Resources / Vardion and Start Comply
Vardion and Start Comply compared
Read on 24 October 2026, each fact cited
Both are Greek and both serve companies under NIS2. Start Comply is a hosted platform for the paperwork of NIS2, DORA and ISO 27001, from TicTac, an Athens security firm. Vardion helps you complete the authority's own assessments and puts your scan evidence beside them.
- Start Comply publishes its prices and adds supplier risk as a second module.
- Vardion carries the gap analysis and self-assessment of Greece's National Cybersecurity Authority (ΕΑΚ) in the authority's format, which the Start Comply pages read do not mention.
Start Comply: €4,500 a year per framework and policy package, from €1,500 a year for supplier risk and the external assessment[1]. Vardion: from €290 a month, billed yearly (pricing).
Side by side
| Start Comply | Vardion | |
|---|---|---|
| Greek instruments | NIS2, DORA and ISO 27001 controls and policies; the pages read do not mention KYA 1689/2025, Law 5160/2024, the ΕΑΚ tools or a self-hosted edition[2][3] | The ΕΑΚ gap analysis (169 controls in 24 sections) and self-assessment (234 questions), in the authority's own Greek and its file formats; KYA 1689/2025 article by article, with policy drafts in English and Greek[5][6] |
| Scanning | An external vulnerability assessment of your domain or a vendor's, drawn from credits[1] | Finds what the company exposes to the internet and ranks it by what attackers exploit. Takes in Tenable, Qualys and Defender results by API and Nessus, OpenVAS and Burp files[7][8] |
| Supplier risk | Tiered vendors, questionnaires and domain scanning; DORA register of information support[2][4] | A supplier register with a grade from public records for each supplier, weekly for the critical ones, with questionnaires you send them[11] |
| Incidents | Workflows for the NIS2 24 and 72 hour windows and the DORA timelines[1] | Incidents recorded with the significance assessment, the drafted reports and every reporting deadline[13] |
| Languages | English, Greek, Bulgarian, Romanian, Polish, Czech and German[2] | Console, reports and policy drafts in Greek and English[10] |
| Deployment | Hosted in EU data centres[2] | On Vardion's hosted console for the programme, email and DNS checks and imported results; on your own Linux server with Docker for all of it, scans included[9] |
| Price | Published: €4,500 a year per package, from €1,500 a year for supplier risk; annual credits that do not roll over[1] | From €290 a month, billed yearly |
| Consultancies | Not stated on the pages read | Client workspaces and your own brand for consultancies[14] |
Choose Start Comply if
- You want one Greek vendor for NIS2, DORA and ISO 27001 paperwork, hosted in the EU, with a services firm behind it.
- Supplier questionnaires with tiered vendors are your main need.
- You work in Bulgarian, Romanian, Polish, Czech or German as well as Greek.
Choose Vardion if
- You must answer the ΕΑΚ gap analysis or self-assessment and want it in the authority's own form.
- You want the evidence for your controls to come from scans of what you expose.
- You are a consultancy running several clients, or you want the platform on your own server.
Scored comparison
2: the product's own pages state it. 1: in part, or sold separately. 0: not offered.
| Criterion | Start Comply | Vardion | Sources |
|---|---|---|---|
| Scanning of what you expose | 1 | 2 | [1] [7] |
| Supplier risk management | 2 | 1 | [2] [4] [11] |
| Incident reporting deadlines | 2 | 2 | [1] [13] |
| Interface languages | 2 | 1 | [2] [10] |
| Published price | 2 | 2 | [1] |
Which one to choose
If your NIS2 work is mostly policies and supplier questionnaires, Start Comply covers it and says so plainly.
If you will be asked for the ΕΑΚ assessment, want scan evidence behind your answers or run several clients as a consultancy, Vardion is built for that.
Sources
- Start Comply, Pricing
- Start Comply, Official information about StartComply
- Start Comply, NIS2 compliance
- Start Comply, Third-party risk management
- The ΕΑΚ gap analysis (169 controls in 24 sections) and self-assessment (234 questions), in the authority's own Greek and its file formats
- KYA 1689/2025 article by article, with policy drafts in English and Greek
- Finds what the company exposes to the internet and ranks it by what attackers exploit
- Takes in Tenable, Qualys and Defender results by API and Nessus, OpenVAS and Burp files
- On Vardion's hosted console for the programme, email and DNS checks and imported results; on your own Linux server with Docker for all of it, scans included
- Console, reports and policy drafts in Greek and English
- A supplier register with a grade from public records for each supplier, weekly for the critical ones, with questionnaires you send them
- A scope check that says whether NIS2 applies
- Incidents recorded with the significance assessment, the drafted reports and every reporting deadline
- Client workspaces and your own brand for consultancies
Start Comply and other product names are trademarks of their owners. This page compares public information and is not endorsed by them.
See the ΕΑΚ assessment run in Vardion
A 30-minute demo with sample data: the gap analysis, the scan evidence beside it and the export the authority reads.