Sold by
Scrut Automation
Scrut Automation is an automated GRC platform designed to save time, effort, and resources by natively integrating with tools like AWS to automate evidence collection, continuously monitor controls, run daily tests, detect risks, and provide actionable remediation guidance. With out-of the box support for 50+ industry standard frameworks, Scrut helps organizations easily automate key compliance workflows and stay audit-ready at all times.
Reviews (1342)
Lyn G.
Streamlined Compliance Evidence Across Frameworks, with More Integrations Needed
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
I like the access review section and how smoothly scheduling and distribution work. I also like that the evidence for our frameworks and regulations is in one place and can be assigned accordingly. Scrut Automation shows which evidence can be used across different frameworks and regulations, so maintaining it is much more seamless than managing it manually in spreadsheets. It also helps me organize compliance activities, collect evidence, monitor things, and inventory our assets. The initial setup was easy.
What do you dislike about the product?
I’d like more integrations that can be connected, monitored, and audited, especially Akamai Cloud Computing.
What problems is the product solving and how is that benefiting you?
I use Scrut Automation to organize compliance activities, collect evidence, and monitor and inventory our assets.
Computer Software
Responsive Team and a Unified Hub for SOC 2 & HIPAA Compliance
Reviewed on Nov 03, 2026
Review provided by G2
What do you like best about the product?
The team behind it. Whenever we needed help, they got on a call quickly and walked us through it, including during our internal audit ahead of the external one. The platform itself keeps SOC 2 and HIPAA in one place: policies, evidence tasks, controls and audit findings all live together, so we always know what is open and what is done. The policy templates gave us a solid starting point, and the sample evidence on each task makes it clear what an auditor expects to see. We also connected Scrut to our AI tools through their MCP server, which let us read controls and upload evidence without clicking through every screen.
What do you dislike about the product?
Some workflows take more clicks than they should. Evidence tasks drop back to Draft after any upload or delete until you mark them as uploaded again, which is easy to miss. The Audit Center is not available through the API or MCP, so closing findings is still manual work in the browser. Reassigning ownership of policies and tasks in bulk, for example when someone leaves the team, could also be easier.
What problems is the product solving and how is that benefiting you?
We sell to companies in financial services and healthcare, so we need SOC 2 and HIPAA to close deals. Scrut gives a small team a clear, structured path through both frameworks without hiring a dedicated compliance person. It tracks what evidence is due, flags gaps before the auditor sees them, and keeps everything ready for the external audit. That saves us a lot of time and gives us confidence when a customer sends a security questionnaire.
Michael W.
Automated compliance made ISO 27001 & SOC 2 achievable for our small team
Reviewed on Nov 02, 2026
Review provided by G2
What do you like best about the product?
As a small team, we achieved ISO 27001:2022 certification and a SOC 2 Type 2 report in the same year, with Scrut as our single source of truth for controls, policies and evidence. What I like best is how much of the evidence collection is automated: the integrations with Google Workspace, GCP and GitHub, plus the monitors and continuous tests, show gaps early instead of right before the audit. The policy templates gave us a solid starting point. Our customer success manager was a big help throughout, from setting up the SOC 2 engagement to coordinating with the auditor. We also use the Scrut MCP server, which lets us query controls and evidence and upload evidence directly from our AI tooling. The Trust Vault gives us an easy way to share certificates and reports with customers.
What do you dislike about the product?
There are a few rough edges. When an automated monitor uploads new files, evidence that was already approved goes back to Draft and has to be approved again, which adds manual clicks every month. Setting up a custom domain for the Trust Vault needs a manual activation by Scrut, and the default portal URL stopped loading until then; a self-service flow would help. With many recurring evidence tasks, the "Needs Attention" workload can pile up quickly, so a better overview of what is due when would be welcome. None of this was a blocker, and support was always responsive.
What problems is the product solving and how is that benefiting you?
Scrut solves the problem of running a compliance program with a small team and no dedicated compliance staff. Before, policies, evidence, risks and vendor information would have been spread across documents, spreadsheets and email. Now everything lives in one place and is mapped across ISO 27001, SOC 2 and GDPR, so one piece of evidence often covers several frameworks. Automated monitoring of our cloud, identity and code systems replaces much of the manual screenshot work and shows gaps continuously instead of right before an audit. The concrete benefit: we achieved ISO 27001:2022 certification and an unqualified SOC 2 Type 2 opinion within one year, and the auditors could work directly from the evidence in the platform. For sales, we can now answer security questionnaires faster and share our certificates and reports through the Trust Vault, which helps in enterprise deals. Going forward, the recurring evidence tasks and reminders keep us audit-ready for the surveillance audit and the next SOC 2 period, instead of starting from scratch each year.
