Sold by
Scrut Automation
Scrut Automation is an automated GRC platform designed to save time, effort, and resources by natively integrating with tools like AWS to automate evidence collection, continuously monitor controls, run daily tests, detect risks, and provide actionable remediation guidance. With out-of the box support for 50+ industry standard frameworks, Scrut helps organizations easily automate key compliance workflows and stay audit-ready at all times.
Reviews (1333)
Margaret K.
Cost-Effective Service with Quick, Responsive Support
Reviewed on Oct 21, 2026
Review provided by G2
What do you like best about the product?
They are cost effective and quick to respond.
What do you dislike about the product?
We don't have the same Scrut person for different initiatives. That leads to inconsistency in delivery.
What problems is the product solving and how is that benefiting you?
SOC 2 type 1 and 2
Birta B.
Scrut Keeps Compliance Organized, with Responsive Support
Reviewed on Oct 19, 2026
Review provided by G2
What do you like best about the product?
Scrut helps keep our compliance work organised by bringing policies, evidence, risks and vendor assessments into one place. I’ve found it particularly useful for reviewing vendor documentation, recording assessments and tracking outstanding actions. Having that information together makes it easier to see what still needs attention and follow up throughout the year.
The support team has also been helpful and responsive. When we recently encountered an issue with automated document collection, they investigated, resolved the problem and followed up with a clear explanation.
The support team has also been helpful and responsive. When we recently encountered an issue with automated document collection, they investigated, resolved the problem and followed up with a clear explanation.
What do you dislike about the product?
There isn’t anything in particular that I dislike about Scrut. Scrut helps make compliance work a lot more organised and manageable.
What problems is the product solving and how is that benefiting you?
Scrut helps us stay on top of ongoing compliance work alongside running the business. Having evidence, policies, vendor assessments and risks in one place makes it easier to keep documentation current, identify outstanding tasks and follow up with the right people.
For me, the main benefit is a clearer view of what needs attention throughout the year, which makes the work more manageable and helps us stay prepared for audits and customer security questions.
For me, the main benefit is a clearer view of what needs attention throughout the year, which makes the work more manageable and helps us stay prepared for audits and customer security questions.
Santhosh B.
Failed Automation, Poor Support, No Leadership Accountability, and Escalations That Went Nowhere
Reviewed on Oct 17, 2026
Review provided by G2
What do you like best about the product?
The Scrut GRC platform helps streamline compliance activities by providing a centralised platform to manage tasks, policies, evidence and compliance requirements.
1. Task assignment and ownership: Tasks can be assigned to individual team members across departments, with clear ownership of the activities they need to complete. This helps ensure that responsibilities are distributed across teams rather than leaving all compliance activities to the IT or Security team. It also helps track pending activities and follow up with the respective owners.
2. Automated draft policy generation: The platform can generate draft policies by providing basic organisational information, such as the company name. This helps teams get started with policy documentation without having to write every document from scratch.
3. Policy customisation and review: The generated policies should be reviewed and customised based on the organisation's actual business operations, technology environment, security controls and compliance requirements. They should not be adopted as-is simply because they have been generated by the platform.
4. Centralised compliance management: The platform helps bring compliance tasks and policy documentation into one place, making it easier to monitor progress, identify pending activities and coordinate with different teams.
5. Improved accountability: By assigning tasks to specific team members, the organisation can establish clear responsibility for completing compliance activities and providing the required evidence.
Overall, Scrut GRC can reduce the manual effort involved in compliance management, accelerate initial policy drafting and improve coordination across departments. However, the quality of the final policies and the effectiveness of the compliance programme still depend on proper review, validation and ownership by the respective teams.
1. Task assignment and ownership: Tasks can be assigned to individual team members across departments, with clear ownership of the activities they need to complete. This helps ensure that responsibilities are distributed across teams rather than leaving all compliance activities to the IT or Security team. It also helps track pending activities and follow up with the respective owners.
2. Automated draft policy generation: The platform can generate draft policies by providing basic organisational information, such as the company name. This helps teams get started with policy documentation without having to write every document from scratch.
