From my perspective, I’ve seen quite a few GRC platforms, and none of them hold a candle to Strike Graph. I came to my current position from NASA’s Jet Propulsion Lab, where we managed over 200 SSPs at one point across virtually every business unit using a home-grown program that was well past its useful life. It wasn’t user-friendly, couldn’t be updated to keep up with current regulatory requirements, and it failed to provide anywhere near the level of management visibility needed to fully run an enterprise-level GRC program. Review collected by and hosted on G2.com.

I haven't found anything that I would call out as a dislike. The personnel with the company have been excellent and fully willing to response to any suggestions for updates and program maturity; that's rare in a service industry today. Review collected by and hosted on G2.com.

For us, not much. We gave up on it once we realized it was basically just a never-ending to-do list organizer—something that, with a little elbow grease, you could put together yourself using publicly available information and the built-in compliance tools offered by major cloud service providers. Review collected by and hosted on G2.com.

Poor Customer Service and inflexibility on contract terms.

We are a small business and had paid for the platform for two years. We had not even logged in for over a year and had not been using the service in any meaningful way. When the renewal invoice arrived, we promptly notified Strike Graph that we did not intend to renew. We were only a few days late under the cancellation deadline.

Rather than make a reasonable accommodation for a long-standing customer with no recent platform usage, Strike Graph insisted on payment for the full additional year. After a painfully long and drawn-out process consisting of repeated emails, slow responses, and multiple attempts to resolve the issue directly, we ultimately settled.

I understand that companies have contracts and renewal terms. My issue is how Strike Graph chose to handle this situation: rigidly, slowly, and with little apparent concern for the customer relationship. It felt less like a partnership and more like a company relying on auto-renewal language to extract another year of subscription revenue from a customer that clearly did not intend to renew and was not using the platform.

We ultimately resolved the matter commercially simply to end the distraction, but the experience consumed unnecessary time, created significant frustration, and left a very negative impression.

My recommendation to other small businesses: be extremely careful before signing. Consider other less costly (or no cost) options and if you do sign up, make sure you have the staff and bandwidth to fully use the platform. Review collected by and hosted on G2.com.

Strike Graph hasn't been just a SaaS platform, we've received incredible service from their team to help us reach compliance across multiple frameworks. Working with Stephanie Lorraine in particular has been a highlight of our experience. Review collected by and hosted on G2.com.

I don't have any negative feedback about Strike Graph so far! Review collected by and hosted on G2.com.

I appreciate the way Strike Graph tracks progress and shows what items need the most attention. This feature helps me see how practical completion is and understand where we stand, especially since there are so many items involved in an audit. The initial setup was good, and I find it valuable for obtaining a SOC II certification. Review collected by and hosted on G2.com.

I find it challenging to better see which outstanding items are applied to multiple controls. It only shows it as outstanding for one control instead of both, which makes it look like there’s more than one evidence needed when it’s really the same evidence for more than one control. Review collected by and hosted on G2.com.

I used to like their tooling before they cut human contact and pushed AI. Review collected by and hosted on G2.com.

It's supposed to solve having a single place to provide evidence to auditors, but it falls short in many ways. They are pushing more and more to take the human out of the process. Our Customer Success rep, our only contact at Strike Graph, was MIA right as our audit was starting, and we were pushed to use AI Chat bots instead of speaking with a human about issues and concerns before, during, and after our audit. They are terrible at communication and have caused delays and issues with our pen tests and audits because of these communication breakdowns that seem intentional. For something compliance-based and mission critical, I should have a single point of contact and shouldn’t be pushed to use an AI bot. If I wanted to go that route, I’d use an LLM, not pay for a service. Stop gaslighting customers that this is a good experience. It's not and misses the actual value SG (Strike Graph) should be providing. Remove the popup chat bot from the tool.. asking me to review your product over and over when I can't even get basic support is very frustrating. It used to be easy before they added all the AI slop to the product and stopped responding to support messages. Review collected by and hosted on G2.com.

