# Which vendor security and privacy assessment tools are most trusted by security and compliance teams based on user reviews?

Hi G2 community, trust in vendor security and privacy assessment tools comes down to whether security and compliance teams can rely on the risk data, assessment workflows, and support after implementation. Looking at the G2 Vendor Security and Privacy Assessment Grid Report, five platforms have useful role-specific review evidence, but they earn that confidence in different ways.

UpGuard Vendor Risk (4.5, 740 reviews): GRC and information security reviewers value having questionnaires, evidence requests, vendor communication, and monitoring in one place. They also praise responsive support and faster assessments, although several want more flexible scoring and questionnaire workflows.
Drata (4.7, 1,393 reviews): Security leaders describe better visibility into controls, evidence, audit requests, and ownership throughout the year. Automated collection reduces manual work, but reviewers note that navigation can interrupt audit workflows and unsupported integrations may require follow-up.
Sprinto (4.7, 1,684 reviews): A CISO and a director of cybersecurity and privacy praised its continuous monitoring, evidence collection, and structured approach to SOC 2 and ISO 27001. Longer-term feedback is mixed, with other security reviewers reporting delayed checks, endpoint-agent reliability problems, or weaker support during the second year.
Whistic (4.6, 56 reviews): Information security and enterprise risk reviewers find it easy to share profiles, review vendors, organize evidence, and move an Excel-based program into one platform. Responsive onboarding and support come up positively, though users mention occasional bugs and feature gaps.
OneTrust Privacy Automation (4.3, 154 reviews): Privacy officers, DPOs, and compliance users value its customizable questionnaires, workflows, dashboards, and coverage of changing privacy laws. It fits global privacy programs particularly well, but some users want easier navigation, more granular reporting, and stronger vendor-management functionality.

What strengthened or damaged trust after rollout: scoring accuracy, evidence freshness, workflow flexibility, or support responsiveness? Has your experience stayed consistent after the first audit cycle?

##### Post Metadata - Posted at: 2 days ago - Author title: Marketer - Net upvotes: 1 ## Comments ### Comment 1 Oh for third-party risk and vendor assessments specifically, UpGuard Vendor Risk is the standout, heavily reviewed and highly rated, security teams like its combination of automated vendor risk scoring plus security questionnaires in one place. Bitsight is another trusted name, well-known for continuous, outside-in security ratings of vendors that compliance teams use to monitor risk without waiting on a vendor's self-reported answers. LogicGate and LogicManager are strong if you want vendor assessment tied into a broader GRC program rather than a point tool. To be real, "trusted" here often means the assessment data holds up under audit scrutiny, so I'd confirm each tool's questionnaire library maps to your actual frameworks (SOC 2, ISO 27001, etc.) rather than assuming generic coverage. Are you doing initial vendor onboarding assessments, or ongoing continuous monitoring? Different tools lean toward one or the other. ##### Comment Metadata - Posted at: about 10 hours ago ## Related discussions - [How well does Trello scale into a larger team?](https://www.g2.com/discussions/1-how-well-does-trello-scale-into-a-larger-team) - Posted at: over 13 years ago - Comments: 6 - [Can we please add a new section](https://www.g2.com/discussions/2-can-we-please-add-a-new-section) - Posted at: over 13 years ago - Comments: 0 - [Quantifiable benefits from implementing your CRM](https://www.g2.com/discussions/quantifiable-benefits-from-implementing-your-crm) - Posted at: over 13 years ago - Comments: 4