3. Policy customisation and review: The generated policies should be reviewed and customised based on the organisation's actual business operations, technology environment, security controls and compliance requirements. They should not be adopted as-is simply because they have been generated by the platform.
4. Centralised compliance management: The platform helps bring compliance tasks and policy documentation into one place, making it easier to monitor progress, identify pending activities and coordinate with different teams.
5. Improved accountability: By assigning tasks to specific team members, the organisation can establish clear responsibility for completing compliance activities and providing the required evidence.
Overall, Scrut GRC can reduce the manual effort involved in compliance management, accelerate initial policy drafting and improve coordination across departments. However, the quality of the final policies and the effectiveness of the compliance programme still depend on proper review, validation and ownership by the respective teams.
What do you dislike about the product?
### My Experience with Scrut GRC, SOC 2 and ISO 27001
My experience with Scrut and its implementation support has been disappointing. The primary issues were lack of clarity, lack of project management, no clear ownership of deliverables and very limited practical assistance throughout the engagement.
**1. Lack of clarity and ownership**
There was no clear ownership of the deliverables or a structured plan to drive the engagement to completion. When we signed up, the sales representative indicated that the team would support us throughout the process. However, the actual experience was very different. There was no clear accountability for ensuring that the required activities were completed on time.
**2. No proper project management**
There was no effective project management or tracking of progress. Although weekly calls were scheduled, there was no clear agenda, no structured review of pending activities and no proper tracking of deliverables. The Scrut team did not proactively identify what needed to be discussed or what actions were required from each team.
Even when team members were on leave, meetings were not cancelled or properly managed. The calls did not provide the visibility or direction needed to move the engagement forward.
**3. No practical assistance with evidence preparation**
One of the biggest gaps was the lack of practical guidance on how to prepare and submit evidence for SOC 2 and ISO 27001. Compliance is not just about assigning tasks through a GRC platform. Teams need to understand what evidence is required, how it should be prepared, what it needs to demonstrate and how it maps to the relevant control requirements.
Despite repeated follow-ups and escalations, we did not receive the level of assistance that had been promised. Multiple escalations did not resolve the underlying issues.
**4. Lack of understanding of SOC 2 and ISO 27001**
The people supporting the engagement did not appear to have a sufficient understanding of what SOC 2 and ISO 27001 actually involve. These are not simply documentation exercises where policies are generated, tasks are marked complete and certificates or reports are issued.
They require an understanding of the organisation's actual environment, implementation of appropriate controls, collection and validation of evidence, and assessment against the applicable requirements.
**5. No clarity on auditor selection or changes**
We also faced a lack of clarity regarding the auditor arrangements. We could not change the auditor for either ISO 27001 or SOC 2, which raised concerns about the flexibility available to us and the clarity of the engagement from the beginning.
**6. Concerns about the quality of the SOC 2 report**
The quality and accuracy of the SOC 2 report were particularly concerning. The report referred to controls and infrastructure, including a WAF and DMZ, that we did not have in our environment. There were also multiple inconsistencies that I identified during my review.
What concerned me further was that these issues were neither adequately corrected nor proactively questioned during the process. As someone responsible for security and compliance, I expected the report to accurately reflect the actual environment and the controls that had been implemented and assessed.
A SOC 2 report must be based on the organisation's actual system description, relevant controls and audit evidence. Incorrectly describing infrastructure that does not exist raises serious questions about the quality of the review and the reliability of the report.
**7. Concerns about the ISO 27001 and SOC 2 outcomes**
I was also surprised by the lack of observations reported across the ISO 27001 and SOC 2 engagements, particularly given the inconsistencies and gaps I identified myself.
I would have expected a rigorous assessment, clear identification of gaps, appropriate corrective actions and transparent reporting of the results. Instead, the overall experience left me questioning how thoroughly the actual environment and evidence had been assessed.
**My overall assessment**
The fundamental issue is that the engagement felt more like a process of paying for and obtaining a certification or report than a properly managed exercise to assess and improve the organisation's security and compliance posture.
A GRC platform can help automate workflows, assign tasks and generate draft policies. However, the platform itself cannot replace competent compliance guidance, effective project management, proper evidence validation or a rigorous independent audit.
