Vanta

What do you like best about the product?

Vanta is very simple and intuitive to understand

What do you dislike about the product?

Vendor assessments don't make it easy to see which one is the old one and the new one

What problems is the product solving and how is that benefiting you?

GRC tool that helps us to keep organized

What do you like best about the product?

It speeds up our third-party reviews for us and provides a central platform to track them.

What do you dislike about the product?

Sometimes the Vanta AI comes up with a blank response when we tell it to input "no evidence found" if it comes up with nothing. It's hard to tell if the AI even attempted to search.

What problems is the product solving and how is that benefiting you?

Its cutting down on review time by speeding up how we review the documentation.

What do you like best about the product?

Our development team is constantly testing out new API services and cloud plugins for various builds. Vanta automatically pulls the exact security posture of these third-party platforms in the background, meaning I don't have to pause development just to interrogate a vendor's support desk.

What do you dislike about the product?

The scanner gets a little too aggressive when flagging small, independent software testing tools that don't carry massive enterprise certifications. I usually have to jump in and manually approve these basic sandbox environments just to stop the dashboard from sending angry alerts to my lead engineer.

What problems is the product solving and how is that benefiting you?

Pitching custom software builds to large corporate clients usually means surviving a brutal vendor security interrogation. Dropping a clean Vanta export on their procurement desk proves we don't blindly connect random apps to their databases, which gets the master service agreements signed way faster.

What do you like best about the product?

Integration and automation is the great benefit That said, support is very quick to respond, resolve issues, and clearly explain the available functionalities.

What do you dislike about the product?

Customization with some logic are not possible in several modules.

What problems is the product solving and how is that benefiting you?

Trying to map multiple frameworks that has overlapping controls. Plus manage risk and enterprise level.

What do you like best about the product?

I like how Vanta acts as a central GRC and compliance platform that helps us manage ISO 27001 controls, policies, and risks. It automates workflows, which is a big help in maintaining audit readiness. It solves the issue of managing compliance activities across different teams and tools, bringing everything into one centralized platform. The automated evidence collection, clear ownership tracking, recurring tasks, and framework-to-control mapping are features I appreciate. It was also easy to connect integrations.

What do you dislike about the product?

Change tracking and rollback could be improved. Some workflows require manual configuration, like recurring access reviews, personal tasks, and vulnerability exceptions. Configuring custom controls and obligations involves manual effort.

What problems is the product solving and how is that benefiting you?

I use Vanta to manage compliance by automating workflows and maintaining audit readiness, solving the challenge of coordinating compliance activities across teams and tools.

What do you like best about the product?

I really like the access request feature in Vanta, especially when the team grows beyond 10 people. The integration with Slack is great because it allows everyone to request access anytime, and it's all immediately registered in Vanta. Also, the initial setup was super easy.

What do you dislike about the product?

Maybe the controls could be improved since it's a bit confusing to understand which controls need immediate attention. Adding an extra filter highlighting mandatory controls for upcoming reviews that need urgent attention would be helpful.

What problems is the product solving and how is that benefiting you?

Vanta helps with all our compliance day-to-day operations and tracks access requests via Slack integration, simplifying employee onboarding and access management.

What do you like best about the product?

The automated tests are the biggest win. Once we connected AWS, GitHub and Google Workspace, Vanta continuously checks things like MFA, access reviews and key rotation, and within a couple of months we went from a blank slate to over 95% of automated tests passing. The policy templates let a small team with no dedicated compliance person get almost every SOC 2 policy drafted, reviewed and approved quickly. I also like that the risk register, vendor reviews and evidence requests all live in one place, and that the AI check on uploaded documents tells you right away whether something has gaps before you submit it. The onboarding check-ins with clear readiness criteria ahead of our audit date kept us on track.

What do you dislike about the product?

Mostly small UI rough edges rather than anything fundamental. The tests list view can show a stale status (a test shows 'Needs remediation' in the list while its detail page already says 'Passing'), so you learn to always open the detail page. Filling in the risk register by hand is slow with five dropdowns per scenario; the CSV export/import works well but is not obvious at first and deserves to be surfaced more prominently. Some evidence workflows, like vendor assessment evidence, only accept file uploads, so links have to be pasted into the notes instead. And for a small team the document request list is long, so it takes some digging to figure out which items can wait until the observation window and which ones actually block the audit start date.

What problems is the product solving and how is that benefiting you?

We are a small healthcare AI company that handles PHI as a HIPAA business associate, and our customers expect SOC 2 and HIPAA evidence before they will sign. Before Vanta, 'get compliant' was a vague goal with policies, risks, vendor reviews and evidence scattered across docs and spreadsheets. Now everything lives in one place, the automated tests tell us exactly which items are blocking the audit date, and that turned the whole effort into a concrete task list split between ops and engineering. A two-person ops team got audit-ready for SOC 2 Type II in a few months without hiring a compliance consultant, which is a real cost saving at our stage. Being able to run SOC 2 first and add HIPAA later on the same platform, with the overlapping controls already mapped, means we are not starting over for the second framework. The platform itself has been fast and reliable day to day.

What do you like best about the product?

Ease of use. I have used other compliance platforms and while Vanta has some areas of opportunity, it definitely excels in many areas that I need it.

What do you dislike about the product?

Questionnaire automation needs work. It does not provide good answers.

What problems is the product solving and how is that benefiting you?

Automating compliance. It helps us to avoid gaps in our compliance by streamlining SLA's, important dates, etc.

What do you like best about the product?

I like that it’s an all-in-one GRC tool that centralizes all our compliance efforts in one place, making it easier to manage everything from a single hub while reducing the cost and need for additional tools. I also appreciate the AI agent, which makes the platform even easier to use, and the extensive range of integrations available allowing Vanta to be fed from numerous sources. Support is also quick and efficient.

What do you dislike about the product?

The information in some sections is not as well organized and categorized as it is in other tools. Additionally, performance can be impacted when an integration ingests a large volume of data.

What problems is the product solving and how is that benefiting you?

The consolidation of GRC information and resources in a single place.

What do you like best about the product?

What I like most about Vanta is its detailed security profiles and clear guidance on the measures required to achieve standards such as ISO 27001. This has a major positive impact on companies preparing for certification, as the controls are straightforward, practical, and easy to follow.

What do you dislike about the product?

Vanta often lacks simple options for handling exceptions. Newly discovered vendors require constant review, and the limited flexibility can create false positives for example, users being flagged as improperly offboarded when a valid special case applies. The controls are straightforward, but exception handling still needs improvement.

What problems is the product solving and how is that benefiting you?

The preparation for ISO compliance and overview about security tracking automatisations it offers.