I truly appreciate that Vanta acts as an always-on digital guard, continuously monitoring all the third-party software. It eliminates the administrative nightmare of audit preparation. The platform's background scanner is my primary line of defense, preparing a security checklist with issues that need fixing to comply with laws. What I like most about Vanta is its security alerts, which notify us of breaches in compliance so we can fix them before the auditor arrives. During audit season, I rely heavily on Vanta to automate tasks that used to be tedious and manual; it automatically scans software and points out potential flaws, easing my team's worries. Review collected by and hosted on G2.com.

The false positive alerts are a big headache. The initial setup of Vanta was very hectic as we had to ask for permission from all third party softwares to provide access to Vanta and it's background screening. Review collected by and hosted on G2.com.

I liked how Vanta helped us monitor all of our security and compliance framework needs, allowing us to track in real time how our compliance journey was going. The functionality around Vanta's risk management system and vendor review system was great for keeping our compliance journey on track, and we managed to achieve SOC 2 compliance very quickly. Vanta's integration with other SaaS provider tools is also a big plus since it brings all of our compliance data into one place, helping manage our risk across our entire ecosystem. Having all data come through one tool allows us to see our compliance journey across our ecosystem. I also found the initial setup of Vanta to be very easy, and it took very little time. Review collected by and hosted on G2.com.

I think there are some components within Vanta, for example, the GDPR function that could benefit from greater automation. Vanta already has a lot of data about the systems that we use already included. I think that integration could be improved substantially to help us automate production of our ROPA. Review collected by and hosted on G2.com.

I love that I can just drop our updated IT policies into the portal and it automatically hunts down the staff to digitally sign them. It totally saves me from sending a massive company-wide email and begging people to reply with a messy scanned signature. Review collected by and hosted on G2.com.

Making a tiny typo fix in a policy is a massive pain because uploading a new version forces every single person to re-sign the document from scratch. You basically have to brace yourself for annoyed Slack messages from the sales team asking why they have to sign the same PDF twice in a week. Review collected by and hosted on G2.com.

By using the integrations built into Vanta for the cloud services we use, we kept our cycle times for going from notification to fixed very low. The acceptance AI is handy, as we get immediate feedback on our submissions. Review collected by and hosted on G2.com.

I wish there was more integration between some of the Document tasks and our ticket tracking system, e.g. for pentest remediation it would be nice to tag those cards as "pen test remediation" and have them automatically show up on the Document task. As it is, I need to gather all the URLs and/or screenshots manually. Also, it would be smoother if updated requirements were received regularly throughout the year, instead of what feels like a significant portion of new requirements appearing during the audit period (when we're working on the audit). Review collected by and hosted on G2.com.

The most helpful thing about Vanta is pointing out to me the tasks that need to be done to be SOC 2 compliant. There are integrations with all of the products I use on an every day basis so I never have to go into each product to find out what I am missing. The dashboard on the homepage gives me a good idea of how much I am missing. A lot of controls might be not passing but a single task is responsible for that. It's a bit confusing to understand sometimes. Vanta performs well since I don't need to wait an unreasonably long time to see whether my changes have resolved the issues or not. Support has been good. It was a bit tough to speak to a human though. The AI agent was not able to give me a suitable solution when some of the computer checks were not passing on one particular computer. It was not clear how to reset/fix the Vanta Device Monitor to resolve the issue. I feel like we are getting our money's worth because there is a lot to be SOC 2 compliant and Vanta is making it a lot easier. Review collected by and hosted on G2.com.

It feels like there is a lot going wrong sometimes but maybe it's because the same control appears under multiple requirement categories. Maybe the information can be laid out in a different way to make it bit less overwhelming. Review collected by and hosted on G2.com.

I primarily use Vanta for Assets > Vulnerabilities. I manage updates across multiple repositories, and I keep the Findings by asset page open in a browser tab pretty much all the time. I like that the UI lets me see almost everything I need at once.