When there is no clear ownership, no meaningful progress tracking, inadequate support and a report containing descriptions of controls that do not exist, it undermines confidence in the entire process.
My expectation was not simply to obtain a certificate or report. It was to ensure that the organisation's security controls were properly assessed, the documentation accurately reflected reality, and the resulting certification or report could withstand scrutiny from customers, partners and auditors.
Based on my experience, Scrut needs to significantly improve its engagement management, practical support, technical understanding and quality assurance if it wants to deliver that outcome consistently.
My experience with Scrut and its implementation support has been disappointing. The primary issues were lack of clarity, lack of project management, no clear ownership of deliverables and very limited practical assistance throughout the engagement.
**1. Lack of clarity and ownership**
There was no clear ownership of the deliverables or a structured plan to drive the engagement to completion. When we signed up, the sales representative indicated that the team would support us throughout the process. However, the actual experience was very different. There was no clear accountability for ensuring that the required activities were completed on time.
**2. No proper project management**
There was no effective project management or tracking of progress. Although weekly calls were scheduled, there was no clear agenda, no structured review of pending activities and no proper tracking of deliverables. The Scrut team did not proactively identify what needed to be discussed or what actions were required from each team.
Even when team members were on leave, meetings were not cancelled or properly managed. The calls did not provide the visibility or direction needed to move the engagement forward.
**3. No practical assistance with evidence preparation**
One of the biggest gaps was the lack of practical guidance on how to prepare and submit evidence for SOC 2 and ISO 27001. Compliance is not just about assigning tasks through a GRC platform. Teams need to understand what evidence is required, how it should be prepared, what it needs to demonstrate and how it maps to the relevant control requirements.
Despite repeated follow-ups and escalations, we did not receive the level of assistance that had been promised. Multiple escalations did not resolve the underlying issues.
**4. Lack of understanding of SOC 2 and ISO 27001**
The people supporting the engagement did not appear to have a sufficient understanding of what SOC 2 and ISO 27001 actually involve. These are not simply documentation exercises where policies are generated, tasks are marked complete and certificates or reports are issued.
They require an understanding of the organisation's actual environment, implementation of appropriate controls, collection and validation of evidence, and assessment against the applicable requirements.
**5. No clarity on auditor selection or changes**
We also faced a lack of clarity regarding the auditor arrangements. We could not change the auditor for either ISO 27001 or SOC 2, which raised concerns about the flexibility available to us and the clarity of the engagement from the beginning.
**6. Concerns about the quality of the SOC 2 report**
The quality and accuracy of the SOC 2 report were particularly concerning. The report referred to controls and infrastructure, including a WAF and DMZ, that we did not have in our environment. There were also multiple inconsistencies that I identified during my review.
What concerned me further was that these issues were neither adequately corrected nor proactively questioned during the process. As someone responsible for security and compliance, I expected the report to accurately reflect the actual environment and the controls that had been implemented and assessed.
A SOC 2 report must be based on the organisation's actual system description, relevant controls and audit evidence. Incorrectly describing infrastructure that does not exist raises serious questions about the quality of the review and the reliability of the report.
**7. Concerns about the ISO 27001 and SOC 2 outcomes**
I was also surprised by the lack of observations reported across the ISO 27001 and SOC 2 engagements, particularly given the inconsistencies and gaps I identified myself.
I would have expected a rigorous assessment, clear identification of gaps, appropriate corrective actions and transparent reporting of the results. Instead, the overall experience left me questioning how thoroughly the actual environment and evidence had been assessed.
**My overall assessment**
The fundamental issue is that the engagement felt more like a process of paying for and obtaining a certification or report than a properly managed exercise to assess and improve the organisation's security and compliance posture.
A GRC platform can help automate workflows, assign tasks and generate draft policies. However, the platform itself cannot replace competent compliance guidance, effective project management, proper evidence validation or a rigorous independent audit.
When there is no clear ownership, no meaningful progress tracking, inadequate support and a report containing descriptions of controls that do not exist, it undermines confidence in the entire process.
My expectation was not simply to obtain a certificate or report. It was to ensure that the organisation's security controls were properly assessed, the documentation accurately reflected reality, and the resulting certification or report could withstand scrutiny from customers, partners and auditors.