Margaret K.
Cost-Effective Service with Quick, Responsive Support
Reviewed on Oct 21, 2026
Review provided by G2
What do you like best about the product?
They are cost effective and quick to respond.
What do you dislike about the product?
We don't have the same Scrut person for different initiatives. That leads to inconsistency in delivery.
What problems is the product solving and how is that benefiting you?
SOC 2 type 1 and 2
Birta B.
Scrut Keeps Compliance Organized, with Responsive Support
Reviewed on Oct 19, 2026
Review provided by G2
What do you like best about the product?
Scrut helps keep our compliance work organised by bringing policies, evidence, risks and vendor assessments into one place. I’ve found it particularly useful for reviewing vendor documentation, recording assessments and tracking outstanding actions. Having that information together makes it easier to see what still needs attention and follow up throughout the year.
The support team has also been helpful and responsive. When we recently encountered an issue with automated document collection, they investigated, resolved the problem and followed up with a clear explanation.
The support team has also been helpful and responsive. When we recently encountered an issue with automated document collection, they investigated, resolved the problem and followed up with a clear explanation.
What do you dislike about the product?
There isn’t anything in particular that I dislike about Scrut. Scrut helps make compliance work a lot more organised and manageable.
What problems is the product solving and how is that benefiting you?
Scrut helps us stay on top of ongoing compliance work alongside running the business. Having evidence, policies, vendor assessments and risks in one place makes it easier to keep documentation current, identify outstanding tasks and follow up with the right people.
For me, the main benefit is a clearer view of what needs attention throughout the year, which makes the work more manageable and helps us stay prepared for audits and customer security questions.
For me, the main benefit is a clearer view of what needs attention throughout the year, which makes the work more manageable and helps us stay prepared for audits and customer security questions.
Santhosh B.
Failed Automation, Poor Support, No Leadership Accountability, and Escalations That Went Nowhere
Reviewed on Oct 17, 2026
Review provided by G2
What do you like best about the product?
The Scrut GRC platform helps streamline compliance activities by providing a centralised platform to manage tasks, policies, evidence and compliance requirements.
1. Task assignment and ownership: Tasks can be assigned to individual team members across departments, with clear ownership of the activities they need to complete. This helps ensure that responsibilities are distributed across teams rather than leaving all compliance activities to the IT or Security team. It also helps track pending activities and follow up with the respective owners.
2. Automated draft policy generation: The platform can generate draft policies by providing basic organisational information, such as the company name. This helps teams get started with policy documentation without having to write every document from scratch.
3. Policy customisation and review: The generated policies should be reviewed and customised based on the organisation's actual business operations, technology environment, security controls and compliance requirements. They should not be adopted as-is simply because they have been generated by the platform.
4. Centralised compliance management: The platform helps bring compliance tasks and policy documentation into one place, making it easier to monitor progress, identify pending activities and coordinate with different teams.
5. Improved accountability: By assigning tasks to specific team members, the organisation can establish clear responsibility for completing compliance activities and providing the required evidence.
Overall, Scrut GRC can reduce the manual effort involved in compliance management, accelerate initial policy drafting and improve coordination across departments. However, the quality of the final policies and the effectiveness of the compliance programme still depend on proper review, validation and ownership by the respective teams.
1. Task assignment and ownership: Tasks can be assigned to individual team members across departments, with clear ownership of the activities they need to complete. This helps ensure that responsibilities are distributed across teams rather than leaving all compliance activities to the IT or Security team. It also helps track pending activities and follow up with the respective owners.
2. Automated draft policy generation: The platform can generate draft policies by providing basic organisational information, such as the company name. This helps teams get started with policy documentation without having to write every document from scratch.
3. Policy customisation and review: The generated policies should be reviewed and customised based on the organisation's actual business operations, technology environment, security controls and compliance requirements. They should not be adopted as-is simply because they have been generated by the platform.
4. Centralised compliance management: The platform helps bring compliance tasks and policy documentation into one place, making it easier to monitor progress, identify pending activities and coordinate with different teams.
5. Improved accountability: By assigning tasks to specific team members, the organisation can establish clear responsibility for completing compliance activities and providing the required evidence.
