Sold by: Strike Graph
Strike Graph's AI-native compliance management software empowers organizations with world-class AI technology for GRC to reduce manual work, stay continuously compliant with real-time validation, and scale effortlessly to meet enterprise standards.
4.6
Overview
Helping teams confidently navigate complex compliance programs, Strike Graph was built for mid-size to large enterprise companies looking to reduce manual effort, audit risk, and time to certification without compromising security and speed.
Uniquely positioned for the highly regulated industries from Department of Defense contractors, manufacturing, medical devices, and finance, Strike Graph's native AI and purpose built features like System Security Plans (SSP), Plan of Action & Milestones (POA&Ms), Self-Assessments, and SBOMs make achieving CMMC a breeze.
Intelligent cross-framework mappings of risks, controls and evidence streamline achieving compliance for ISO 27001, NIST 800-171, TISAX, PCI DSS, and US and EU Pre & Post Market Requirements. Easily manage and share compliance across your entire organization with enterprise content management.
At the core is Verify AI, your intelligent internal auditor. It continuously tests controls, validates evidence, and flags issues in real time-tailored to your unique compliance needs, not just standard templates. Verify AI ensures ongoing audit readiness by monitoring your program between assessments and offering instant, actionable insights.
Supporting this is the Security Assistant, your AI compliance advisor. It recommends improvements, auto-fills security questionnaires, and implements fixes with a single click. Combined, these features eliminate guesswork and streamline your entire compliance lifecycle.
Strike Graph integrates seamlessly with over 5,000 data sources to securely automate workflows and make recommendations based on your unique environment minimizing friction and accelerating compliance. Security is a priority. Your data remains encrypted, siloed, and never used to train third-party models. You control visibility with granular access settings to ensure only authorized users and view or edit data.
Our vision is simple: AI that empowers your GRC. Get audit-ready, stay compliant, and move your business forward with confidence.
Highlights
- Manage compliance across your enterprise: With Strike Graph Workspaces, you can easily share controls, assign tasks, and track progress across multiple locations, frameworks, or products-all from one centralized platform.
- Powerful AI tools: Our suite of AI features (Atlas, Verify AI, and AI Security Assistant) ensures ongoing audit readiness by identifying gaps, continuously testing controls, validating evidence, and flagging any issues in real time. Get instant, actionable insights, recommendations to improve your security posture, and auto-fill security questionnaires.
- Seamless Integrations: Securely connect data sources to initiate real-time evidence collection. Our AI understands your environment and suggests relevant controls, minimizing friction and accelerating compliance across all frameworks.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor, and additional usage. You pay upfront or in installments according to your contract terms with the vendor. This entitles you to a specified quantity of use for the contract duration. Usage-based pricing is in effect for overages or additional usage not covered in the contract. These charges are applied on top of the contract price. If you choose not to renew or replace your contract before the contract end date, access to your entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Scale | Includes: Everything from Certify plan, Pre-seeded Tier 1 or Tier 2 framework (ISO 27001, PCI DSS, TISAX), Verify AI, Multi-domain users, 20 security questionnaires, Reduced audit, framework, and evidence attachment pricing, Additional cross-mapped framework, Annual audits (additional cost) | $18,000.00 |
CMMC Bundle | Includes: NIST 800-171 (CMMC Framework), SSP, POAM, SBOM, and Self Evaluation | $14,000.00 |
MedDev | Includes: MedDev, HITRUST, and SBOM | $12,000.00 |
Tier 1 Framework | Includes one Framework: CIS, CCPA/CPRA, GDPR, HIPAA, ISO 27701, NIST CSF (FINRA/GLBA), SOC 1, SOC 2 | $3,000.00 |
Tier 2 Framework | Includes one Framework: Essential Eight, ISO 27001, ISO 27799, ISO 42001, ISO 9001, PCI DDS, TISAX | $5,000.00 |
Tier 3 Framework | Includes one Framework: AZ DIFI, CMS, DORA, HITRUST, ISO 13485, MedDev, NIST 800-53 (FedRAMP), NIS2, NIST 800-171 (CMMC) | $8,000.00 |
Dimension | Description | Cost/unit |
|---|---|---|
Overages | Additional Usage | $1.00 |
Dimensions summary
You buy this platform through a contract. The Scale option builds on the Certify plan and adds pre-seeded frameworks, AI validation, and reduced audit pricing. You then add framework coverage in three tiers, each covering one framework: Tier 1, Tier 2, or Tier 3, grouped by complexity. Two bundles package related frameworks together: the CMMC Bundle and MedDev. If your usage passes what your contract includes, the Overages dimension charges for additional usage. You combine these pieces to match the frameworks and scale your organization needs.