Based on my experience, Scrut needs to significantly improve its engagement management, practical support, technical understanding and quality assurance if it wants to deliver that outcome consistently.
What problems is the product solving and how is that benefiting you?
### Scrut Automation: Poor Product Support and Ineffective Automation
My experience with Scrut Automation was disappointing. We encountered several issues with the platform and raised them with the product team. However, instead of taking the time to understand the problems, getting on a call with us and working towards a resolution, the focus often seemed to be on closing the support tickets.
A support ticket should not be considered resolved simply because it has been closed in the system. The underlying issue needs to be understood and fixed, and the customer should be able to confirm that the solution works.
We expected the product team to engage with us, understand the issues we were facing in real-world compliance activities and help resolve them. Instead, we repeatedly had to follow up on issues without getting the practical resolution we needed.
The automation itself also did not deliver the value we expected. The purpose of a GRC automation platform is to reduce manual effort, simplify compliance activities, improve evidence collection and provide visibility into progress. When the platform has recurring issues and the support team does not resolve them effectively, the intended benefits are lost.
**Overall, the automation was of little practical use to us, and the product support experience did not give us confidence in the platform.** There is a significant difference between closing tickets to meet internal metrics and actually solving customer problems. In our experience, the emphasis appeared to be on the former rather than the latter.
My experience with Scrut Automation was disappointing. We encountered several issues with the platform and raised them with the product team. However, instead of taking the time to understand the problems, getting on a call with us and working towards a resolution, the focus often seemed to be on closing the support tickets.
A support ticket should not be considered resolved simply because it has been closed in the system. The underlying issue needs to be understood and fixed, and the customer should be able to confirm that the solution works.
We expected the product team to engage with us, understand the issues we were facing in real-world compliance activities and help resolve them. Instead, we repeatedly had to follow up on issues without getting the practical resolution we needed.
The automation itself also did not deliver the value we expected. The purpose of a GRC automation platform is to reduce manual effort, simplify compliance activities, improve evidence collection and provide visibility into progress. When the platform has recurring issues and the support team does not resolve them effectively, the intended benefits are lost.
**Overall, the automation was of little practical use to us, and the product support experience did not give us confidence in the platform.** There is a significant difference between closing tickets to meet internal metrics and actually solving customer problems. In our experience, the emphasis appeared to be on the former rather than the latter.
Jan M.
Weekly Reviews Are Incredibly Helpful
Reviewed on Oct 16, 2026
Review provided by G2
What do you like best about the product?
the people in the weekly reviews are very helpful
What do you dislike about the product?
standard templates are not the best possible. need some legal rework
What problems is the product solving and how is that benefiting you?
giving 1 platform for most ISO related certificates
Mark W.
Scrut Makes Continuous SOC 2 & ISO 27001 Compliance Truly Achievable
Reviewed on Oct 15, 2026
Review provided by G2
What do you like best about the product?
Scrut gives us a single source of truth for SOC 2 and ISO 27001. Cross-framework control mapping means we collect evidence once and reuse it, the assignment and approval workflow keeps a small team accountable without endless follow-ups, and having risks, policies and vendor assessments in one place made our audit cycle far more organised. For a lean SaaS company, it’s made continuous compliance genuinely achievable.
What do you dislike about the product?
There’s genuinely nothing I dislike about Scrut. It has met all of our compliance needs, and any questions we’ve had have been resolved quickly.
What problems is the product solving and how is that benefiting you?
Scrut solves the challenge of managing SOC 2 and ISO 27001 compliance with a lean team. Controls, evidence, policies, risks and vendor assessments all sit in one platform, with cross-framework mapping so we collect evidence once and reuse it. The benefit for us is far less duplicated effort, clear accountability through assigned tasks and approvals, and a much more organised audit cycle. Compliance has become an ongoing, manageable process rather than a last-minute scramble.
Nilima A.
All-in-One Compliance Platform with Intuitive UI and Fast Support
Reviewed on Oct 07, 2026
Review provided by G2
What do you like best about the product?
