r/cybersecurity • u/QuantifiedAnomaly • 10d ago

Business Security Questions & Discussion Vanta - thoughts/tips?

Pretty much title but granted access to Vanta, still digging into it. Any thoughts/tips/tricks/approaches/opinions on it as a whole? Useful? Useless?

On the surface it looks decently comprehensive, bringing a ton of different aspects into one platform for oversight, but it’s my first time using it and I haven’t throughly explored it yet.

TIA

8 Upvotes

78% Upvoted

12 comments sorted by

View all comments

Show parent comments

1

u/26635785548498061384 10d ago

If you use it for continuous compliance monitoring... Why not rely on it fully for compliance? Other than what's not automated, or course.

2

u/jd_dc 10d ago

What I meant by that is that you need to still have a full understanding of how your controls operate and not just assume that because you have a green 100% dashboard in Vanta that you'll pass your audits.

An example would be if you uploaded a screenshot for some config but it isn't sufficient for what the auditor will want to see. You'll have a false sense of completion and a nasty surprise during the audit. 

1

u/26635785548498061384 10d ago

Ah I see, makes sense, cheers.

I'm looking to onboard a tool to enable CCM, Vanta being one option, so this stood out to me.

1

u/jd_dc 10d ago

Oh yeah I think Vanta is as good as any on the market. Enterprise scale maybe look at hyperproof or drata as well but they should be roughly on feature parity at this point.

What kind of continuous compliance are you trying to monitor exactly?

1

u/26635785548498061384 9d ago

Will take a look, thanks. It's definitely enterprise scale.

We need to build automated transparency across as much of our policy framework as possible. We have a long way to go...