Purpose. This page is the documented basis for the planned /ai-module product page. Today's competitor research brief surfaced three positioning gaps where Drata, Vanta, and Thoropass leave room — against the $10K–$25K/yr SaaS bands those platforms charge. Each gap below gets a feature angle, a copy angle, and a pricing-positional treatment so the eventual product page has a defensible stance before it ships.
Audience. Rhodigital product, marketing, and engineering — internal stakeholders only. Not customer-facing. Cross-linked from /pricing and /services for traceability, but the page itself stays internal.
Each gap has three blocks: Feature (what the module does), Copy (how the marketing pitch attacks the gap), and Pricing (where the RhodigitalOS figure sits vs. the $10K–$25K/yr competitor band). Anchors #gap-1, #gap-2, #gap-3 deep-link from pricing and services.
SMB-friendly speed vs. premium-seat, premium-month SaaS
Drata, Vanta, and Thoropass price their automation platforms for VC-funded Series A SaaS — pricing tiers indexed on employee count, with premium seats reserved for the GRC lead. SMBs and non-profits in our buyer pool fall several ranges below where those platforms assume their buyer sits, and pay full freight for slow, multi-quarter onboarding.
The AI module generates audit-ready control evidence — policies, mappings, gap reports, and (in the Advisor-Led tier) board-ready recaps — in under 60 seconds from the same eight-question intake that already drives the free readiness assessment.
- Continuous evidence generation against a live NIST CSF 2.0 / SOC 2 / ISO 27001 / CMMC crosswalk, not a quarterly snapshot.
- Re-runnable AI regeneration when regulations shift — HIPAA update, NIST CSF 2.1, NIST AI RMF additions — without re-onboarding.
- Self-serve primary: no premium seat tax. The Advisor-Led upgrade is a paid human layer, not a gated rating.
Attack the affordability gap the same way the NIST Policy Package copy does today: "Audit-ready in 60 seconds, not 60 days." Position downtime-to-first-evidence as the buyer's real cost — what they pay Drata $15K for but don't get in the first quarter because onboarding, evidence collection, and policy review each take weeks.
The line to repeat across the page: "If your GRC platform needs 90 days to produce your first audit pack, your platform is the gap."
The competitor band for SMB+ tier (single framework, automation, advisor-light) is $10K–$15K/yr at Drata / Vanta / Thoropass. RhodigitalOS's AI module sits well below that band by collapsing the implementation into the assessment itself — no consultant bench hours, no per-seat surcharge.
| Tier | Competitor band (annual) | RhodigitalOS AI module |
|---|---|---|
| SMB — single framework, self-serve | $10K–$15K | Below band; first-evidence in 60 seconds, not 60 days |
| SMB — advisor-led on top | $15K–$25K | Mid-to-upper band; quarterly advisor review layered in |
| Mid-market — multi-framework | $25K+ | Stay under band via crosswalk reuse; advisor-led only when needed |
The headline pitch on the eventual /ai-module page: "What competitors charge $15K/year to start, RhodigitalOS does in the first 60 seconds."
Framework breadth — NIST CSF 2.0 + AI RMF + CMMC, not SOC 2 first
Drata and Vanta are SOC 2-first; Thoropass is SOC 2 + HIPAA. All three treat NIST CSF and CMMC as add-on enterprise SKUs at higher price points. Our 2026 buyer pool — non-profits, defense suppliers, regulated SMBs (HIPAA / FERPA / PCI / SEC cyber disclosure) — names NIST CSF 2.0 and CMMC before SOC 2 on intake forms. The platforms aren't aligned to that ordering.
Ship the AI module framework-aware, with NIST CSF 2.0 as the primary spine (which already matches our assessment, continuous monitoring, and policy package today) and SOC 2 / HIPAA / PCI-DSS / CMMC / NIST AI RMF as crosswalks layered over that spine.
- One assessment, one control set, multiple framework outputs through the existing crosswalk mapping table — same pattern as the NIST Policy Package.
- NIST AI RMF (
.cursorrules, governance pipeline, CI/CD policy gates) ships as a peer to NIST CSF — not a feature-of-a-feature. - CMMC Level 1/2 coverage reuses the NIST SP 800-171 mapping we already maintain for the CMMC Module (Advisor-Led) tier.
