Vanta covers compliance, TPRM, access reviews, trust centre, and risk management in one platform. As a small InfoSec function, not having to stitch together multiple tools is a genuine force multiplier Review collected by and hosted on G2.com.

Some of the newer AI and automation features feel like they're still maturing - useful in principle, but not yet reliable enough to lean on for high-stakes decisions. Review collected by and hosted on G2.com.

I use Vanta for automating security compliance and to monitor our cloud structure. It easily integrates with systems like AWS, Google Workspace, GitHub, and endpoint management tools to collect audit evidence, monitor security controls, and identify compliance gaps wherever necessary, and it simplifies audit preparation for frameworks such as SOC 2 and ISO 27001. The feature I like the most is the automation it provides. Instead of manually collecting evidence and checking security controls, Vanta continuously performs these tasks in the background, which significantly reduces audit preparation time. It gives me a centralized, real-time view of compliance status, failed security checks, and remediation tasks across all integrated systems. During a SOC 2 audit, Vanta automatically collected evidence from AWS and other similar platforms throughout the year, so instead of spending several weeks gathering screenshots and access logs manually, everything was already organized in one dashboard. We completed auditor requests within days and reduced audit preparation time by nearly half while improving accuracy and transparency. It automatically checks controls such as MFA enforcement, device encryption, employee onboarding, user access reviews, and cloud security configuration through integrated systems. Failed checks generate alerts and remediation tasks for the appropriate teams, and this continuous automation keeps compliance up to date and ensures we are always audit ready throughout the year. I like the continuous evidence collection, which ensures evidence is always current, significantly reduces repetitive administrative work, and minimizes human error. IT security has benefited the most, since it reduces their manual workload now that it's automated and reduces human errors. There is a 60-70% reduction in audit time, we reduced compliance-related manual tasks, responded to auditors faster, and identified security gaps much earlier through continuous monitoring. It collaborates well between teams, hands off the work smoothly, and the remediation of tasks is well organized with easy transitions. The initial setup was moderately easy for us. Review collected by and hosted on G2.com.

Even though it's highly effective, I find the customization and reporting capabilities somewhat limited for organizations with unique compliance requirements. Some integrations require additional manual configuration. And for complex environments, I need extra tools to get complete visibility and meet specialized security or regulatory needs. Review collected by and hosted on G2.com.

What I like best about Vanta is how it brings security compliance into one organized, easy-to-manage platform. The dashboard is clean and intuitive, making it simple to see which security controls are complete and which ones still require attention. Instead of tracking evidence manually, the automated integrations collect information from many of the tools our team already uses, which saves a significant amount of time and reduces repetitive work.

I also appreciate the continuous monitoring features because they help identify potential issues early instead of waiting until an audit. That gives our team more confidence that we're staying compliant throughout the year rather than scrambling before review time. The onboarding experience was straightforward, and the documentation made it easy to understand what each control required.

One benefit I didn't expect was how much easier collaboration became. Since evidence, tasks, and compliance progress are all centralized, everyone has visibility into what needs to be done without relying on long email threads or spreadsheets. Overall, Vanta has made the compliance process more efficient, transparent, and much less stressful. Review collected by and hosted on G2.com.

One area where Vanta could improve is making some of the compliance requirements more beginner-friendly. While the platform automates a lot of evidence collection, there are still controls that require manual interpretation, and it isn't always immediately clear what specific documentation is expected. More in-app examples or guided recommendations would help newer users complete these tasks with greater confidence.

As our organization connected more integrations, the amount of information in the dashboard increased significantly. Although it's comprehensive, it can sometimes feel overwhelming when trying to prioritize what needs immediate attention. Additional filtering, customizable views, or AI-powered prioritization could make the experience even more efficient.

Overall, these are usability improvements rather than major issues. The platform performs well and is reliable, but adding more contextual guidance and making navigation easier for first-time users would make an already strong product even better. Review collected by and hosted on G2.com.

It gives structure when going for certifications (ie ISO 27001, SOC2, GDPR) in complex business environments.

When setup properly, it gives a good view of progress towards framework compliance.

Questionnaire automation looks promising to safe time filling those out. Review collected by and hosted on G2.com.

