GRC Automation Security Tools

Vanta was first to market and heavily relied on automating endpoint evidence. They have since rapidly expanded and deserve to be considered right next to Drata as a leader in the space.

Drata had the advantage of starting after Vanta, and they quickly built a greater depth of automation. They were less focused on their endpoint solution, and more focused on powerful evidence automation. That said, these tools have struggled providing the depth needed for enterprise risk teams.

Zania is a really cool product. They ingest audit reports of various types and format them into controls with suggested feedback, confidence, and direct attestation of where the evidence came from. An extremely helpful tool, especially for third party risk assessments.

Acquired by Drata. Safebase is a simple way to host a public security page with your compliance information and NDA document request workflows.

LogicGate is heavily focused on risk assessment and risk management alone, and greatly lacks the automation capabilities of other platforms

Conveyor is a platform for managing vendor questionnaires and trust center workflows

SecureFrame is a great third choice to Vanta and Drata, but lacks the same depth and breadth of features.

Originally ZenGRC, they were the largest traditional GRC provider to build cloud evidence automation. They're the most automated of the traditional GRC providers, but still lack the depth of Vanta and Drata for getting everything automated.

Akitra has built an automation platform focused on in depth automation creation. They've done the hard work of building various cloud reports that can be attached to various frameworks, creating a more realistic automation approach for enterprises.

Control Tower can be used to try and enforce compliant resource creation across your organization, but is less effective as this is becoming accomplished through policy as code instead.