We bought DoControl three months before a customer-mandated security audit that included data governance. The initial scan found years of accumulated mess: client files shared with personal accounts, public links to contracts, ex-employees with live access. We used bulk remediation to clean it and automated workflows to prove it would stay clean. The auditor saw current state plus the remediation log and moved on. That audit closed a contract worth more than ten years of DoControl. Review collected by and hosted on G2.com.

The first dashboard view is a lot to take in. New admins benefit from the onboarding sessions; skip them and you will flail for a week. I also want saved-query sharing between admins, which apparently is on the roadmap. Review collected by and hosted on G2.com.

For context: we’re about 120 employees in the cybersecurity sector, with Google Workspace and Slack as our core stack. Visibility—finally. We ran the free risk assessment, and it came back showing 12,460 public and external assets. I went quiet for a minute, and then I started clicking through the results. Our CEO asked for the exposure number in the first week, and this time I actually had one. Review collected by and hosted on G2.com.

The depth can vary depending on the connector. In the demo, test the specific connectors you rely on before you buy. Review collected by and hosted on G2.com.

The ITDR piece. DoControl flagged a senior account manager who downloaded 2,000+ files over a weekend and shared a folder with a personal Gmail address. HR had not even announced the resignation yet; the system picked up the deviation from that person's normal pattern and from their team's baseline. Alerts go to our Slack channel and forward into our SIEM, so the SOC sees them in the same queue as everything else. For a financial services firm, this is the scenario that keeps a CISO up at night, and it works. Review collected by and hosted on G2.com.

The first month required real tuning.. You need someone who owns alert triage during that window. Review collected by and hosted on G2.com.

Asset inventory that covers users, files, external users, OAuth apps—everything. I was able to get it all within a week, and there were no agents to install. Review collected by and hosted on G2.com.

To be honest, it can be hard to understand the OAuth risk score at times. I know what inputs go into it, but I don’t really understand the process behind it or why similar apps can end up with different risk levels. Review collected by and hosted on G2.com.

I like how DoControl makes it easier to keep track of who has access to our files. Before, checking permissions could take extra time, especially when there were lots of files to go through. Having everything easier to review in one place makes my work simpler. Review collected by and hosted on G2.com.

It took me some time to get familiar with the different options. A few settings could be easier to find, but after using it for a while, I found it easier to work with. Review collected by and hosted on G2.com.

The ability to correct history, instead of just watching it. We cleaned up about 24,300 excess shared assets in Google Workspace with a few clicks, and then set up scheduled workflows so the problem doesn't accumulate again. Every action is logged with a timestamp and the actor who performed it: our auditor really liked this part. What I appreciate most is that the remediation really gets to the 'done'. Other tools highlight the risk and then leave you with a queue to manage. With DoControl, we managed to clear a backlog of about 24,300 files in just one morning. Review collected by and hosted on G2.com.

For us, bulk actions make me cautious every time I use them. An undo option for bulk remediation would make me feel more at ease. Also, in practice, the mobile experience is read-only: it's fine for triage, but not for administrative tasks. Review collected by and hosted on G2.com.

Good engineering, responsive support, real visibility. Honestly, the fit for our mix of tools is incomplete. The asset inventory. Users, files, external collaborators, OAuth apps, all of it collected in one afternoon without a single agent installed. Review collected by and hosted on G2.com.

The product is at its best in Google Workspace, and we live across five other apps. Connector depth past the core did not meet our needs at this price. For us, quarterly business reviews are useful but the metrics deck assumes a bigger team than ours. Review collected by and hosted on G2.com.

What it does, it does well. But for what we needed beyond Microsoft 365, it feels a bit thin. Review collected by and hosted on G2.com.

Strong engine, but both the reporting and the per-user pricing need work before I’d call this a default choice. In our environment, the first month of anomaly detection took real tuning, and we were getting pinged about legitimate bulk projects before it learned our normal rhythms. Review collected by and hosted on G2.com.

The exposure query builder. I can ask ‘show me everything procurement shared externally last quarter’ and get an answer, not a ticket. We found shares from employees who left in 2022. Still live. Review collected by and hosted on G2.com.

The free scan set my expectations high. By comparison, the paid product’s reporting feels less polished than the initial assessment. Salesforce integration works, but it still doesn’t go as deep as the Google Workspace side. Review collected by and hosted on G2.com.

Within 48 hours of connecting Microsoft 365, OneDrive, and Teams, DoControl surfaced exposures we’d been guessing about for years. The guessing is over. Review collected by and hosted on G2.com.

We didn’t really have a clear inventory of who could see what across Microsoft 365, OneDrive, and Teams. It was mostly spreadsheets and hope. Now we can answer access questions in minutes, and board reporting has gotten easier as well. Review collected by and hosted on G2.com.