Scrut Automation

What do you like best about the product?

Scrut helps keep our compliance work organised by bringing policies, evidence, risks and vendor assessments into one place. I’ve found it particularly useful for reviewing vendor documentation, recording assessments and tracking outstanding actions. Having that information together makes it easier to see what still needs attention and follow up throughout the year.

The support team has also been helpful and responsive. When we recently encountered an issue with automated document collection, they investigated, resolved the problem and followed up with a clear explanation.

What do you dislike about the product?

There isn’t anything in particular that I dislike about Scrut. Scrut helps make compliance work a lot more organised and manageable.

What problems is the product solving and how is that benefiting you?

Scrut helps us stay on top of ongoing compliance work alongside running the business. Having evidence, policies, vendor assessments and risks in one place makes it easier to keep documentation current, identify outstanding tasks and follow up with the right people.

For me, the main benefit is a clearer view of what needs attention throughout the year, which makes the work more manageable and helps us stay prepared for audits and customer security questions.

What do you like best about the product?

The Scrut GRC platform helps streamline compliance activities by providing a centralised platform to manage tasks, policies, evidence and compliance requirements.

1. Task assignment and ownership: Tasks can be assigned to individual team members across departments, with clear ownership of the activities they need to complete. This helps ensure that responsibilities are distributed across teams rather than leaving all compliance activities to the IT or Security team. It also helps track pending activities and follow up with the respective owners.

2. Automated draft policy generation: The platform can generate draft policies by providing basic organisational information, such as the company name. This helps teams get started with policy documentation without having to write every document from scratch.

3. Policy customisation and review: The generated policies should be reviewed and customised based on the organisation's actual business operations, technology environment, security controls and compliance requirements. They should not be adopted as-is simply because they have been generated by the platform.

4. Centralised compliance management: The platform helps bring compliance tasks and policy documentation into one place, making it easier to monitor progress, identify pending activities and coordinate with different teams.

5. Improved accountability: By assigning tasks to specific team members, the organisation can establish clear responsibility for completing compliance activities and providing the required evidence.

Overall, Scrut GRC can reduce the manual effort involved in compliance management, accelerate initial policy drafting and improve coordination across departments. However, the quality of the final policies and the effectiveness of the compliance programme still depend on proper review, validation and ownership by the respective teams.

What do you dislike about the product?

### My Experience with Scrut GRC, SOC 2 and ISO 27001

My experience with Scrut and its implementation support has been disappointing. The primary issues were lack of clarity, lack of project management, no clear ownership of deliverables and very limited practical assistance throughout the engagement.

**1. Lack of clarity and ownership**

There was no clear ownership of the deliverables or a structured plan to drive the engagement to completion. When we signed up, the sales representative indicated that the team would support us throughout the process. However, the actual experience was very different. There was no clear accountability for ensuring that the required activities were completed on time.

**2. No proper project management**

There was no effective project management or tracking of progress. Although weekly calls were scheduled, there was no clear agenda, no structured review of pending activities and no proper tracking of deliverables. The Scrut team did not proactively identify what needed to be discussed or what actions were required from each team.

Even when team members were on leave, meetings were not cancelled or properly managed. The calls did not provide the visibility or direction needed to move the engagement forward.

**3. No practical assistance with evidence preparation**

One of the biggest gaps was the lack of practical guidance on how to prepare and submit evidence for SOC 2 and ISO 27001. Compliance is not just about assigning tasks through a GRC platform. Teams need to understand what evidence is required, how it should be prepared, what it needs to demonstrate and how it maps to the relevant control requirements.

Despite repeated follow-ups and escalations, we did not receive the level of assistance that had been promised. Multiple escalations did not resolve the underlying issues.

**4. Lack of understanding of SOC 2 and ISO 27001**

The people supporting the engagement did not appear to have a sufficient understanding of what SOC 2 and ISO 27001 actually involve. These are not simply documentation exercises where policies are generated, tasks are marked complete and certificates or reports are issued.

They require an understanding of the organisation's actual environment, implementation of appropriate controls, collection and validation of evidence, and assessment against the applicable requirements.

**5. No clarity on auditor selection or changes**

We also faced a lack of clarity regarding the auditor arrangements. We could not change the auditor for either ISO 27001 or SOC 2, which raised concerns about the flexibility available to us and the clarity of the engagement from the beginning.

**6. Concerns about the quality of the SOC 2 report**

The quality and accuracy of the SOC 2 report were particularly concerning. The report referred to controls and infrastructure, including a WAF and DMZ, that we did not have in our environment. There were also multiple inconsistencies that I identified during my review.

What concerned me further was that these issues were neither adequately corrected nor proactively questioned during the process. As someone responsible for security and compliance, I expected the report to accurately reflect the actual environment and the controls that had been implemented and assessed.