The pre-made frameworks have a lot of overlapping similar tests & controls. It would make the process of collecting evidence more streamlined if these were combined better.

The automated tests look promising but in practice the auditors have still been requesting documented evidence that should have been covered by these automated tests.

Features that seem to me should be part of the basic package, such as filtering on a product for automated questionnaire answering, are charged as additional packages. Review collected by and hosted on G2.com.

I use Vanta as a compliance toolset for ISO 27001 and appreciate how it consolidates all tests, SLAs, and necessary proof for our audits in one place—not just for the yearly audit cycle, but also as a great daily tool for operations and traction. I like that Vanta makes vendor risk management very easy by analyzing all documents like SOC and ISO reports, and provides a well-thought-out questionnaire feature that we can send to vendors. The AI that automatically fills in forms and helps identify risks and findings early is incredibly helpful. It's also fantastic for auto-populating answers from major companies like AWS and Google using their own trust pages and reports. Additionally, the initial setup of Vanta was straightforward. Review collected by and hosted on G2.com.

A lot of policy templates are not well suited for Sweden. For example, the Code of Conduct includes unnecessary points like not bringing firearms into the office, which is not relevant to Swedish laws. There are also some policy templates that conflict with each other, and it's hard to find where and when. We used AI outside of Vanta to identify a lot of errors like that. Review collected by and hosted on G2.com.

Vanta is a fantastic tool for keeping track of all the processes that require our attention, it greatly facilitates assistance, saves us time, and helps keep the controls OK. Review collected by and hosted on G2.com.

If I had to add something to Vanta to improve it, it would be the communication between organizations, and secondly, make Vanta as a monitoring application a bit more stable in terms of failures or errors in device synchronization. Review collected by and hosted on G2.com.

I find Vanta to be a complete solution for GRC related frameworks, which is really helpful. One of the aspects I like most about Vanta is the policy builder. It saves a lot of time for any organization that needs to establish compliance from scratch. It is particularly useful in writing and creating policies specific to the framework and organization. The time saving is huge. Additionally, the support team was really quick in resolving initial teething issues with tool integrations. Review collected by and hosted on G2.com.

Vanta has lots of automations and AI, which is good for big organizations; however, startups find it time-consuming and expensive. Entry-level pricing could be reduced while blocking the complex automations for smaller startups. Review collected by and hosted on G2.com.

Vanta is really easy to use and integrates well with the tools we already have. The best part is that we don't need to go back and forth with auditors using giant spreadsheets anymore. Everything is in one place. Uploading evidence is simple and saves us a lot of time during audits.

Performance has been solid for us. Our workload isn't huge so we haven't really pushed it to the limits, but we have no complaints there. Support and onboarding were great too, the app is pretty intuitive so we didn't need much hand-holding to get started.

On pricing, it's a bit on the higher side, especially if you're a startup going through your first audit. That said, the ROI is definitely there once you see how much time and effort it saves you. Review collected by and hosted on G2.com.

Some user flows are hidden deep inside specific pages and not easy to find from the main menu. I get that they want to keep the menu clean, but it takes too many clicks to go from a failing test all the way to, say, removing a computer from an employee that left the company. And if you go directly to the computers page, it's not obvious that there's an unassigned computer sitting there. A bit more visibility on those things would help a lot. Review collected by and hosted on G2.com.

I like that I can do my internal audit in it basically daily. It's always monitoring and it's so easy to know when things are off. Review collected by and hosted on G2.com.

Right now their AI agent takes forever to load anything, remediations, questions, etc. Their AI features are extremely slow that you click out of Vanta and forget about it for an hour. Review collected by and hosted on G2.com.

Old API tokens used to sit forgotten in our AWS console for months until someone casually remembered to clean them up. Now the dashboard automatically catches any developer credentials that haven't been used in ninety days and calls them out immediately. Review collected by and hosted on G2.com.

Service accounts create a massive amount of noise here because our automated scrapers and CI/CD pipelines rely on permanent background keys by design. I waste way too much time writing up custom exclusion rules just to stop the scanner from flagging our legitimate build bots. Review collected by and hosted on G2.com.