Vanta, Drata, Thoropass, or None of the Above?

As the number of SOC 2 reports has increased, so has the number of SOC 2 Compliance Automation Software Companies. In many ways the rise of SOC automation software companies brought efficiency to an otherwise painful process, but not without some significant drawbacks. Systems like Vanta, Drata, and Laika can be incredibly powerful for larger organizations that have to comply with multiple compliance frameworks. In our opinion, the jury is still out for startups on whether the spend is worthwhile. Companies also need to be aware of these SOC 2 compliance automation software red flags:

Auditor Exclusivity

The goal of SOC 2 is to create a credible report to build trust with your customers and prospects. Unfortunately, some compliance automation software companies are incentivized to partner with cheap audit firms, so they keep more of your compliance budget. You have the right to choose your audit firm – an audit firm that can drop their SOC 2 audit fees to $5,000 using an automation platform was never going to provide much value anyways. Good software does not lead to a good SOC Report, a good SOC auditor does.

Claims to Fully "Automate” Readiness

The point of SOC 2 Readiness is to create a custom set of controls designed to meet SOC 2 requirements efficiently given a company’s size, industry, and IT systems. Software companies are designed for scalability, not customization, leading to unnecessary policies and requirements that waste time.

Biased Information

If you Google “SOC 2”, the top results will be SOC automation companies, like Vanta, Drata, and Laika. This means most companies learn how to be SOC 2 certified from a software company, not from a SOC auditor.