestamped · verifier cron
AI / LLM surface	ISO 42001 certified for internal AI governance (Oct 2024)^[3] · AI-assisted evidence workflows · MCP server (July 2026)	Titanium MCP tool graph · governed autonomous ops via Trustworthy Autonomy™ · evidence-backed answers
Own compliance	SOC 2 Type II · ISO 27001 · ISO 42001 · HITRUST i1	SOC 2 Type II · ISO 27001 (in progress) · runs on itself

Notes & sources

Provenance§10

[1]Thoropass Connected Audit model per thoropass.com (accessed 2026-09-02, disclosed as “Thoropass is a licensed auditor that delivers audits, supported by purpose built software to streamline the process”). Customer testimonial (“We picked Thoropass because it provides an assessor and a platform…”) verbatim from the same source. Corroborated by TrustRadius aggregation (in-house auditors + platform bundled), sprinto.com/blog/thoropass-review, and soc2auditors.org “Connected Audit Verdict” review (all accessed 2026-09-02). Cross-verified across three source categories (vendor site, review platforms, third-party review aggregators).
[2]Support-quality score per g2.com/products/thoropass/reviews (accessed 2026-09-02): 9.6/10 for quality of support across 200+ G2 reviews. Customer-review theme (support “incredibly helpful and hands-on” / “like hiring a dedicated compliance officer”) corroborated across G2, TrustRadius, and Capterra aggregation. Overall Thoropass rating: 4.7/5 across 549+ verified reviews across all three platforms.
[3]ISO 42001 certification per Thoropass press release “Thoropass becomes the first infosec compliance solution to achieve ISO 42001 certification” (October 2024) and EIN Presswire coverage of the same announcement. ISO 42001 (AI management systems) is a genuine third-party-verified certification; the “first infosec compliance solution” framing is Thoropass’s own claim and is presented here as such, not as an independently-verified market-first claim.
[4]Customer count (“more than 1,000 organizations globally”) per thoropass.com FAQ (accessed 2026-09-02). Review aggregation (4.7/5 across 549+ verified reviews across G2, Capterra, TrustRadius) per sprinto.com/blog/thoropass-review aggregation (accessed 2026-09-02, note: aggregation compiled by a Thoropass competitor).
[5]Thoropass framework catalog per help.thoropass.com/en/articles/11460011 (May 2025) and thoropass.com/blog/eight-new-frameworks (2025-06-24): SOC 1, SOC 2, ISO 27001, ISO 27701, GDPR, PCI DSS, HIPAA, HITRUST e1/i1/r2, CMMC L1, CMMC L2, NIST 800-53, NIST 800-171, DORA, NIS 2, ISO 9001, FERPA, C5, CIS v8, CSA STAR, Cyber Essentials (~28 total). vCISO Lite framework count from vcisolite.com/features/compliance (accessed 2026-09-02, disclosed as “250+ frameworks cross-mapped to 1,468 controls via SCF”). Note: Thoropass’s narrower catalog is a deliberate product decision (optimized for the reports their in-house audit firm delivers), not a coverage gap — deeper per-framework automation, narrower breadth.
[6]Company history: founded 2019 by Austin Ogilvie, Sam Li, and Eva Pittas (per Thoropass company page and Crunchbase); rebranded from Laika to Thoropass March 2023 per PRNewswire (“Laika Announces Rebrand to Thoropass”) and thoropass.com/company/newsroom. Funding: $50M Series C led by Fin Capital with Centana Growth participating (November 2022); $98M total across 3 rounds per Crunchbase (accessed 2026-09-02).
[7] Two-entity independence structure per thoropass.com/independence-and-excellence and thoropass.com/blog/setting-the-record-straight-on-independence (accessed 2026-09-02): Thoropass, Inc. (platform) and Laika Compliance, LLC dba Thoropass Assurance (CPA firm) operate as separate legal entities under common ownership; Thoropass Assurance is AICPA-registered with a passing peer review accepted December 12, 2025 (period through January 31, 2025). AICPA independence rule per ET § 1.295.145 (Information Systems Services), effective January 2023, permits information-systems services to an attest client with safeguards when the system is not a Financial Information System. ISO/IEC 17021-1 § 5.2.5 (per European Accreditation FAQ 41.1) prohibits a certification body, any part of the same legal entity, and any entity under its organizational control from offering management-system consultancy — the reason Thoropass does not self-certify ISO 27001 and instead partners with third-party accredited certification bodies.
All product capability claims for both platforms are current as of the “Prepared” date at the top of this page. Thoropass’s product surface is evolving; capabilities may have shipped since. Corrections: /contact.
This page does not compare against Vanta, Drata, Secureframe, Sprinto, or other compliance-automation vendors. For the Vanta comparison see /vs/vanta; for the Drata comparison see /vs/drata; for the Secureframe comparison see /vs/secureframe; for the Sprinto comparison see /vs/sprinto; the full head-to-head hub is /compare. For what a vCISO service actually is (not just the alternative products), see /services/vciso; for a broader competitive frame, see /why-vciso-lite.

vCvCISO Litevs versus Thoropass

Make the case for vCISO Lite over Thoropass

vCISO Lite versus Thoropass