A SOC 2 report must be based on the organisation's actual system description, relevant controls and audit evidence. Incorrectly describing infrastructure that does not exist raises serious questions about the quality of the review and the reliability of the report.

**7. Concerns about the ISO 27001 and SOC 2 outcomes**

I was also surprised by the lack of observations reported across the ISO 27001 and SOC 2 engagements, particularly given the inconsistencies and gaps I identified myself.

I would have expected a rigorous assessment, clear identification of gaps, appropriate corrective actions and transparent reporting of the results. Instead, the overall experience left me questioning how thoroughly the actual environment and evidence had been assessed.

**My overall assessment**

The fundamental issue is that the engagement felt more like a process of paying for and obtaining a certification or report than a properly managed exercise to assess and improve the organisation's security and compliance posture.

A GRC platform can help automate workflows, assign tasks and generate draft policies. However, the platform itself cannot replace competent compliance guidance, effective project management, proper evidence validation or a rigorous independent audit.

When there is no clear ownership, no meaningful progress tracking, inadequate support and a report containing descriptions of controls that do not exist, it undermines confidence in the entire process.

My expectation was not simply to obtain a certificate or report. It was to ensure that the organisation's security controls were properly assessed, the documentation accurately reflected reality, and the resulting certification or report could withstand scrutiny from customers, partners and auditors.

Based on my experience, Scrut needs to significantly improve its engagement management, practical support, technical understanding and quality assurance if it wants to deliver that outcome consistently.

What problems is the product solving and how is that benefiting you?

### Scrut Automation: Poor Product Support and Ineffective Automation

My experience with Scrut Automation was disappointing. We encountered several issues with the platform and raised them with the product team. However, instead of taking the time to understand the problems, getting on a call with us and working towards a resolution, the focus often seemed to be on closing the support tickets.

A support ticket should not be considered resolved simply because it has been closed in the system. The underlying issue needs to be understood and fixed, and the customer should be able to confirm that the solution works.

We expected the product team to engage with us, understand the issues we were facing in real-world compliance activities and help resolve them. Instead, we repeatedly had to follow up on issues without getting the practical resolution we needed.

The automation itself also did not deliver the value we expected. The purpose of a GRC automation platform is to reduce manual effort, simplify compliance activities, improve evidence collection and provide visibility into progress. When the platform has recurring issues and the support team does not resolve them effectively, the intended benefits are lost.

**Overall, the automation was of little practical use to us, and the product support experience did not give us confidence in the platform.** There is a significant difference between closing tickets to meet internal metrics and actually solving customer problems. In our experience, the emphasis appeared to be on the former rather than the latter.

What do you like best about the product?

the people in the weekly reviews are very helpful

What do you dislike about the product?

standard templates are not the best possible. need some legal rework

What problems is the product solving and how is that benefiting you?

giving 1 platform for most ISO related certificates

What do you like best about the product?

Scrut gives us a single source of truth for SOC 2 and ISO 27001. Cross-framework control mapping means we collect evidence once and reuse it, the assignment and approval workflow keeps a small team accountable without endless follow-ups, and having risks, policies and vendor assessments in one place made our audit cycle far more organised. For a lean SaaS company, it’s made continuous compliance genuinely achievable.

What do you dislike about the product?

There’s genuinely nothing I dislike about Scrut. It has met all of our compliance needs, and any questions we’ve had have been resolved quickly.

What problems is the product solving and how is that benefiting you?

Scrut solves the challenge of managing SOC 2 and ISO 27001 compliance with a lean team. Controls, evidence, policies, risks and vendor assessments all sit in one platform, with cross-framework mapping so we collect evidence once and reuse it. The benefit for us is far less duplicated effort, clear accountability through assigned tasks and approvals, and a much more organised audit cycle. Compliance has become an ongoing, manageable process rather than a last-minute scramble.

What do you like best about the product?

What I like most about Scrut Automation is that it brings our entire compliance lifecycle into one platform. From policy creation and automated evidence collection to AI-powered reviews, gap analysis, and employee training, it has everything we need to manage compliance efficiently. The UI is intuitive and easy to use. Customer support is quick and resolves technical issues within a day.

What do you dislike about the product?

The AI-powered gap analysis of evidence is very extensive, and while the suggestions can sometimes be irrelevant, the overall analysis is still thorough and exhaustive.

What problems is the product solving and how is that benefiting you?

We’re a startup working with a lean team, and we needed to stay compliant across four frameworks. Scrut Platform made that possible and helped us get there without overcomplicating the process. The dashboard keeps us on top of things suggesting when fresh evidences are needed or policies require reviews.