Phil<p>Good lord, <a href="https://fed.bajsicki.com/tags/Vanta" rel="nofollow noopener" target="_blank">#Vanta</a><span> is so limited in features. <br><br>My self-designed system (using </span><a href="https://fed.bajsicki.com/tags/orgmode" rel="nofollow noopener" target="_blank">#orgmode</a> and <a href="https://fed.bajsicki.com/tags/orgql" rel="nofollow noopener" target="_blank">#orgql</a> and <a href="https://fed.bajsicki.com/tags/orgsuperlink" rel="nofollow noopener" target="_blank">#orgsuperlink</a><span>) can handle inventory, shadow it (via API calls to SSO vendor), risk register, regulations, compliance tracking and a bunch more. And it can work as a database for lookups.<br><br>Granted it's a little bit more demanding (a few keypresses instead of clicking on the website) but it's infinitely expandable and fully integrated across its modules (</span><a href="https://fed.bajsicki.com/tags/orgroam" rel="nofollow noopener" target="_blank">#orgroam</a><span>). <br><br>Vanta, on the other hand, does come with very simplified stuff. For SOC2, I see only 67 pre-defined risk scenarios, which are so vague as to be meaningless. <br><br>What do you mean "personnel misused assets and data is lost?" <br><br>What assets? What data? Lost in what way? <br><br>If I tried to mitigate this risk (properly) I'd spend weeks ensuring </span><i>everything</i><span> is backed up and then testing those backup systems. That's unrealistic.<br><br>But that's the kind of feel-good vagueness one can expect from vendors. They don't sell to </span><i>infosec</i>, they sell to <i>management</i><span>. <br><br>My </span><i>baseline</i><span> at the moment is >200 basic risks that are split per-system, with specific steps for mitigation (and if the same risk occurs in different systems, that's a different risk since the outcomes will be different and need to be handled appropriately.)<br><br>So... why does Vanta exist, exactly? <br><br>Sure it can pull data in near-real time from </span><i>some</i><span> systems (a lot of our systems literally can't hook into it)... but that's a non-issue anyway if you just maintain your inventory a little bit each week. It's not like massive infra changes happen often.<br><br>Given that, the only answer I can think of is to pull wool over their customer's eyes and give them the impression of compliance, the impression of </span><i>less effort</i><span>, while sweeping the real security implications under the rug. <br><br>You don't get security by being vague.<br><br></span><a href="https://fed.bajsicki.com/tags/burnout" rel="nofollow noopener" target="_blank">#burnout</a> <a href="https://fed.bajsicki.com/tags/infosec" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://fed.bajsicki.com/tags/imsotired" rel="nofollow noopener" target="_blank">#imsotired</a> <a href="https://fed.bajsicki.com/tags/compliance" rel="nofollow noopener" target="_blank">#compliance</a> <a href="https://fed.bajsicki.com/tags/grc" rel="nofollow noopener" target="_blank">#grc</a></p>