Overall, Scrut GRC can reduce the manual effort involved in compliance management, accelerate initial policy drafting and improve coordination across departments. However, the quality of the final policies and the effectiveness of the compliance programme still depend on proper review, validation and ownership by the respective teams.
What do you dislike about the product?
### My Experience with Scrut GRC, SOC 2 and ISO 27001
My experience with Scrut and its implementation support has been disappointing. The primary issues were lack of clarity, lack of project management, no clear ownership of deliverables and very limited practical assistance throughout the engagement.
**1. Lack of clarity and ownership**
There was no clear ownership of the deliverables or a structured plan to drive the engagement to completion. When we signed up, the sales representative indicated that the team would support us throughout the process. However, the actual experience was very different. There was no clear accountability for ensuring that the required activities were completed on time.
**2. No proper project management**
There was no effective project management or tracking of progress. Although weekly calls were scheduled, there was no clear agenda, no structured review of pending activities and no proper tracking of deliverables. The Scrut team did not proactively identify what needed to be discussed or what actions were required from each team.
Even when team members were on leave, meetings were not cancelled or properly managed. The calls did not provide the visibility or direction needed to move the engagement forward.
**3. No practical assistance with evidence preparation**
One of the biggest gaps was the lack of practical guidance on how to prepare and submit evidence for SOC 2 and ISO 27001. Compliance is not just about assigning tasks through a GRC platform. Teams need to understand what evidence is required, how it should be prepared, what it needs to demonstrate and how it maps to the relevant control requirements.
Despite repeated follow-ups and escalations, we did not receive the level of assistance that had been promised. Multiple escalations did not resolve the underlying issues.
**4. Lack of understanding of SOC 2 and ISO 27001**
The people supporting the engagement did not appear to have a sufficient understanding of what SOC 2 and ISO 27001 actually involve. These are not simply documentation exercises where policies are generated, tasks are marked complete and certificates or reports are issued.
They require an understanding of the organisation's actual environment, implementation of appropriate controls, collection and validation of evidence, and assessment against the applicable requirements.
**5. No clarity on auditor selection or changes**
We also faced a lack of clarity regarding the auditor arrangements. We could not change the auditor for either ISO 27001 or SOC 2, which raised concerns about the flexibility available to us and the clarity of the engagement from the beginning.
**6. Concerns about the quality of the SOC 2 report**
The quality and accuracy of the SOC 2 report were particularly concerning. The report referred to controls and infrastructure, including a WAF and DMZ, that we did not have in our environment. There were also multiple inconsistencies that I identified during my review.
What concerned me further was that these issues were neither adequately corrected nor proactively questioned during the process. As someone responsible for security and compliance, I expected the report to accurately reflect the actual environment and the controls that had been implemented and assessed.
A SOC 2 report must be based on the organisation's actual system description, relevant controls and audit evidence. Incorrectly describing infrastructure that does not exist raises serious questions about the quality of the review and the reliability of the report.
**7. Concerns about the ISO 27001 and SOC 2 outcomes**
I was also surprised by the lack of observations reported across the ISO 27001 and SOC 2 engagements, particularly given the inconsistencies and gaps I identified myself.
I would have expected a rigorous assessment, clear identification of gaps, appropriate corrective actions and transparent reporting of the results. Instead, the overall experience left me questioning how thoroughly the actual environment and evidence had been assessed.
**My overall assessment**
The fundamental issue is that the engagement felt more like a process of paying for and obtaining a certification or report than a properly managed exercise to assess and improve the organisation's security and compliance posture.
A GRC platform can help automate workflows, assign tasks and generate draft policies. However, the platform itself cannot replace competent compliance guidance, effective project management, proper evidence validation or a rigorous independent audit.
When there is no clear ownership, no meaningful progress tracking, inadequate support and a report containing descriptions of controls that do not exist, it undermines confidence in the entire process.
My expectation was not simply to obtain a certificate or report. It was to ensure that the organisation's security controls were properly assessed, the documentation accurately reflected reality, and the resulting certification or report could withstand scrutiny from customers, partners and auditors.
Based on my experience, Scrut needs to significantly improve its engagement management, practical support, technical understanding and quality assurance if it wants to deliver that outcome consistently.
My experience with Scrut and its implementation support has been disappointing. The primary issues were lack of clarity, lack of project management, no clear ownership of deliverables and very limited practical assistance throughout the engagement.