Top-of-mind questions for buyers
Each framework tier unit covers one framework you select. Tier 1 includes options like SOC 2, HIPAA, or GDPR. Tier 2 includes options like ISO 27001 or PCI DSS. Tier 3 includes options like HITRUST, FedRAMP, or CMMC. Tiers group frameworks by complexity, not by number included.
You start with a Scale unit, which builds on the Certify plan and reduces framework and audit pricing. You then add framework tier units or bundles for the standards you need. Each added framework charges separately. Scale sets your base; framework units and bundles stack on top.
Overages apply when your usage passes what your contract includes. You can add frameworks or services during the year; the vendor notes compliance is a journey and lets you expand later. Added framework standards carry their own cost based on your plan level.
www.strikegraph.com
Helpful?
Vendor refund policy
All fees are non-refundable and non-cancellable except as required by law.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
Email support services are available from Monday to Friday.
support@strikegraph.com
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
The AI-native CrowdStrike Falcon Platform provides comprehensive protection across all areas of enterprise risk - devices, identities, data, endpoints and cloud. Powered by a single agent, crowdsourced data, expert threat intelligence, and advanced AI, the Falcon Platform simplifies security operations and stops breaches.
Neo4j Aura is a fully managed, always-on graph database-as-a-service (DBaaS) that helps organizations uncover hidden patterns and relationships across connected data. Built for modern applications and AI, it enables teams to create knowledge graphs, power GraphRAG and agentic AI, and support use cases such as fraud detection, customer 360, product recommendations, and supply chain optimization. With flexible, pay-as-you-go pricing, AuraDB makes it easy to scale graph-powered innovation on AWS.
Glean revolutionizes enterprise productivity through its AI-powered workspace platform. At its core, Glean employs Retrieval-Augmented Generation (RAG) to deliver secure, permission-based access to organizational knowledge. The platform combines a sophisticated enterprise knowledge graph with web-sourced information, enabling contextually rich AI interactions.
AI-native platform that automates financial crime compliance - from sanctions screening to complex trade finance investigations - with governed, evidence-based AI agents.
Customer reviews
Frederick B.
Strike Graph Sets the Bar for Enterprise GRC
Reviewed on Sep 17, 2026
Review provided by G2
What do you like best about the product?
From my perspective, I’ve seen quite a few GRC platforms, and none of them hold a candle to Strike Graph. I came to my current position from NASA’s Jet Propulsion Lab, where we managed over 200 SSPs at one point across virtually every business unit using a home-grown program that was well past its useful life. It wasn’t user-friendly, couldn’t be updated to keep up with current regulatory requirements, and it failed to provide anywhere near the level of management visibility needed to fully run an enterprise-level GRC program.
What do you dislike about the product?
I haven't found anything that I would call out as a dislike. The personnel with the company have been excellent and fully willing to response to any suggestions for updates and program maturity; that's rare in a service industry today.
What problems is the product solving and how is that benefiting you?
Virtual integration for GRC is critical and Strike Graph has provided a one-stop shop for up us to provide SSP updates, control definitions and inputs also with integrated AI for policy vetting and applicability.
Consulting
I'd think twice
Reviewed on Jul 28, 2026
Review provided by G2
What do you like best about the product?
For us, not much. We gave up on it once we realized it was basically just a never-ending to-do list organizer—something that, with a little elbow grease, you could put together yourself using publicly available information and the built-in compliance tools offered by major cloud service providers.
What do you dislike about the product?
Poor Customer Service and inflexibility on contract terms.
We are a small business and had paid for the platform for two years. We had not even logged in for over a year and had not been using the service in any meaningful way. When the renewal invoice arrived, we promptly notified Strike Graph that we did not intend to renew. We were only a few days late under the cancellation deadline.
