Scrut Automation

What do you like best about the product?

What I value most is that Scrut keeps compliance running year-round, rather than in frantic bursts right before an audit. Once we connected our cloud and SaaS integrations, the automated tests began flagging misconfigurations as they occurred. We triage each failed test against the controls it impacts and then either remediate it or mark it as ignored with a recorded business justification. When the auditor reviews our work, that justification is already attached right next to the test, so we’re not stuck trying to recreate the reasoning later.

The MCP connector has also been an unexpected win. From our AI assistant, I can look up policies, evidence, and failed tests; upload evidence directly into the correct evidence task; and pull control context into client security questionnaires without constantly switching tabs. During our GDPR audit prep, we handled the gap assessment against the framework and a sweep for pending evidence mostly this way, and it took days off the overall effort. Uploading evidence is close to effortless now: files from our cloud accounts, policy PDFs, and screenshots shared by colleagues can go straight into the relevant evidence task.

Audit findings, the risk register, and CAPAs (corrective and preventive actions) all live in the same place as the controls. That setup makes it easy to trace a finding back to the controls it affects and then close it out with supporting evidence. Vendor risk assessments with Scrut Teammates have also given us a quick first pass on new vendors.

What do you dislike about the product?

Most of my frustration is with the MCP connector, which is the part of Scrut we rely on most. It reads data well, but it can barely write. Creating risks, logging CAPAs, updating audit findings, completing vendor assessments, and even ignoring tests still have to be done in the web app. That breaks AI-assisted workflows halfway through, and we end up falling back to browser automation, which is slow and brittle. If the connector supported write access for these objects, it would be far more useful.

The second issue is performance on bulk queries. When listing controls, tests, or evidence—and sometimes even when fetching a single long policy—the connector returns far more data than an AI client can handle in one go. Pagination, field selection, and summary views would address this. Document search through the connector also consistently fails to return vault documents. On top of that, the question-answering tool rarely finds an answer even when the information exists, seemingly because it only looks at one document at a time instead of searching across our whole library.

In the web app, closing an audit finding after it’s fixed takes more manual steps than it should. It would help if closure could be auto-suggested when the linked evidence is updated. The answer library also starts empty, and an easier way to seed it from questionnaires we’ve already completed would make the questionnaire features pay off sooner.

What problems is the product solving and how is that benefiting you?

We run several frameworks at once—SOC 2, ISO 27001, and GDPR. Before Scrut, evidence was scattered across shared drives and spreadsheets, control ownership was tracked manually, and every audit turned into weeks of chasing people and rebuilding context. Client security questionnaires were just as painful, with answers reassembled from fragmented documents each time.

Scrut gives us a single place where controls, policies, evidence, risks, and audit findings are connected across all frameworks. When we map a control once, it carries over to every framework it applies to, so we’re no longer duplicating the same work for each audit. Automated cloud tests have replaced periodic manual configuration reviews, which means drift shows up within days instead of only surfacing at audit time. Policy acceptance is tracked per employee as well, so we can see who still hasn’t acknowledged and follow up without relying on spreadsheets.

The biggest recent improvement has been connecting Scrut to our AI assistant through MCP. Evidence uploads, failed-test triage, and pulling policy or control context into client questionnaires can now happen in a single conversation.

What do you like best about the product?

Their UI is simple to follow. Their customer success team is always helpful. We got quick response on all our queries.

What do you dislike about the product?

They have MCP support however we didn't use that much for collecting evidence. Perhaps that would have solved our problems.

What problems is the product solving and how is that benefiting you?

Our compliance is NOT a one time act. Scrut keeps monitoring our platform for any compliance breach and alerts us to fix it. It is a CI for Compliance

What do you like best about the product?

I liked the scrut UI/Ux. It is easy to find the security issue identified by scrut and keep track of them. For the issue it even suggests the exact fix that needs to be applied. Scrut has good and simple integrations with external services like aws, jira, slack etc. Also point of contact from scrut are regularly in touch with us and respond to any questions quickly.

What do you dislike about the product?

Lot of manual work while uploading evidences. Hope this can be further automated.

What problems is the product solving and how is that benefiting you?

We are a small company and did not know how to get started with get security certifications. Scrut has been helping us with this.

What do you like best about the product?

What I like most about Scrut Automation is its clean and intuitive UI. The integration library is extensive and covers almost all the applications we use, which makes implementation much easier.

The support team has been very helpful throughout, and we had a smooth and positive onboarding experience. The AI capabilities are also particularly strong and have helped us significantly across various compliance and automation activities.

What do you dislike about the product?

For a startup or a growing organization, some of the recommended Gaps by AI can be hard to implement exactly as suggested, and they may not always feel proportionate to the actual risk. It would be more helpful if the AI tailored its recommendations to the organization’s specific context, and then prioritized the gaps based on risk, business impact, and practical feasibility.

What problems is the product solving and how is that benefiting you?

Scrut Automation has helped us significantly reduce the manual effort involved in governance and compliance. Previously, tracking policies, controls, evidence, reviews, and other compliance activities took a lot of manual follow-up and record-keeping. With Scrut, most of this work is now centralized and automated, making it much easier to monitor the status of compliance tasks and maintain the required evidence.

What do you like best about the product?

I receive immediate responses from the account manager and the support team whenever I have compliance or platform-related questions, and they consistently provide a solution.

UI/UX is good, can be little improved

Integrations are on stronger side supporting lots of platforms

AI integration works good can be improved to be better
Overall Performance is great

What do you dislike about the product?

Trainings are not up to date with latest technology and standards, strong experts needed for upcoming compliances as DPDPA

What problems is the product solving and how is that benefiting you?

It solves GRC for us and benefits us for achieving and maintaining compliances