**1. Lack of clarity and ownership**
There was no clear ownership of the deliverables or a structured plan to drive the engagement to completion. When we signed up, the sales representative indicated that the team would support us throughout the process. However, the actual experience was very different. There was no clear accountability for ensuring that the required activities were completed on time.
**2. No proper project management**
There was no effective project management or tracking of progress. Although weekly calls were scheduled, there was no clear agenda, no structured review of pending activities and no proper tracking of deliverables. The Scrut team did not proactively identify what needed to be discussed or what actions were required from each team.
Even when team members were on leave, meetings were not cancelled or properly managed. The calls did not provide the visibility or direction needed to move the engagement forward.
**3. No practical assistance with evidence preparation**
One of the biggest gaps was the lack of practical guidance on how to prepare and submit evidence for SOC 2 and ISO 27001. Compliance is not just about assigning tasks through a GRC platform. Teams need to understand what evidence is required, how it should be prepared, what it needs to demonstrate and how it maps to the relevant control requirements.
Despite repeated follow-ups and escalations, we did not receive the level of assistance that had been promised. Multiple escalations did not resolve the underlying issues.
**4. Lack of understanding of SOC 2 and ISO 27001**
The people supporting the engagement did not appear to have a sufficient understanding of what SOC 2 and ISO 27001 actually involve. These are not simply documentation exercises where policies are generated, tasks are marked complete and certificates or reports are issued.
They require an understanding of the organisation's actual environment, implementation of appropriate controls, collection and validation of evidence, and assessment against the applicable requirements.
**5. No clarity on auditor selection or changes**
We also faced a lack of clarity regarding the auditor arrangements. We could not change the auditor for either ISO 27001 or SOC 2, which raised concerns about the flexibility available to us and the clarity of the engagement from the beginning.
**6. Concerns about the quality of the SOC 2 report**
The quality and accuracy of the SOC 2 report were particularly concerning. The report referred to controls and infrastructure, including a WAF and DMZ, that we did not have in our environment. There were also multiple inconsistencies that I identified during my review.
What concerned me further was that these issues were neither adequately corrected nor proactively questioned during the process. As someone responsible for security and compliance, I expected the report to accurately reflect the actual environment and the controls that had been implemented and assessed.
A SOC 2 report must be based on the organisation's actual system description, relevant controls and audit evidence. Incorrectly describing infrastructure that does not exist raises serious questions about the quality of the review and the reliability of the report.
**7. Concerns about the ISO 27001 and SOC 2 outcomes**
I was also surprised by the lack of observations reported across the ISO 27001 and SOC 2 engagements, particularly given the inconsistencies and gaps I identified myself.
I would have expected a rigorous assessment, clear identification of gaps, appropriate corrective actions and transparent reporting of the results. Instead, the overall experience left me questioning how thoroughly the actual environment and evidence had been assessed.
**My overall assessment**
The fundamental issue is that the engagement felt more like a process of paying for and obtaining a certification or report than a properly managed exercise to assess and improve the organisation's security and compliance posture.
A GRC platform can help automate workflows, assign tasks and generate draft policies. However, the platform itself cannot replace competent compliance guidance, effective project management, proper evidence validation or a rigorous independent audit.
When there is no clear ownership, no meaningful progress tracking, inadequate support and a report containing descriptions of controls that do not exist, it undermines confidence in the entire process.
My expectation was not simply to obtain a certificate or report. It was to ensure that the organisation's security controls were properly assessed, the documentation accurately reflected reality, and the resulting certification or report could withstand scrutiny from customers, partners and auditors.
Based on my experience, Scrut needs to significantly improve its engagement management, practical support, technical understanding and quality assurance if it wants to deliver that outcome consistently.
What problems is the product solving and how is that benefiting you?
### Scrut Automation: Poor Product Support and Ineffective Automation
My experience with Scrut Automation was disappointing. We encountered several issues with the platform and raised them with the product team. However, instead of taking the time to understand the problems, getting on a call with us and working towards a resolution, the focus often seemed to be on closing the support tickets.
A support ticket should not be considered resolved simply because it has been closed in the system. The underlying issue needs to be understood and fixed, and the customer should be able to confirm that the solution works.
We expected the product team to engage with us, understand the issues we were facing in real-world compliance activities and help resolve them. Instead, we repeatedly had to follow up on issues without getting the practical resolution we needed.
