Sable
The security platform that runs your whole program.
Frameworks, risk, vendors, policies, findings, and SOC, together in one workspace, run the way security actually gets run.
14 days · No credit card
See plans →Program overview · live: Frameworks, risk, vendors, policies, findings, and SOC, together in one workspace, run the way security actually gets run.
One platform. Built for the way security actually gets run.
Frameworks map to controls. Controls map to evidence and policies. Risks link to mitigation tasks. Findings flow into one queue. Update one node and the graph stays current, including your board report.
SOC2_controls_v7_FINAL.xlsx
| Control | Status | Updated |
|---|---|---|
| CC6.1 | MFA · done? | 2025-03 |
| CC6.6 | MFA | 2025-03 |
Access control policy v2.docx
MFA required for admins only · 2024
Auditor · Harper & CoTue 14:02
Please confirm MFA evidence for CC6.1 before Friday
OHOmar Haddadso is MFA 'implemented' or not? the sheet and the policy disagree
Control
Multi-factor authentication
- FrameworksSOC 2 Type II · CC6.1, CC6.6 · ISO 27001:2022 · A.8.5all three clauses covered
- PolicyAccess control policy · v3 · PublishedMFA required for all users · 41/46 acknowledged
- RiskStale admin accounts · residual 62 → 31mitigation complete, control linked
- EvidenceEntra ID MFA policy export.pdf · Q3 access review.pdf2 items · next expiry 1/5/2027
- Audit trailUpdated by Dana Ruiz · 10/07/2026 09:41every linked record current · chain verified
One change. Five records current. Audit ready.
- 01
One workspace for the whole program.
Policies, vendor management, risk register, framework assessments, vulnerability scans, and managed SOC, all in the same tenant. Shared identity, shared audit trail, shared reporting.
- 02
Everything is connected.
Frameworks map to controls. Controls map to evidence and policies. Risks link to mitigation tasks. Findings flow into one queue. Update one node and the graph stays current, including your board report.
- 03
Built for one team or one hundred.
Run your own program in a single tenant, or run programs for every client you protect. Multi-tenant from day one, with isolated client workspaces, role-based access, per-tenant module control, and fleet dashboards.
Six modules. One tenant. One audit trail.
Everything a modern security program needs in one workspace, without bolt-on integrations or duct-taped CSVs.
Vendor management Build your vendor inventory, run real security reviews, and stop being surprised by renewals.
Risk management A real risk register and framework assessments, with controls that link to the evidence behind them.
Vulnerability management Continuous scans across hosts and apps, deduplicated and ranked by real-world risk.
Frameworks & compliance Map controls once to ISO 27001, SOC 2, HIPAA, and GDPR. Evidence once, audit forever.
Managed SOC 24/7 detection and response, triaged by SubRosa analysts, in the same workspace as everything else.
What customers are seeing with Sable.
“We had our compliance and vendor risk spread across spreadsheets and a couple of tools, which mostly held together until someone asked a question we couldn't answer quickly. Sable put all of it in one system, so the evidence and the findings are actually tracked rather than sitting in someone's inbox.”
“Sable is where I go to see where we actually stand. Before we had it I was mostly taking people's word for things, or digging through emails trying to work out whether something had been done. Now the frameworks, the evidence, the vendors, it's all in one place and I can just look.”
Security programs run on Sable across
- AI companies
- SaaS platforms
- Healthcare networks
- Managed service providers
For MSPs & MSSPs
Ten clients or a hundred. One pane of glass.
Multi-tenant from day one. A fleet dashboard that shows health across every client tenant, per-tenant module control, and SubRosa running SOC for the clients who need it, without you staffing 24/7.
- Fleet dashboardHealth across every client tenant: findings, incidents, risk, vendor coverage, overdue tasks.
- Per-tenant module controlPolicies for one client, the full stack plus SOC for another. Configured per tenant.
- Managed SOC integrationSubRosa runs SOC for the tenants who need it. You stay in the loop without staffing 24/7.
- White-label readyYour clients see views designed for them, under your brand.
Talk to MSP salesPublished per-seat pricing · billing adjusts as you add seats
The other options, and what Sable changes.
- Vs. point GRC tools (Vanta, Drata)
You don't have to bolt on vendor management, vulnerability scanning, or SOC.
Sable is one tenant, one bill, one set of users. The whole program lives together, not glued through Zapier and CSVs.
- Vs. building it yourself
A hardened multi-tenant platform, granular access controls, a tamper-evident audit trail, and ready-made framework libraries, already in production.
You don't write the platform; you run your security program on it. The hard parts are already shipped and battle-tested by SubRosa's team.
