G2

Steven C.

Vice President, Product Engineering

Small-Business (50 or fewer emp.)

8/14/2026

"Zero to Compliant for a startup with one-man ISMS - Cognisys was key to success"

4.5/5

What do you like best about Cognisys?

They give you a structure to follow. The work is split into modules, and after each workshop you get a written list of actions with names against them, so I always knew what the next thing was.

They are sensible about scope and know their stuff. We are fully remote, BYOD, no office, and everything runs on managed PaaS. Rather than asking us to produce evidence for controls we don't have, they helped us take things out of scope with a written reason we can confidently show an auditor.

They manage progress, advise on drafting documents and entering them into Vanta correctly. Risk register, tabletop exercise report, management review pack, non-conformity register with root cause analysis. That is a lot of work we got right the first time, saving untold hours of effort.

The internal audit was a real audit. It picked up things Vanta's automated tests hadn't, and we came out of it with findings and actions, including some non-conformities.

Day to day the engagement runs in a shared Slack channel with a named consultant and a project coordinator. Replies are quick, and when our consultant was on leave they put someone else on it. Review collected by and hosted on G2.com.

What do you dislike about Cognisys?

Nothing to put a finger on. It is a lot to take on for a small team on both sides of the engagement - even so there were weeks I think we could have moved faster. After openly communicating this, the team stepped up the pace respectively. Review collected by and hosted on G2.com.

Recommendations to others considering Cognisys:

Give one or more people clear accountability on your side and carve out the time for them to deliver. It moves at the speed of whoever owns it internally, not at the speed of the consultancy. Use a shared Slack channel rather than email to keep momentum.

Do the recommended preparation before the workshops. That is where you get the value, because the changes you make in the session are what turn a template into something audit-ready.

Be upfront about the things you don't do. They will help you take them out of scope with a written reason instead of expecting you to pretend you run controls you don't. Review collected by and hosted on G2.com.

What problems is Cognisys solving and how is that benefiting you?

Cognisys is consulting for us (Squad AI) on getting compliant with ISO 27001 and SOC 2. There are seven of us, nobody here does compliance for a living, and we had never run an ISMS before. We need both to get through procurement with the customers we are selling to now. They run the readiness programme on top of Vanta: scoping, drafting the policies and the risk register, the workshops, the tabletop exercise, the trust centre, the pen test and our internal audit. It means one of us can own compliance alongside an engineering job instead of us hiring someone for it. Review collected by and hosted on G2.com.

Response from Aston Smith of Cognisys

edit

Thank you so much for this thoughtful review!

We're delighted to hear about Squad AI's path through ISO 27001 and SOC 2 as a small team.

Your feedback on pace is well taken, engagements like this really do move at the speed of whoever owns it internally, and we're glad that openly flagging this led to us stepping up the pace together.

Thank you for trusting us to help Squad AI get audit-ready while staying focused on your product.