The automation itself also did not deliver the value we expected. The purpose of a GRC automation platform is to reduce manual effort, simplify compliance activities, improve evidence collection and provide visibility into progress. When the platform has recurring issues and the support team does not resolve them effectively, the intended benefits are lost.
**Overall, the automation was of little practical use to us, and the product support experience did not give us confidence in the platform.** There is a significant difference between closing tickets to meet internal metrics and actually solving customer problems. In our experience, the emphasis appeared to be on the former rather than the latter.
My experience with Scrut Automation was disappointing. We encountered several issues with the platform and raised them with the product team. However, instead of taking the time to understand the problems, getting on a call with us and working towards a resolution, the focus often seemed to be on closing the support tickets.
A support ticket should not be considered resolved simply because it has been closed in the system. The underlying issue needs to be understood and fixed, and the customer should be able to confirm that the solution works.
We expected the product team to engage with us, understand the issues we were facing in real-world compliance activities and help resolve them. Instead, we repeatedly had to follow up on issues without getting the practical resolution we needed.
The automation itself also did not deliver the value we expected. The purpose of a GRC automation platform is to reduce manual effort, simplify compliance activities, improve evidence collection and provide visibility into progress. When the platform has recurring issues and the support team does not resolve them effectively, the intended benefits are lost.
**Overall, the automation was of little practical use to us, and the product support experience did not give us confidence in the platform.** There is a significant difference between closing tickets to meet internal metrics and actually solving customer problems. In our experience, the emphasis appeared to be on the former rather than the latter.
Jan M.
Weekly Reviews Are Incredibly Helpful
Reviewed on Oct 16, 2026
Review provided by G2
What do you like best about the product?
the people in the weekly reviews are very helpful
What do you dislike about the product?
standard templates are not the best possible. need some legal rework
What problems is the product solving and how is that benefiting you?
giving 1 platform for most ISO related certificates
Mark W.
Scrut Makes Continuous SOC 2 & ISO 27001 Compliance Truly Achievable
Reviewed on Oct 15, 2026
Review provided by G2
What do you like best about the product?
Scrut gives us a single source of truth for SOC 2 and ISO 27001. Cross-framework control mapping means we collect evidence once and reuse it, the assignment and approval workflow keeps a small team accountable without endless follow-ups, and having risks, policies and vendor assessments in one place made our audit cycle far more organised. For a lean SaaS company, it’s made continuous compliance genuinely achievable.
What do you dislike about the product?
There’s genuinely nothing I dislike about Scrut. It has met all of our compliance needs, and any questions we’ve had have been resolved quickly.
What problems is the product solving and how is that benefiting you?
Scrut solves the challenge of managing SOC 2 and ISO 27001 compliance with a lean team. Controls, evidence, policies, risks and vendor assessments all sit in one platform, with cross-framework mapping so we collect evidence once and reuse it. The benefit for us is far less duplicated effort, clear accountability through assigned tasks and approvals, and a much more organised audit cycle. Compliance has become an ongoing, manageable process rather than a last-minute scramble.
Nilima A.
All-in-One Compliance Platform with Intuitive UI and Fast Support
Reviewed on Oct 07, 2026
Review provided by G2
What do you like best about the product?
What I like most about Scrut Automation is that it brings our entire compliance lifecycle into one platform. From policy creation and automated evidence collection to AI-powered reviews, gap analysis, and employee training, it has everything we need to manage compliance efficiently. The UI is intuitive and easy to use. Customer support is quick and resolves technical issues within a day.
What do you dislike about the product?
The AI-powered gap analysis of evidence is very extensive, and while the suggestions can sometimes be irrelevant, the overall analysis is still thorough and exhaustive.
What problems is the product solving and how is that benefiting you?
We’re a startup working with a lean team, and we needed to stay compliant across four frameworks. Scrut Platform made that possible and helped us get there without overcomplicating the process. The dashboard keeps us on top of things suggesting when fresh evidences are needed or policies require reviews.
David C.
Beginner-Friendly Templates That Make the Process Simple
Reviewed on Oct 05, 2026
Review provided by G2
What do you like best about the product?
The templates are easy to use. A beginner is guided through the entire process which makes it simple to use.
What do you dislike about the product?
There is a lot of material which is not directly relevant and getting through it can take some time.
What problems is the product solving and how is that benefiting you?
Scrut manages our ISO certification compliance. It would be quite a headache to manage this manually as we don't know what we need and then would have to develop systems for updating and reviewing all the evidence.