What I like most about Scrut Automation is that it brings our entire compliance lifecycle into one platform. From policy creation and automated evidence collection to AI-powered reviews, gap analysis, and employee training, it has everything we need to manage compliance efficiently. The UI is intuitive and easy to use. Customer support is quick and resolves technical issues within a day.
What do you dislike about the product?
The AI-powered gap analysis of evidence is very extensive, and while the suggestions can sometimes be irrelevant, the overall analysis is still thorough and exhaustive.
What problems is the product solving and how is that benefiting you?
We’re a startup working with a lean team, and we needed to stay compliant across four frameworks. Scrut Platform made that possible and helped us get there without overcomplicating the process. The dashboard keeps us on top of things suggesting when fresh evidences are needed or policies require reviews.
David C.
Beginner-Friendly Templates That Make the Process Simple
Reviewed on Oct 05, 2026
Review provided by G2
What do you like best about the product?
The templates are easy to use. A beginner is guided through the entire process which makes it simple to use.
What do you dislike about the product?
There is a lot of material which is not directly relevant and getting through it can take some time.
What problems is the product solving and how is that benefiting you?
Scrut manages our ISO certification compliance. It would be quite a headache to manage this manually as we don't know what we need and then would have to develop systems for updating and reviewing all the evidence.
Gokul P.
Smooth Onboarding, Modern UI, and Powerful AI-Driven Compliance Automation
Reviewed on Oct 02, 2026
Review provided by G2
What do you like best about the product?
The onboarding process is extremely smooth and fast. The platform itself is very well organized and easy to follow, keep track of policies, compliances, risk etc. The dashboard gives a good visual snapshot of where things stand. The UI/UX is very modern and easy to navigate. You have the option to use your own policy template or start from scratch. The pricing is also reasonable for a startup and helps us move fast. The scrut teammates AI features help find compliance and policy gaps fast and can recommend fixes. Overall very impressed with the product and the on going support we have received from the Scrut team. It definitely de-mystifies the whole process and makes it much less burdensome. The automation and AI features helps ensure that we stay in compliance all the time.
What do you dislike about the product?
There are opportunities to improve integration with some newer and niche tech stack
What problems is the product solving and how is that benefiting you?
This tool helps us stay compliant for SOC2. It automates evidence collection, clearly shows our compliance status, and cuts down the hours we used to spend on manual work and meetings.
Varun C.
Year-Round Compliance Automation That Streamlines Audits
Reviewed on Oct 01, 2026
Review provided by G2
What do you like best about the product?
What I value most is that Scrut keeps compliance running year-round, rather than in frantic bursts right before an audit. Once we connected our cloud and SaaS integrations, the automated tests began flagging misconfigurations as they occurred. We triage each failed test against the controls it impacts and then either remediate it or mark it as ignored with a recorded business justification. When the auditor reviews our work, that justification is already attached right next to the test, so we’re not stuck trying to recreate the reasoning later.
The MCP connector has also been an unexpected win. From our AI assistant, I can look up policies, evidence, and failed tests; upload evidence directly into the correct evidence task; and pull control context into client security questionnaires without constantly switching tabs. During our GDPR audit prep, we handled the gap assessment against the framework and a sweep for pending evidence mostly this way, and it took days off the overall effort. Uploading evidence is close to effortless now: files from our cloud accounts, policy PDFs, and screenshots shared by colleagues can go straight into the relevant evidence task.
Audit findings, the risk register, and CAPAs (corrective and preventive actions) all live in the same place as the controls. That setup makes it easy to trace a finding back to the controls it affects and then close it out with supporting evidence. Vendor risk assessments with Scrut Teammates have also given us a quick first pass on new vendors.
The MCP connector has also been an unexpected win. From our AI assistant, I can look up policies, evidence, and failed tests; upload evidence directly into the correct evidence task; and pull control context into client security questionnaires without constantly switching tabs. During our GDPR audit prep, we handled the gap assessment against the framework and a sweep for pending evidence mostly this way, and it took days off the overall effort. Uploading evidence is close to effortless now: files from our cloud accounts, policy PDFs, and screenshots shared by colleagues can go straight into the relevant evidence task.
