A visual breakdown of who gets priced out of trust center software — and why the industry's cost structure is a feature, not a bug.
Last week, we mapped the consolidation of the trust center market. Three acquisitions. Three independent options gone. But the acquisitions aren't the whole story.
The bigger question: who can still afford what's left?
The widest layer represents the largest market segment — and the one with the fewest options.
Enterprise pricing isn't arbitrary. It's structural. Every layer of the sales process adds cost that gets passed to the buyer:
No self-serve pricing. A 30-minute discovery call before you see a number.
Pricing varies by company size, modules, and negotiation leverage. Floor: $15K.
Implementation team, kickoff calls, 6-8 week deployment timeline.
Price increases built in. Switching costs accumulate. You're locked in.
Each step assumes you already have what you're trying to get: a security team, a budget line, a procurement process. The gate isn't the price alone — it's the infrastructure required to pay it.
"The irony of enterprise GRC is that the companies who need trust centers most urgently — the ones losing deals to 'send us your security docs' — are precisely the ones who can't afford them."
— Industry observation "Enterprise GRC is designed to keep you enterprise. The pricing, the onboarding, the sales process — it's all built to filter out the companies that need this most." — Anton Lissone & Howard Zev, Co-FoundersWe looked at the B2B SaaS market to understand who's actually served by the current trust center ecosystem:
The average startup spends an estimated $48,000/year in engineering time answering security questionnaires manually. They're already paying the "security tax" — they just can't access the tools that would eliminate it because the tools cost more than the problem they solve at that scale.
This isn't a technology problem. The technology to build affordable, automated trust centers has existed for years. The gap persists because of business model incentives:
"The question isn't whether startups need trust centers. It's whether anyone has the incentive to build one they can afford."
— The market design problemAn accessible trust center would need: self-serve onboarding (no sales team), automated maintenance (no professional services), and a price point that works without procurement approval. The constraint isn't engineering — it's building a company that can survive on SMB economics.
Next in the series: the onboarding problem.
Next: What "going live" should look like →