- Vs. legacy MSP platforms
Modern stack, modern UX. Per-client billing built in.
Your analysts and your clients see views designed for the work they actually do, not a 2014-era console nobody wants to log into.
Integrations
Plays nicely with the tools your team already runs on.
Four feeds carry customer data into the SOC today. Evidence connectors for identity, cloud, code and HR are next; the first, Microsoft Entra ID, is in progress.
Microsoft 365
Sign in, mailbox and endpoint alerts from Entra ID and Defender arrive as detections and cases. Read only.
LiveSelf-serve
SentinelOne
Endpoint threats from your existing SentinelOne estate, triaged alongside everything else rather than in a second console.
LiveSet up by SubRosa
Check Point Email Security
Email threats from Check Point, correlated with the identity and endpoint activity around them.
LiveSet up by SubRosa
Microsoft Entra ID
MFA coverage, conditional access, legacy sign-in and stale-account checks, run on a schedule and attached to the controls they prove. Separate from the Defender alert feed.
In progress
Okta
User inventory, MFA enrolment and deprovisioning history for the access control family. Its app list also shows which vendors your team actually uses.
Coming soon
Amazon Web Services
Account, IAM and logging configuration collected on a schedule and mapped to the controls that ask for it.
Coming soon
GitHub
Branch protection, review requirements and access reviews for the change management controls.
Coming soon
Slack
Post detection alerts and new cases into a channel, so nobody has to be signed in to find out something happened.
Coming soon- Don't see your tool?See every integration →Live, in progress and planned, labelled as such.Tell us what you run →
Pricing
Pick the plan that fits. Upgrade as you grow.
Every plan starts with a 14-day free trial, no credit card, every module except Managed SOC. Annual billing gets two months free.
- Starter
- $400/month
- Solo operator or very small team running the basics. Or $4,000/yr, 2 months free.
- Team
- $700/month
- Small teams formalizing risk and controls into a real program. Or $7,000/yr, 2 months free.
- Growth
- $1,200/month
- Growing security or GRC team that needs the full GRC stack. Or $12,000/yr, 2 months free.
- Scale
- Custom
- Mid-market and enterprise programs with custom needs. Contact sales for pricing.
Start your 14-day trial. No card. No call.
Spin up your workspace and run every module except Managed SOC free for 14 days. Add SOC and the services team whenever you're ready.
Common questions
- What does Sable actually do?
- Sable is a multi-tenant security platform with six connected modules: Policies, Vendor Management, Risk Management (including framework assessments for ISO 27001:2022 and GDPR), Vulnerability Management, Managed SOC, and Security Services. Everything runs in one tenant with shared identity, role-based access control, a tamper-evident audit log, and per-tenant module control. Built for security teams running their own program and MSPs running programs for many clients.
- Do I need a credit card to start the trial?
- No. The 14-day trial requires no credit card and no demo call. Create an account and start using the platform immediately.
- What's actually included in the trial?
- Every module except Managed SOC: Policies, Vendor Management, Risk Management, and Vulnerability Management. Managed SOC requires EDR coverage and is provisioned by SubRosa after a setup call.
- What happens at day 15 if I don't subscribe?
- Your trial of the modules ends, but you keep dashboard and account access until you decide. Your data stays put. Pick a plan whenever you're ready to keep working in the modules.
- Can I cancel anytime?
- Yes. Cancel from your billing settings at any time. You'll keep access through the end of your billing period. No retention calls, no friction.
- How does annual billing work?
- Annual plans get two months free: you pay for 10 months and get 12. Starter is $4,000/yr, Team is $7,000/yr, and Growth is $12,000/yr on annual billing.
- Can I upgrade or downgrade mid-cycle?
- Yes. Plan changes are prorated automatically. Upgrades take effect immediately; downgrades take effect at the next billing period.
- Is my data exportable if I leave?
- Yes. You can export your policies, vendor inventory, risk register, and findings to standard formats from inside the app. Your data is yours.
- How does MSP billing work?
- MSP pricing is published, not quoted. It is a $299/month platform fee plus $9/month for every user seat, on your team or any client's, and the $299 fee is waived once your account reaches 50 seats. Add or remove seats in the app and billing adjusts automatically.
- Does Sable replace my current GRC tool?
- For most teams using Vanta, Drata, or a spreadsheet-and-Notion setup, yes. Sable covers policies, vendor management, risk register, framework-based assessments, and vulnerability scanning in one tenant. The difference: you also get Managed SOC and Security Services tied to the same workspace, without bolting on a second platform.