Rather than make a reasonable accommodation for a long-standing customer with no recent platform usage, Strike Graph insisted on payment for the full additional year. After a painfully long and drawn-out process consisting of repeated emails, slow responses, and multiple attempts to resolve the issue directly, we ultimately settled.
I understand that companies have contracts and renewal terms. My issue is how Strike Graph chose to handle this situation: rigidly, slowly, and with little apparent concern for the customer relationship. It felt less like a partnership and more like a company relying on auto-renewal language to extract another year of subscription revenue from a customer that clearly did not intend to renew and was not using the platform.
We ultimately resolved the matter commercially simply to end the distraction, but the experience consumed unnecessary time, created significant frustration, and left a very negative impression.
My recommendation to other small businesses: be extremely careful before signing. Consider other less costly (or no cost) options and if you do sign up, make sure you have the staff and bandwidth to fully use the platform.
We are a small business and had paid for the platform for two years. We had not even logged in for over a year and had not been using the service in any meaningful way. When the renewal invoice arrived, we promptly notified Strike Graph that we did not intend to renew. We were only a few days late under the cancellation deadline.
Rather than make a reasonable accommodation for a long-standing customer with no recent platform usage, Strike Graph insisted on payment for the full additional year. After a painfully long and drawn-out process consisting of repeated emails, slow responses, and multiple attempts to resolve the issue directly, we ultimately settled.
I understand that companies have contracts and renewal terms. My issue is how Strike Graph chose to handle this situation: rigidly, slowly, and with little apparent concern for the customer relationship. It felt less like a partnership and more like a company relying on auto-renewal language to extract another year of subscription revenue from a customer that clearly did not intend to renew and was not using the platform.
We ultimately resolved the matter commercially simply to end the distraction, but the experience consumed unnecessary time, created significant frustration, and left a very negative impression.
My recommendation to other small businesses: be extremely careful before signing. Consider other less costly (or no cost) options and if you do sign up, make sure you have the staff and bandwidth to fully use the platform.
What problems is the product solving and how is that benefiting you?
If we were using it, I suppose it would have helped organize and generate documentation.
Computer & Network Security
Easy-to-Navigate Website with Clear Q&A Sections
Reviewed on Jul 23, 2026
Review provided by G2
What do you like best about the product?
The website is easy to navigate with clearly defined question and answer sections.
What do you dislike about the product?
Nothing to really dislike as the forms are created by the company.
What problems is the product solving and how is that benefiting you?
Strike Graph enabled my company to submit our information for audit purposes. Upon completion, we were able to continue providing our service.
Information Technology and Services
Great for Linking Controls & Compliance Docs, but Needs Project Status Tracking
Reviewed on Jul 21, 2026
Review provided by G2
What do you like best about the product?
Ability to link controls and compliance documentation, as well as incorporate integrations.
What do you dislike about the product?
I have not worked with the tool long enough to provide this feedback. However, it would be helpful to track project performance through status updates, and currently the tool does not provide this.
What problems is the product solving and how is that benefiting you?
We are currently in implementation and I cannot clearly describe what the real benefits are at this time.
Higher Education
Clean, Audit-Ready Compliance Tool with Phenomenal Support
Reviewed on Jul 21, 2026
Review provided by G2
What do you like best about the product?
I like being able to assign controls to the people responsible for them. I also appreciate the built-in risk assessment. Having support for multiple organizations is helpful too, since I can inherit a large corporate policy into my system security plan.
The interface is clean and easy to navigate, they consistently add updates. The support is phenomenal.
They do have AI tools built in to query the documentation easier.
It's been great to use and have available during an audit
The interface is clean and easy to navigate, they consistently add updates. The support is phenomenal.
They do have AI tools built in to query the documentation easier.
It's been great to use and have available during an audit
What do you dislike about the product?
The evidence for controls can be buried through menu options.
What problems is the product solving and how is that benefiting you?
NIST 800-171 Compliance, HIPAA compliance, other regulatory compliance.
Risk Assessments for systems.
Strike Graph definitely makes it easier to handle all the documentation during an audit.
Risk Assessments for systems.
Strike Graph definitely makes it easier to handle all the documentation during an audit.