What do users say about Vanta?

I like the solution’s flexibility and how everything ties together. I’ve seen both technical and non-technical individuals, with little to no Vanta experience, navigate the software successfully. The wide range of integrations supports the different sizes of companies I work with, and the cost is lower than other vendors in the GRC software space.

Additionally, my customers and I have experienced fewer than a handful of performance issues. The AI and agent included in the solution also help end users self-serve by quickly finding answers or by notifying Vanta when something is more critical. Review collected by and hosted on G2.com.

Vanta is an amazing solution. Like other GRC tools, Vanta acts like a vacuum: it pulls in many different items and marks them as in scope for whatever frameworks an organization is using. That can be really helpful for understanding the full compliance scope. However, it can also be confusing for customers, because when they open the software, they may find there’s more to remediate or sort through than they expected. Review collected by and hosted on G2.com.

Vanta is extremely useful for collecting evidence and mapping controls across frameworks. Working with auditors who are trained on Vanta also speeds up audit timeframes significantly, and it makes communication and evidence follow-ups much easier. Review collected by and hosted on G2.com.

Vanta can make it easy to over-document and end up flooding the system with too much information. For example, I struggle with some of the connectors for asset management because the filtering has (historically, at least) not allowed me to work effectively with our current estate data. The issue is that our data on my company’s end isn’t as clean as Vanta seems to require, which makes those connectors harder to use in practice. Review collected by and hosted on G2.com.

I really like the ease of use and simplicity of Vanta. The system presents very few things on the screen, making it intuitive to understand. Whatever section you're in, it only focuses on that, which takes minimal training for our staff to use. Our entire company can utilize it, including sales staff who need to present documentation, and departments like HR, legal, and marketing. Even our engineers, with their more technical focus, can easily use the same tool with minimal training. It's really effective in helping us show compliance with particular items through simple steps. Review collected by and hosted on G2.com.

The integrations are not as expansive as other tools. Vanta's integration with our HR tool, like Ripple, is very light and can't track a lot of information back and forth. We end up using a lot of canned reports instead of having the integration automatically update. While Vanta works well with our AWS instance and other systems, they have limited integrations available, and the depth of integration is not as deep as with tools like MetrcStream, Archer, or ServiceNow. Review collected by and hosted on G2.com.

Vanta makes compliance feel effortless. The automation features save hours of manual work, and the platform’s clarity helps everyone on the team stay aligned. I especially appreciate how intuitive the dashboard is.... it gives a real-time pulse on our security posture without needing to dig through spreadsheets or audit trails!! Review collected by and hosted on G2.com.

Occasionally, some integrations take a bit of fine-tuning to sync perfectly, and certain alerts could use more context or flexibility. But overall, the product team is clearly responsive, and improvements roll out frequently. Review collected by and hosted on G2.com.

It integrates with multiple tools, automates tracking of any anomalies with respect to the respective controls, provide guidance on how to resolve those anomalies and also share timely notifications to resolve them over email which enables us to remain on top of our compliance requirements. Review collected by and hosted on G2.com.

We have realized that probably auditor view doesn't allow auditors to look at everything we have uploaded as evidences, because, during multiple audits in the past auditors have asked us to share evidences which we had already uploaded on Vanta, but they didn't have access to it. This happens in very few cases, but causes some amount of rework and time delays in audit. Pricing of the tool is also on the higher side. Review collected by and hosted on G2.com.

Getting started with Vanta was honestly super easy, and their customer support team actually helps wherever we get stuck. I love the automated evidence collection feature because it pulls compliance data straight from our cloud vendors, so I never have to beg sales reps for their security documents. Review collected by and hosted on G2.com.

The platform gets a little confused if a smaller maritime supplier is running their databases on super outdated, non-standard servers. I usually end up having to ping the support desk to help me manually clear the error codes just so my main compliance dashboard stops flashing red all week. Review collected by and hosted on G2.com.

I’m happy with the speed of product development and with how quickly Vanta itself is being adapted to the European regulatory landscape. Review collected by and hosted on G2.com.

The product feels quite complex at the moment. When I ask Vanta AI to explain how to use some of the newer features, it can take a while to get a clear, refined answer. I also think the integrations still need to be expanded for a start-up/scale-up tech stack, since it currently seems to support enterprise company stacks first (for example, there isn’t an option to create workflows with Linear). Review collected by and hosted on G2.com.

The ability of Vanta to connect to AWS, GITHUB, your HR system, Google workspace, etc. Trying to find violation manually is just a looser. No one has the concentration to review 100's of AWS settings for compliance, match SW vulnerabilities to code and libraries used. Additionally, even if you get to compliance, things are always changing and systems are growing. The ability to automatically check for issue day in and day out is the only way to handle HIPAA compliance Review collected by and hosted on G2.com.

It took me a while to understand the hierarchy, connections, and navigation. The learning curve is initially steep, but gets easier. It does require consistent use to be good at the tool Review collected by and hosted on G2.com.

The automated inventory tracking and direct integration with our MDM and cloud providers. Instead of maintaining manual spreadsheets, Vanta automatically catalogs newly provisioned laptops and cloud resources in one dashboard. It flags non-compliant devices immediately - such as missing disk encryption, disabled screen locks, or outdated OS versions - which cuts down the time spent chasing down hardware during audits. Review collected by and hosted on G2.com.

Alert fatigue can be an issue early on before fine-tuning the notification filters. Occasionally, an asset or contractor account that is decommissioned in another system takes longer to clear or requires a manual sync to resolve the status. Review collected by and hosted on G2.com.

Honestly the main thing is the integrations. We connected AWS, Bitbucket, Google Workspace, Jira, Confluence, and Slack and it just started collecting evidence automatically. Access reviews, inventory from AWS, policy docs from Confluence - stuff that would've taken us a while to figure out how to document on our own. We got Vanta because we needed SOC 2 and didn't really know where to start, and the onboarding walked us through what controls we actually needed to have in place, which helped a lot early on. The dashboard is clean and easy to scan - I check it most weeks to see if anything's drifted and I don't have to dig around to find what I need. Year and a half in and it does what we need it to. Review collected by and hosted on G2.com.

The Slack notifications are too noisy. We had to tune them down pretty quickly because the channel was getting flooded with stuff that didn't need immediate attention, and at that point people just start ignoring everything. Could use better filtering or some way to set severity thresholds for what actually gets sent. The AI features also feel pretty early. I've poked at them a few times and the output wasn't useful enough to trust without rewriting most of it anyway, so I just stopped using them. Not a dealbreaker since we didn't buy Vanta for AI, but if they're going to put it in the product it should do more than generate vague first drafts. Review collected by and hosted on G2.com.