I think the support that we received from Vanta's team is really good, and they're very responsive with addressing any questions or updates to their software. I've met with the development team personally to help design the next kind of iteration of the Vanta software, and they definitely take their customers' feedback very seriously and try to build a better product. The actual platform is fairly intuitive to understand, and I like the user interface and how it organizes a great amount of information to keep track of open items. The Vanta tool is easy to track and follow, helping with what open items are needed, getting back on track, and tracking due dates—essential for compliance or certifications like SOC 2. Setup was super easy as everything was very well laid out from the onboarding team, with templates and instructions detailed enough to get a small team started in the right direction. Review collected by and hosted on G2.com.

I think there's some strides that they could make in the nesting of certain features. For example, access reviews are a little bit difficult to find since they're pretty far nested underneath different tabs and groupings. The navigation aspects of the site could be better routed. Review collected by and hosted on G2.com.

I really like Vanta's centralized aspect. Everything is captured and tracked in one main location, which means I don't have to go hunting around in multiple places to piece together information related to enterprise risk management or management's risk mitigation plans. This centralized repository allows all updates to be reflected there, and reporting can be had from that one central place. It really helps tremendously, particularly for external audit readiness like for SOC 2, as it provides a clear picture of where we stand with outstanding documents and tests we've passed, so we always know our standing. Review collected by and hosted on G2.com.

There are some manual processes in Vanta that make things cumbersome. Specifically, in the action tracker, the notes section is a manual process where people can overwrite things that are already there. I don't get automatic notifications when someone makes updates, so I have to manually check if updates have been made. It's a bit of a pain. Review collected by and hosted on G2.com.

I use Vanta for SOC 2 compliance and it maintains all the documentation required for SOC 2 audits, like vendor reviews, in a neat and tidy process. I like the risk management features as well. Vanta's ease of use is something I really appreciate, with everything collected in one place, making audits so much simpler and quicker. Having the ability to flag failing tests throughout the year is also a huge help, as it saves us a lot of work correcting issues later. Review collected by and hosted on G2.com.

It can be a little bit hard to find the features. I feel like maybe the top-level naming could be clearer. Some of the drop-downs and things don't have tooltips that would make them a lot easier to navigate. For example, when you're doing a review of a vendor, there's something called a security owner and a business owner. I actually don't know what those mean, so I just kind of guessed. Adding more tooltips with explanations like, 'hey, this is required' or 'why this is required' would be very helpful. Trying to find things in documentation or trying to figure it out with an AI is kind of painful, and I would prefer not to have to do that. Review collected by and hosted on G2.com.

I really like the user interface and user experience of Vanta. It's very intuitive for me, the management team, as well as all our stakeholders, whether they are internal employees or any external firms we work with. It's unified and cohesive, making it seamless for almost anyone to understand. Review collected by and hosted on G2.com.

I think specifically for the vulnerabilities that we had, there's room for improvement. Even though it's not completely a Vanta issue, it has to do with how we're triaging and prioritizing them. Often, we have labels for GitHub vulnerabilities like critical, high, medium, low. But at the end of the day, if we had any missed day, it just showed that we were not compliant. I feel like there could be some sort of variability there so that if someone is approaching the platform, they can see the degrees to the vulnerabilities or outstanding things. Review collected by and hosted on G2.com.

I like that Vanta simplifies and automates our SOC 2 certification efforts every year. They give us access to competent auditors, which is really helpful. I appreciate their robust system and the lots of integrations they offer. It's great that Vanta essentially has their own auditor hub, and they refer auditors to us, saving a lot of time and making everything more streamlined and easier. The platform is especially useful as auditors can go in and see everything that has been uploaded, making things really clear and upfront for us. The initial setup was extremely easy and seamless, which is part of the reason we stay with it. Review collected by and hosted on G2.com.

I think sometimes moving around how they do certain tests, and I used to be able to easily hover over users when deactivating someone and pull up their profile. Now it's a little harder to do that, and there's more menus to go into to deprovision them, which used to be a lot simpler, I feel. Review collected by and hosted on G2.com.

Vanta's continuous monitoring does a lot of the heavy lifting for our ISO 27001 program. The integrations pull evidence automatically, so instead of chasing screenshots before an audit we get a live view of where our controls actually stand. The access and vendor tracking has been especially valuable for us — seeing who has access to what, keeping personnel onboarding and offboarding visible, and having vendor risk in one place has taken real manual effort off our plate. Over time it has become a reliable single source of truth for our compliance posture. Review collected by and hosted on G2.com.

There is a real learning curve at the start. Getting comfortable with how the platform is structured, understanding what each failing test actually means, and knowing how to action it takes time, so it helps to have someone able to invest in that initial setup phase. Review collected by and hosted on G2.com.

I like that Vanta helps us a lot in being SOC 2 compliant. It's also quite helpful as we're working on ISO 27000 certification. Vanta provides a consolidated view of our entire compliance policy, allowing me to monitor anything and everything related to compliance. The timely reminders to update our documents and policies that we might have missed are particularly beneficial. I find the Slack upgrade and the time limit features quite helpful as they give an exact timeline for upgrades. Review collected by and hosted on G2.com.

The search features in Vanta are a bit confusing. Searching for specific policies or compliance issues can be cumbersome, especially if I don't have the links readily available. It's not very user-friendly, and the search functionality doesn't work properly when looking for particular compliance issues or policies. This aspect could be improved a bit. Review collected by and hosted on G2.com.

What I like most about Vanta is how much manual work it removes from our compliance audits. Automated evidence collection and continuous monitoring across our tech stack (AWS, GitHub, Google Workspace, etc.) mean we’re not scrambling to gather screenshots and logs every time an auditor asks for something—it’s already there and kept up to date in real time. The pre-built control mappings for frameworks like SOC 2 and ISO 42001 also saved us a lot of time by clarifying what evidence ties to which requirement. On top of that, the dashboard makes it easy to see at a glance which controls are passing or failing, so we can address issues before they turn into audit findings rather than reacting afterward. Review collected by and hosted on G2.com.

What I dislike about Vanta is that some of the automated checks can be overly rigid or throw false positives, which then forces a manual review just to confirm a control is actually fine. Pricing can also feel steep as you add more integrations or frameworks, and it isn’t always clear or transparent upfront. A few integrations are also shallower than I expected: they’ll flag an issue, but they don’t always provide enough context to resolve it without digging into the underlying system yourself. Customer support has been hit or miss depending on who picks up the ticket, and the UI—while generally clean—can start to feel cluttered once you’re managing multiple frameworks at the same time. Review collected by and hosted on G2.com.

I really like how easy it is to review all documents and controls. The integrations are very useful and give time back to my team. The pricing is very high, though, which makes it hard to sell to smaller customers. That being said, it does the job extremely well. The app itself is always fast and reliable. The automated alerts on controls is very useful. Support is very quick to help Review collected by and hosted on G2.com.

Honestly no real downsides. the automation can get a little aggressive, but better safe than sorry. Review collected by and hosted on G2.com.

It’s very easy to use and intuitive, and it offers a lot of useful features that make it practical and convenient. It has all the integrations we need and the pricing is accesible. Another advantage was that we could create a payment plan, to help our cashflow. The AI features are great when you submit the evidence, as they flag any inadvertence. The onboarding was easy. Highly recommend Review collected by and hosted on G2.com.

Policies to be available in our local language or maybe even the entire interface. It would be very useful because the laws in our country spcify that all official documents should be written in our language (Romanian in my case) Review collected by and hosted on G2.com.