If I could add one feature, I’d want the ability to reorganize the columns so I can put SLA Status and Due Date first. Right now I regularly have to scroll the table to the right just to see how much time I have left for each repo.

On performance, I’d appreciate more detail on refresh status. It warns that it might take a couple of hours, but it’s usually much faster (which is great). Still, it would be helpful to have a bit more visibility into where the refresh is at.

For the AWS integration, it would be really helpful if Vanta could pull in the specific area where the offending file is located. For example, when I go into ECR and select a specific finding, there’s an “Affected packages” section with “File paths” on the side. If Vanta surfaced that same data, it would save me a lot of time. Often I’m trying to figure out which dependency is using an offending sub-dependency, or whether the issue is with a default gem in Ruby itself. Review collected by and hosted on G2.com.

Just the scrolling to the right on the table for the vulnerabilities "Findings by asset" page. If I could see the SLA Status and Due Date first, that would be great. Review collected by and hosted on G2.com.

I find Vanta very easy to use, even for those who don't have a background in these types of certifications. It makes it available for everyone to work on the project together, instead of needing a dedicated resource with a background in these certifications. The initial setup was very easy, and we had a lot of support from the customer success team. Review collected by and hosted on G2.com.

I think the only thing that could be improved is some of the connect that we wanted to use weren't available, but Vanta did make it easy for us to put in those as a request. And then there was some specific certifications around the government of Canada that we're not available in Vanta, but we do know we can use the custom frameworks for that. Review collected by and hosted on G2.com.

I appreciate how Vanta helps us get compliant with SOC and ISO and any other compliance needs we have. I like that we get access to people when we have problems, and the platform itself helps us scope out our issues and understand what we need to fix for compliance. Vanta also provides templates and explanations, along with AI features that help us understand controls. Review collected by and hosted on G2.com.

I wish there was a consultancy option for Vanta where we would get even more support in terms of doing the work, rather than just how to get it done or how to get compliant. I feel Vanta should help us more with actually doing the work, providing more support than we currently have, and help us clear and do the work as much as possible supported inside of the organization instead of just listing what needs to be done. Also, I don't feel like Vanta is very project management friendly, especially for tasks and everything. The views and boards just aren't very project friendly, so we use Notion alongside Vanta. The initial setup was a little challenging with a bit of a learning curve because it's not as friendly as we would want it to be, but we eventually got the hang of it. Review collected by and hosted on G2.com.

It is a well organized system, and learning to use it is quite easy. The AI is quite possibly the best I've seen in the market, and the support is great.

The integrations are kind of "it is what it is", new integrations we've requested went ignored, however the one that are there are mostly solid. Oh yeah, and the check list wants me to talk about performance. The performance is fine. The performance is not the issue. Review collected by and hosted on G2.com.

The customisability is limited, as is the visibility in the audit, and this has caused friction with our auditors. Our auditors are one of the big four so this is not like were doing something out of the ordinary.The friction with the auditors is the big minus and the fact that you have to pay more because for customizability on an already pricy product puts it as a "meh" for me. I don't know that it genuinely gave more value than an massive excel that the auditors could have edited in advance. That would saved us missing tests that the auditors deem as basic but weren't ****ing there and we couldn't add in Vanata. Review collected by and hosted on G2.com.

What I like best about Vanta is how much manual work it removes from the compliance process. It continuously monitors your infrastructure and connected systems, so instead of scrambling to gather evidence before an audit, most of it is already collected and up to date. The automated evidence collection and continuous control monitoring save a huge amount of time compared to doing SOC 2 or ISO 27001 prep manually or through spreadsheets. Review collected by and hosted on G2.com.

What I dislike about Vanta is that some integrations can be finicky, occasionally losing connection or requiring re-authentication without much warning, so alerts need periodic checking rather than being fully "set and forget." Pricing can also feel steep as you add more frameworks or entities. And while it covers the common frameworks well, more custom or niche compliance needs sometimes require workarounds outside the platform. Review collected by and hosted on G2.com.