I like that Vanta is configurable, which is really useful for us because we have several frameworks to adhere to, and each year, new ones are added. Vanta allows us to have the same controls being mapped to different frameworks, so we avoid having to search for the same information several times a year. We just use one control and link it to different frameworks. It's also great that you can create custom frameworks, configure it to match the requirements of different frameworks, and you only have to work on a control once a year. This saves a lot of time and avoids unnecessary duplication of work. Review collected by and hosted on G2.com.

What doesn't work well is the policy alerting when it's about to expire because we can see it's about to expire, but we don't see a test saying it needs to be reviewed within a month. So I need to manually go and check which ones are about to expire, and I asked Vanta support about this. But it was not solved. Review collected by and hosted on G2.com.

I really appreciate how Vanta has automated 90% of our evidence collection across over 35 security frameworks like HIPAA. The platform checks our system configuration on an hourly basis, which gives me peace of mind knowing we won't accidentally fall out of compliance. Implementing this platform has completely changed our auditing process by hooking directly into our cloud infrastructure and automatically pulling evidence in real time. The biggest win for us was Vanta's massive integration ecosystem, which connected out of the box with almost every application and tool we already use. This automation saved us weeks of manual data gathering. The initial deployment was smooth, too. Review collected by and hosted on G2.com.

During deployment, I found that the automated tests triggered a nonstop wave of notifications even for minor issues. Review collected by and hosted on G2.com.

I find Vanta incredibly helpful for our ISO 27001 certification process. It allows us to work in a structured way and keeps everything in one place, ensuring good process organization. The reminders about tasks and updates we need to handle are very useful. My favorite feature is definitely the AI assistant, which acts as a great sounding board and partner to help me understand different tests, requirements, and how to take the correct actions. I also good really good support and help from our CSM Jamie! Review collected by and hosted on G2.com.

I believe the search function for searching across different tests is pretty poor. The search result isn't always very smart, and I think that's an area for improvement. Review collected by and hosted on G2.com.

I really like Vanta because it largely automates the work of keeping our systems compliant with major security frameworks. The digital monitoring and tracking aligns with regulatory guidelines, which makes the overall process feel much more manageable. I also appreciate that Vanta provides an actionable roadmap to help us reach our security standards and compiles a clear security checklist to support meeting regulatory requirements. On top of that, the continuous scanning across our software and backend tools removes the stress of manual evaluation and helps reduce the chances of issues being flagged by external assessors. Review collected by and hosted on G2.com.

I keep getting the same alerts over and over about a compliance check that didn’t actually fail, which is very irritating. The initial setup was also tricky and more complicated than it needed to be, particularly around granting permissions for each individual backend software component. Review collected by and hosted on G2.com.

I appreciate how Vanta runs automatically in the background, scanning critical IT infrastructure and quickly flagging high-risk gaps in our compliance checklist. The tool’s core strength is its passive operation: it continuously monitors connected code repositories, identity providers, and data stores without requiring constant hands-on effort. I also like how it maps our infrastructure directly to frameworks like SOC 2, ISO 27001, and HIPAA, then keeps those compliance mappings updated in real time as our cloud environment changes. It removes a lot of guesswork by showing exactly how our current configurations measure up against regulatory requirements. On top of that, deploying Vanta was smoother than I expected. Review collected by and hosted on G2.com.

I find alert fatigue really frustrating, because so many alerts end up being false alarms or just temporary setups that don’t actually require action. Review collected by and hosted on G2.com.

We specifically like how Vanta is able to be a one-stop shop for our SOC2 compliance and the ability to communicate that with customers through the trust center. It also enables us to be the nerve system for auditing, compliance, and speaking with our compliance partners. Furthermore, it also has really good integrations with our system so that we don't have to do all of the gathering of information ourselves. They also have good templates. We also like that the UI and UX of it are really easy to use, as easy for anyone who's even non-technical to understand what the controls are necessary. We also like how easy it is for us to onboard. We were able to do this self-serve without any additional things, and the performance was really fast. Review collected by and hosted on G2.com.