Audit findings, the risk register, and CAPAs (corrective and preventive actions) all live in the same place as the controls. That setup makes it easy to trace a finding back to the controls it affects and then close it out with supporting evidence. Vendor risk assessments with Scrut Teammates have also given us a quick first pass on new vendors.
What do you dislike about the product?
Most of my frustration is with the MCP connector, which is the part of Scrut we rely on most. It reads data well, but it can barely write. Creating risks, logging CAPAs, updating audit findings, completing vendor assessments, and even ignoring tests still have to be done in the web app. That breaks AI-assisted workflows halfway through, and we end up falling back to browser automation, which is slow and brittle. If the connector supported write access for these objects, it would be far more useful.
The second issue is performance on bulk queries. When listing controls, tests, or evidence—and sometimes even when fetching a single long policy—the connector returns far more data than an AI client can handle in one go. Pagination, field selection, and summary views would address this. Document search through the connector also consistently fails to return vault documents. On top of that, the question-answering tool rarely finds an answer even when the information exists, seemingly because it only looks at one document at a time instead of searching across our whole library.
In the web app, closing an audit finding after it’s fixed takes more manual steps than it should. It would help if closure could be auto-suggested when the linked evidence is updated. The answer library also starts empty, and an easier way to seed it from questionnaires we’ve already completed would make the questionnaire features pay off sooner.
The second issue is performance on bulk queries. When listing controls, tests, or evidence—and sometimes even when fetching a single long policy—the connector returns far more data than an AI client can handle in one go. Pagination, field selection, and summary views would address this. Document search through the connector also consistently fails to return vault documents. On top of that, the question-answering tool rarely finds an answer even when the information exists, seemingly because it only looks at one document at a time instead of searching across our whole library.
In the web app, closing an audit finding after it’s fixed takes more manual steps than it should. It would help if closure could be auto-suggested when the linked evidence is updated. The answer library also starts empty, and an easier way to seed it from questionnaires we’ve already completed would make the questionnaire features pay off sooner.
What problems is the product solving and how is that benefiting you?
We run several frameworks at once—SOC 2, ISO 27001, and GDPR. Before Scrut, evidence was scattered across shared drives and spreadsheets, control ownership was tracked manually, and every audit turned into weeks of chasing people and rebuilding context. Client security questionnaires were just as painful, with answers reassembled from fragmented documents each time.
Scrut gives us a single place where controls, policies, evidence, risks, and audit findings are connected across all frameworks. When we map a control once, it carries over to every framework it applies to, so we’re no longer duplicating the same work for each audit. Automated cloud tests have replaced periodic manual configuration reviews, which means drift shows up within days instead of only surfacing at audit time. Policy acceptance is tracked per employee as well, so we can see who still hasn’t acknowledged and follow up without relying on spreadsheets.
The biggest recent improvement has been connecting Scrut to our AI assistant through MCP. Evidence uploads, failed-test triage, and pulling policy or control context into client questionnaires can now happen in a single conversation.
Scrut gives us a single place where controls, policies, evidence, risks, and audit findings are connected across all frameworks. When we map a control once, it carries over to every framework it applies to, so we’re no longer duplicating the same work for each audit. Automated cloud tests have replaced periodic manual configuration reviews, which means drift shows up within days instead of only surfacing at audit time. Policy acceptance is tracked per employee as well, so we can see who still hasn’t acknowledged and follow up without relying on spreadsheets.
The biggest recent improvement has been connecting Scrut to our AI assistant through MCP. Evidence uploads, failed-test triage, and pulling policy or control context into client questionnaires can now happen in a single conversation.
Goutham K.
Simple UI and a Responsive, Helpful Customer Success Team
Reviewed on Sep 30, 2026
Review provided by G2
What do you like best about the product?
Their UI is simple to follow. Their customer success team is always helpful. We got quick response on all our queries.
What do you dislike about the product?
They have MCP support however we didn't use that much for collecting evidence. Perhaps that would have solved our problems.
What problems is the product solving and how is that benefiting you?
Our compliance is NOT a one time act. Scrut keeps monitoring our platform for any compliance breach and alerts us to fix it. It is a CI for Compliance