I like being able to assign controls to the people responsible for them. I also appreciate the built-in risk assessment. Having support for multiple organizations is helpful too, since I can inherit a large corporate policy into my system security plan.

The interface is clean and easy to navigate, they consistently add updates. The support is phenomenal.

They do have AI tools built in to query the documentation easier.

It's been great to use and have available during an audit Review collected by and hosted on G2.com.

The evidence for controls can be buried through menu options. Review collected by and hosted on G2.com.

The information is provided after viewing/digesting what it's been given. It interprets marvelously. Review collected by and hosted on G2.com.

I wish the numbers matched for submitted questionnaire and you could teach the NLN from the Security Assistant responses. Review collected by and hosted on G2.com.

I have been using Strike Graph for risk management and SOC2 Type1 and Type 2 Compliance for a couple of years, and it has been a great experience. I like the simplicity of the design and how compliance can be done effortlessly. The way document collection works is impressive, and I find it easy to track responsibility and timelines. It also provides a huge number of documents and all kinds of templates for our use. The support is awesome, with our account manager always being responsive and patient. Additionally, the initial setup was super easy, which was a big plus for our team. Review collected by and hosted on G2.com.

There are small things on the document automatic collection. We have it integrated with our SharePoint / OneDrive, but it could be more helpful if the function can be enhanced. I am hoping it can automatically collect all documents under one folder, not just limited to one file. Review collected by and hosted on G2.com.

The platform makes it easy to organize evidence items across a variety of certifications and frameworks. The examples and descriptions for each evidence item are clear, and most items include a link to a help page that explains what kinds of materials will satisfy the requirements for the control(s) that item is linked to. Being able to link a single evidence item to multiple controls also really helps reduce the overall workload.

Their example policies helped us take information that had been stored in a wide variety of places (and in people’s heads) and pare it down into a manageable set of documents that are easy for our employees to find and use.

Caroline did an excellent job helping us get set up in the beginning. She made what felt like a daunting process manageable, and her attitude was consistently bright.

Edit (1/29/26): The folks I’ve worked with over the last couple of years have all been great, and we really appreciate the insight they provide. Access to support is immediate: you can get solid answers from the browser help, and when you email them you receive a response quickly. The flexibility to organize evidence items according to controls that may span multiple frameworks makes things much easier to respond to client requests. The whole crew has made the audit process as easy and painless as they can.

I've been experimenting with the Security Questionnaire AI tool and it is surprisingly good. You still have a bit of work to do to double-check that the answers really do apply to the question, sometimes it will pull in a control that isn't exactly what the client question is about, but it has been able to identify a good number of solid answers to the questions. Review collected by and hosted on G2.com.

Nothing. The tool has been great and I can't say I ran into any trouble using it. Caroline took down some notes here and there about questions I had while entering information in, but none were show-stoppers and I honestly can't even remember most of what they were.

It would be nice to have an integration for Bitbucket through Atlassian since JIRA is available. I was also a bit bummed that the AWS integrations had to go through Cumulus, which we don't have. Review collected by and hosted on G2.com.

Periodic reminders about expiring evidence is very helpful for staying on top of what evidence needs to be refreshed, when, and how often.

Control- and evidence-assignment makes it simple for different users to look up what has been assigned to them, which controls have been fully/partially satisfied.

The web portal makes it easy to access things from multiple locations.

They've recently improved the interactivity of the website, which makes navigation and multi-tab management easier than it was previously. Review collected by and hosted on G2.com.

A lot of the documentation & examples are focused on AWS and particular products/services, which can make things difficult inexperienced users from organizations that use other options.

The difference between evidence owners & control owners can sometimes cause some confusion, since control owners aren't warned about linked evidence that's expiring - that would be a nice option, since control owners are the ones considered responsible for associated evidence, even if a particular evidence item is assigned to someone different. Review collected by and hosted on G2.com.