We dislike how the current monitoring offerings for monitoring controls don't have anything that rich. As a result, we can't use it as an exclusive way of handling MDM. Also, the way to deploy this monitoring is very lightweight, and we wish we could integrate it with something like Apple Business Manager. Review collected by and hosted on G2.com.

What I like most about Vanta is how it brings the entire compliance process into one place and makes it much easier to understand what needs attention. The automated monitoring and integrations save a lot of manual effort, while the clear dashboard makes it easy to track progress, identify gaps, and stay audit-ready. The overall UI is intuitive, and it turns what could otherwise be a complex and time-consuming compliance process into something much more manageable. Review collected by and hosted on G2.com.

Some parts of Vanta can feel a little overwhelming at first, especially when there are many tests, controls, and integrations to manage. It is not always immediately clear why a particular test is failing or what exact action is needed to resolve it. More contextual guidance and clearer explanations for failed checks would make troubleshooting faster and reduce the learning curve. Review collected by and hosted on G2.com.

I like the user interface. I mean, most of these tools are, you know, pretty standard at this point, but I think Vanta has used their interface and how easy it is to use and how you can run the test and just fix them really quickly and assign them to different owners. And most importantly, inviting vendors into the platform is what I like best about it. Review collected by and hosted on G2.com.

Adding personnel is such a nightmare. I feel like I never know which tab to go to. Like, personnel is it personnel? Is it members? And then setting permissions and groups? I feel like that definitely can and should be streamlined. Also, a lot of times, you know, it picks upon workspace accounts that are obviously service accounts. It would be great if it just randomly prompted me rather than to set new accounts rather than failing all the tests. That's one minor thing. Review collected by and hosted on G2.com.

Vanta allows us to check our compliance with international accreditions like NIST 800 and CMMC Level 2 without much hindrance. With its FedRAMP compliance, the auditors can directly access the evidences from Vanta during the audit process. Review collected by and hosted on G2.com.

The policy templates in Vanta are only covering the scope of frameworks we have enabled rather than covering the generic information security requirements. Review collected by and hosted on G2.com.

What I like best about Vanta is how much manual compliance work it eliminates. The automated continuous monitoring runs against our connected integrations, so control drift surfaces on its own instead of requiring someone to go verify things by hand. For a lean security team, that's the difference between staying audit-ready year round and scrambling before every audit.

Beyond the automation, it's become our single platform for the whole GRC program: ISO 27001 controls and evidence, our policy library with review cycles and employee acceptance, vendor risk assessments through the TPRM module, and personnel onboarding and offboarding tasks. Having all of that in one place instead of spreadsheets is a huge time saver.

Performance has been consistently solid. The platform is fast and responsive even with a large volume of tests, policies, and vendor records, and the integration syncs run reliably in the background without needing babysitting.

Onboarding was smooth as well. Connecting our integrations was straightforward, the platform guided us through getting tests and controls stood up quickly, and support has been responsive and knowledgeable whenever we've had questions.

The Trust Center has also been an unexpected win. The knowledge base and answer library behind it directly cut down the time we spend on customer security questionnaires, and integrations like connecting our contract management tooling to the Commitments module keep expanding what flows in automatically. Review collected by and hosted on G2.com.

Very few complaints overall. If I'm being picky: some of the automated tests can be noisy out of the box and need tuning to fit how your environment is actually configured, so expect to invest some time upfront deduplicating or scoping tests to avoid false positives. Certain modules are also still maturing, so occasionally you'll hit a workflow where you want a bit more customization or granularity than the platform currently offers. That said, the product ships improvements at a fast pace, and features I initially found limited have consistently gotten better over time.

Pricing/packaging by module can add up as you expand into TPRM, Trust Center, and other add-ons

Reporting and dashboard customization could be deeper for executive-level views

Some integrations sync only certain data, so there's occasional manual gap-filling Review collected by and hosted on G2.com.