Vanta and Drata are genuinely good products. They also cannot design a control, scope an audit, or argue with an auditor, and the gap between those two facts is where most failed certifications live.
Every few weeks we meet a company that bought a compliance automation platform nine months ago, watched the percentage climb into the eighties, and then discovered that the auditor did not care about the percentage.
This is not a criticism of the tools. Automated evidence collection is a real advance, and doing SOC 2 without it now feels like doing accounting on paper. The problem is a category error: the platform measures whether a control is producing evidence. It cannot tell you whether the control was the right one, whether your scope is defensible, or whether the system description matches the system.
What the platform genuinely does
- Collects evidence continuously from systems it can integrate with
- Tracks control status and flags drift
- Gives you a policy template library and a place to store attestations
- Reduces the year-two burden substantially once the program is correct
What it does not do
Scoping is the first and largest one. The platform inherits whatever boundary you give it. We have seen companies bring their entire corporate estate into a SOC 2 scope because nobody made a deliberate decision about the audit boundary, roughly doubling the control surface, the evidence load and the cost, for zero additional customer assurance.
Control design is the second. A template policy says access is reviewed quarterly. Whether your access review is a meaningful check or a rubber stamp on a CSV export is a design question, and it is the question an experienced auditor asks in fieldwork. The dashboard shows green either way.
The third is the system description, the narrative document at the front of a SOC 2 report describing what your service actually does and how it is controlled. It is written by you, judged by the auditor, and read by your customers. No platform generates it, and a weak one undermines an otherwise clean report.
The pattern that works
Use the platform for what it is good at, and put a person in front of it who has been through the audit before. Concretely: decide scope deliberately and write down why; design controls against how your team actually works before configuring them; assign every control a human owner who can explain it out loud; and treat the platform as the evidence pipeline rather than the program.
The companies that sail through year two are the ones where the control set fits the operating reality. The ones that struggle are the ones where the dashboard went green before anyone asked whether the controls made sense.