Position the breadth as "the framework you name first is the framework we lead with." Today's Drata/Vanta pages lead with SOC 2 — when the buyer's questionnaire asks for NIST CSF or NIST AI RMF, that ordering misleads.
The line to repeat across the page: "Your enterprise customers didn't ask for SOC 2 first. They asked for NIST CSF, or AI RMF, or CMMC. Start where they start."
The competitor band for SMB multi-framework coverage (NIST CSF + SOC 2 + ISO 27001, automation only) is $15K–$25K/yr. Thoropass in particular sits at the upper end of this band. RhodigitalOS reuses the same control set across frameworks via the crosswalk — so the second framework's marginal cost is much lower than the competitor baseline.
| Coverage | Competitor band (annual, SMB) | RhodigitalOS AI module |
|---|---|---|
| NIST CSF 2.0 only | $10K–$15K | Below band — single-framework primary spine |
| NIST CSF + 1 added framework (SOC 2 / HIPAA / PCI / CMMC) | $15K–$20K | Under band — second framework is a crosswalk, not a parallel program |
| NIST CSF + AI RMF | $20K–$25K (rare, often enterprise-only) | Confidently below band — AI RMF is a peer spine, not an enterprise add-on |
The headline pitch: "One control set, every framework your questionnaire names. Competitors sell each framework as a separate SKU."
Human-in-the-loop — actual advisor calls, not dashboard-only
Drata, Vanta, and Thoropass are dashboard automation — the human layer is sold as a separate, expensive "expert network" or behind an enterprise SKU. Our buyer pool is partial to that model: at the slice where compliance is a board-level concern (Series B+ SaaS, defense suppliers, healthcare data handlers), the buyer wants a named advisor who briefs leadership, not a tool they have to staff.
The AI module pairs with the existing Advisor-Led Continuous Monitoring tier. The advisor (Brian Rhodes, Founder) reviews the AI-generated evidence pack quarterly, joins a 60-minute call with leadership, and produces a board-ready recap — all shipped as part of the Advisor-Led SKUs we already sell today. The AI module is the engine; Advisor-Led is the deliverable.
- Quarterly advisor call cadence — not a ticketed support queue, not a marketplace of contracted consultants.
- Board-ready recap delivered from the AI summary plus advisor commentary — single artifact, not a stack of dashboards.
- Escalation channel for KEV/incident events tied to the named advisor, not a chatbot.
Attack the dashboard-only frustration: "A dashboard isn't a security program." Position the advisor layer as the deliverable, not an upsell — make it explicit that without an advisor, the buyer is paying for software they then have to staff, which is the same hidden cost Drata and Vanta customers complain about in third-party reviews.
The line to repeat across the page: "Tools collect evidence. Advisors turn evidence into posture. RhodigitalOS ships both — in one engagement."
For SMB+ buyers who want both automation and a named advisor, the competitor band is $18K–$25K/yr (Drata's expert network add-ons or Thoropass's senior-advisor tier). RhodigitalOS Advisor-Led has historically undercut that band because the AI module does the evidence work, and the human-time on the engagement is the deliverable, not a back-and-forth.
| Buyer scope | Competitor band (annual) | RhodigitalOS AI module + Advisor-Led |
|---|---|---|
| Automation + named advisor (single framework) | $18K–$25K | Mid-band — AI does evidence work, advisor is the deliverable |
| Automation + named advisor (multi-framework) | $25K+ | Under upper band — crosswalk reuse amortizes the advisor time |
| Enterprise-style dedicated vCISO | $50K+ (outside SMB band) | Stay out of this band; Fractional CISO SKU for bespoke engagements |
The headline pitch: "Competitors ship you software and a support inbox. We ship you software and a named advisor in the same engagement."
What this spec asks of the eventual /ai-module page
- Three anchors. Section structure mirrors
#gap-1,#gap-2,#gap-3so pricing and services can deep-link to specific gaps. - Three-block pattern per gap. Feature → Copy → Pricing. Same internal rhythm in every section, including on the eventual public page.
- Pricing references only the external $10K–$25K/yr competitor band. No internal RhodigitalOS tier tokens — those go through
site/data/pricing.jsand the pricing-pages route at request time. - Copy angles writable as one-liners. Each gap has a one-liner ready for the marketing page hero section. They're listed at the bottom of each gap.