Some background: we’re roughly 2,500 employees at an insurance company, and most of our data lives in Google Workspace, Slack, and Salesforce. We assumed our sharing hygiene was pretty decent, but DoControl’s initial scan showed otherwise—around 10,000 files were shared outside the company, with some of those shares untouched since 2019. We even found files still being shared by employees who left in 2019, and those links were still live. That was honestly the wow moment. You connect Google Workspace and, about an hour later, you’re looking at every overshared file across the company, sortable by owner, department, and sensitivity. Review collected by and hosted on G2.com.

The first dashboard view is a lot to take in. Honestly, without the onboarding sessions, new admins tend to flail for about a week before they find their footing. In our case, the per-user model also means that every hiring wave pushes the bill up, so it’s something to keep in mind. My one tip is to plan for that during the budget cycle so it doesn’t catch you off guard. Review collected by and hosted on G2.com.

We’re roughly 850 employees in consumer electronics, and most of our data lives in Microsoft 365, Salesforce, and Teams. Within a weekend of connecting Microsoft 365, Salesforce, and Teams, DoControl surfaced exposure we’d been guessing about for years. The guessing is over. The numbers were a lot worse than we assumed. The exposure query builder is the standout: I can ask, “Show me everything Customer Success shared externally last quarter,” and get an answer right away not a ticket. Review collected by and hosted on G2.com.

In our case, it won’t manage SaaS licenses or handle IT lifecycle work. For us, that falls into a different tool category, but people keep asking about it. Review collected by and hosted on G2.com.

Measured outcome: in the last quarter, 52% of our sharing-policy violations were resolved by the employee who caused them, after the Slack bot asked them to confirm or undo the action. My analysts never touched those tickets. The bot also collects business context when someone genuinely needs the share, which gets attached to the event for our records. Security awareness went up as a side effect, because people learn the policy at the moment they break it, not in an annual training video nobody watches. Review collected by and hosted on G2.com.

Bot message templates need more localization options for our non-US offices. And when an employee ignores the bot, escalation logic works but the reporting on those escalations could be clearer. Review collected by and hosted on G2.com.

We ran BetterCloud for IT automation and it did that job fine, but when leadership asked who could see our sensitive files and what random apps were connected to our domain, BetterCloud's answers were shallow. DoControl answers those questions in depth: per-file exposure, per-user behavior, per-app risk scores, plus the context from Okta and our HRIS to tell an accident from a threat. The workflows aim at security outcomes, not admin busywork. Migration of our policies took about three weeks. Review collected by and hosted on G2.com.

It will not manage licenses or offboard a user across 40 apps the way an SMP does, so do not expect that. We kept a lighter tool for lifecycle work. Also, the pricing conversation required executive involvement; this is not a swipe-the-card purchase. Review collected by and hosted on G2.com.

Automated remediation. We can create policies that detect risky sharing or access and automatically remove permissions instead of creating another ticket for someone to investigate manually. Review collected by and hosted on G2.com.

It doesn't have a completely built out misconfigurations module compared to some other more traditional SSPMs on the market. My account manager told me this feature is newer and it was an added part of the product so just be aware of that if that is important to you. Review collected by and hosted on G2.com.

Within a single morning of connecting Google Workspace and Slack, DoControl surfaced exposure we’d been guessing at for years. The guessing is over. It was honestly a real wow moment: you connect Google Workspace, and about an hour later you’re looking at every overshared file in the company, with the ability to sort by owner, department, and sensitivity. Review collected by and hosted on G2.com.

UI updates have now wiped out my saved filters twice. Review collected by and hosted on G2.com.

The push into governing AI tools and non-human identities has been the biggest positive for us recently. We had a ton of employees jumping into Google Workspace AI features and custom gems, and DoControl rolled out discovery and posture controls for that pretty much right away, so we could see if custom prompts or sensitive drive context were being exposed externally without having to block the tools entirely. Also really liking the updates they made to the data scanning engine within workflows. It used to feel a bit too reliant on basic regex triggers which gave us false positives on internal spreadsheets, but the newer contextual inspection handles sensitive data flags much better. The end-user bot notifications in Slack have also gotten smoother—our users can actually confirm or expire their own external shares directly instead of filing a helpdesk ticket with SecOps every single time, which saved us a ton of back-and-forth noise. Review collected by and hosted on G2.com.

The initial policy builder and alert threshold tuning definitely took longer than expected to dial in. When we first turned it on, the volume of alerts for routine sharing was pretty overwhelming, and we had to spend a solid three or four weeks tweaking regex patterns and building out exclusions so we weren't drowning in notifications. The workflow canvas is powerful, but the UI can get a bit clunky and unintuitive when you're trying to chain together multi-step branching logic or complex conditions across different departments. Another thing is the disparity between supported connectors. Their depth for Google Workspace, Slack, and Salesforce is super thorough, but coverage for smaller, niche SaaS tools or more granular misconfiguration checks on secondary apps feels a bit shallow by comparison. Also, while the risk scoring is generally solid, it can occasionally feel like a bit of a black box where it's hard to tell why one specific action triggered a high-severity score over another similar one without digging into the raw event logs. Review collected by and hosted on G2.com.

Speed to value was the big win for us. We connected Google Workspace on a Tuesday, and by Thursday we already had a full inventory, exposure numbers, and our first workflows running. There were no agents, no proxies, and no six-week professional services engagement to get started. We’re a consumer brand with a tiny security team, and the pre-built playbooks cover our main risks: external shares, public links, departing employees, and sketchy OAuth apps. The Slack bot also takes care of the long tail of employee mistakes, which helps the two of us stay focused on the real threats. Review collected by and hosted on G2.com.

The pricing feels geared toward larger companies than ours, and I had to push hard to get the budget approved. Some of the dashboards also seem to assume you have a SOC running in shifts, which we don’t. Still, these are minor gripes considering what we get overall. Review collected by and hosted on G2.com.

The misconfiguration module maps checks to CIS controls and shows impact by app and domain, so my team fixes the worst things first instead of reading a 200-item list. Auditors like the evidence trail. Every remediation is logged with a timestamp and an actor, which ended the annual screenshot scavenger hunt. Guided remediation steps are specific enough that a junior analyst can follow them without Slack-ing an engineer. Review collected by and hosted on G2.com.

Framework coverage is still growing. SOC 2 and CIS are fine; some of the mappings we need for ISO 27001 required manual work. The misconfiguration module is also clearly newer than the data access side, and the check library per app varies. Google Workspace is deep, some others are shallow. Review collected by and hosted on G2.com.

The OAuth app inventory found 340 third-party apps connected to our Google Workspace, and I had personally approved maybe 30 of them. Each app gets a risk score based on its scopes, its usage, and where it comes from. Removing a bad one is one click, and you can bulk-remove or set a workflow that blocks new installs of unapproved categories. We killed a handful of abandoned apps that still had full Drive read access. One had been requesting email scopes since 2021. Review collected by and hosted on G2.com.

The risk scoring is a black box at times. I can see the inputs but not always why two similar apps land on different scores. Smaller niche SaaS connectors are missing, though the big five are covered well. No browser extension telemetry, so a tool used only in the browser without OAuth can slip past it. Review collected by and hosted on G2.com.