G2

Michael W.

Founder

Small-Business (50 or fewer emp.)

11/2/2026

"Automated compliance made ISO 27001 & SOC 2 achievable for our small team"

4.5/5

What do you like best about Scrut Automation?

As a small team, we achieved ISO 27001:2022 certification and a SOC 2 Type 2 report in the same year, with Scrut as our single source of truth for controls, policies and evidence. What I like best is how much of the evidence collection is automated: the integrations with Google Workspace, GCP and GitHub, plus the monitors and continuous tests, show gaps early instead of right before the audit. The policy templates gave us a solid starting point. Our customer success manager was a big help throughout, from setting up the SOC 2 engagement to coordinating with the auditor. We also use the Scrut MCP server, which lets us query controls and evidence and upload evidence directly from our AI tooling. The Trust Vault gives us an easy way to share certificates and reports with customers. Review collected by and hosted on G2.com.

What do you dislike about Scrut Automation?

There are a few rough edges. When an automated monitor uploads new files, evidence that was already approved goes back to Draft and has to be approved again, which adds manual clicks every month. Setting up a custom domain for the Trust Vault needs a manual activation by Scrut, and the default portal URL stopped loading until then; a self-service flow would help. With many recurring evidence tasks, the "Needs Attention" workload can pile up quickly, so a better overview of what is due when would be welcome. None of this was a blocker, and support was always responsive. Review collected by and hosted on G2.com.

What problems is Scrut Automation solving and how is that benefiting you?

Scrut solves the problem of running a compliance program with a small team and no dedicated compliance staff. Before, policies, evidence, risks and vendor information would have been spread across documents, spreadsheets and email. Now everything lives in one place and is mapped across ISO 27001, SOC 2 and GDPR, so one piece of evidence often covers several frameworks. Automated monitoring of our cloud, identity and code systems replaces much of the manual screenshot work and shows gaps continuously instead of right before an audit. The concrete benefit: we achieved ISO 27001:2022 certification and an unqualified SOC 2 Type 2 opinion within one year, and the auditors could work directly from the evidence in the platform. For sales, we can now answer security questionnaires faster and share our certificates and reports through the Trust Vault, which helps in enterprise deals. Going forward, the recurring evidence tasks and reminders keep us audit-ready for the surveillance audit and the next SOC 2 period, instead of starting from scratch each year. Review collected by and hosted on G2.com.