The Compliance Platform Moat Is Gone

The disruption wasn't caused by competition.

It was caused by the fact that the thing platforms were selling, and charging for, is no longer rare.

What Platforms Were Selling

When Vanta, Drata, and Secureframe first pitched, they weren’t pitching “we will make you secure.” They were pitching: “Connect your systems and compliance becomes automatic. You’ll never have to pull another screenshot again. The integrations do all of the work.”

That was a real product. Creating and maintaining hundreds of API connectors to identity providers, cloud consoles, HR systems, code hosts, etc. is really hard, really expensive, and really valuable if nobody else can do it.

Creating those connectors was the moat. Everything else in the platform, including the policy templates, control library, and Auditor portal, was packaging around that moat.

Two problems showed up in practice.

The first is that the integrations break quietly. A vendor moves a setting from one page in an admin console to another, and suddenly the automated test starts failing or, worse yet, starts passing for the wrong reason. Someone at the platform has to notice and ship a fix. When you get that across a few hundred connectors and a few dozen frameworks, that's just noise to the customer.

The second is that the integrations pull in whatever they can reach, which isn’t necessarily what the Auditor wants. Connect every single thing on day one before anybody has scoped out the engagement, and you end up with a system full of data nobody ever asked for. Dirty data is far worse than clean data because now some poor soul has to sort it out. I’ve had a steady stream of companies come through our doors after that experience saying the exact same sentence: “It was more trouble than it was worth.”

But here's where I always thought the pitch undercut itself long before AI: you still have to hire an Auditor. The platform never issued a report. Never signed anything. Collected evidence and gave it to a CPA firm, which then did what CPA firms do. The automation was a conveyor belt to a human bottleneck the platform couldn't remove.

So, the platform was solving a smaller problem than what the marketing implied. But now that small piece of work doesn't require the platform.

Put an Agent Into Their Environment

Take any frontier model, add an application layer onto it, and drop it into the client's environment with read-only permissions. The agent enumerates the tenant. Enumerates the IAM policy exports, the role bindings, the conditional access configurations, the endpoint inventory, and the log retention settings. Doesn't need a pre-connector because it can read a console, a CLI, and an API the same way an analyst can, and it doesn't need someone at a vendor to push out a fix when Microsoft moves a menu.

In approximately 18 months, that integration advantage has largely evaporated.

How we use that advantage is interesting because ‘cheaper’ is a boring argument. The interesting claim is that the output is superior to what a platform generates, and that it is superior for a structural reason: a platform has to create one control set for 15,000 customers. We get to create one for one.

Evidence Collection

During a SOC 2 renewal this summer, we provided the client with a single collection of evidence requests: 41 rows covering roughly 80% of the audit’s controls. What made it successful wasn’t the list itself. It was that every row included the Auditor’s intent: which trust services criterion it satisfies, what the control is trying to prove, what constitutes a complete evidence collection, what the bare-minimum acceptable artifact is, where in their unique environment to collect it, and who is responsible for collecting it. Not “screenshot your Active Directory.” More along the lines of full principal population and role binding, IAM policy export per project, plus a list of owners and editors.

Their engineer took one look at it and said it was a week of work. He would have spent that week either way. The difference was where the week was spent. When you include the level of completeness in each request up front, you don't spend one to two weeks of time toward the end of the engagement reviewing cycles with the CPA firm to obtain a third version of the same artifact. We also had him assign each file with its corresponding criterion ID, so that mapping evidence to controls is mechanical versus manual.

A platform cannot create that document, because it is based on this environment, this Auditor's standards, and last year's report. Platforms sell generic checklists and links to help articles.

Policy Creation

This is where the one-size-fits-all problem is most evident and where I believe we're doing something truly new.

In another ISO 27001 engagement, their policies aren't living in a compliance platform as PDFs. They live in the repository adjacent to the code within a documentation directory that the AI development agents consume. One policy document is now the sole source of truth for three distinct consumers: it fulfills the requirements for ISO control, instructs coding agents on handling that type of data, and defines scope for penetration testing.

The third one was the unlock.

Their project lead put it better than I would have:

“If you don’t define what data is supposed to be exposed to penetration testing, then the tester won’t know what to look for.”

Tell the tester conference presentation materials must never be publicly accessible and reaching them constitutes a finding. Write down what should never exist and the tester walked right past it.

Policy can either exist as something a human signs once per year and files away or it can live in source control and influence how code gets written and tested. When used that way, it becomes part of the security process rather than simply a compliance artifact. Even though well written, platforms' template libraries are only designed for that first use case.

Reporting

Last month a client sent us a two-page email full of accusatory statements about work we didn't perform. We pointed an agent at the history of their project along with their meeting record, and it created a 45-page account of their entire engagement: what was committed, when, by whom, and what shipped. Their accusations didn't survive it. They paid their invoice.

That report exists because there were enough records existing within the repository such that something could read all of them at once to produce that report. Same capability applied toward different questions produces board-ready reports on security posture, customer-facing trust summaries, or the narrative section at the front of the SOC 2 report. We've done similar things with vendor due diligence. An agent reads a vendor's public posture (certifications, breach history, published controls), populates the assessment, and emails a questionnaire only when the public record comes up empty. That used to be a spreadsheet people hated.

Where This Applies and Where It Doesn't

I want to approach this carefully because this claim gets oversold, and the oversell damaged the platform category in the first place.

You Still Need an Auditor

None of what I wrote above means that nothing has changed regarding auditors: an agent can get you audit-ready in days versus months. The audit still takes four to six weeks, and CPA firms still need to perform fieldwork and issue an opinion. Any vendor claiming that AI reduces that time is selling you something.

Time Still Passes in Type 2

SOC 2 Type 2 audits require observation windows: six months are six months. No tooling can possibly reduce the period during which organizations have demonstrated operating effectiveness; any vendor claiming otherwise will have qualified your audit report.

Compliance Platforms Fail Because They Replace Ownership With Automation

I’ve seen a lot of failures with compliance platforms, but rarely is it due to the quality or functionality of the tool itself. A compliance platform will usually provide automated compliance functions, and the user may assume that automatically provides compliance as opposed to requiring some level of oversight and control. Auditors often find that the user failed to define adequate scope when defining their control, and the response “the model did it” will not be sufficient. Someone must be responsible for making that decision and explaining that decision.

Auditor Independence Still Applies

As part of many of our ISO engagement activities, we always take read-only access to all systems being audited. We cannot help prepare a client for certification while we operate the controls we are auditing. Likewise, a certification body should not create a client's SOA nor certify against it. Just because something takes less time to deploy does not mean it avoids structure.

Is There Any Value Remaining in the Category?

Yes, there is still value remaining in the category.

For example, let's say you are a 15-person SaaS provider with a typical cloud infrastructure, no security personnel, and one large enterprise customer who has asked for a SOC 2 logo prior to closing the sale. At that point, a compliance platform is a good investment. This is a commonly traveled path where your auditor already knows about the platform, and using a compliance platform will cost much less than developing an entirely new program yourself. Also, neither of the current market leaders, Vanta and Drata, is standing still; they both developed and released agent-based solutions this year, which shows that they can also read the same handwriting on the wall.

However, know exactly what you are purchasing today. The two primary advantages of purchasing a compliance platform today are convenience and a pre-existing collection of controls. These two items represent a significant departure from building a system designed specifically for your environment. Your integration library is no longer a moat, so your renewal costs cannot be defended by these arguments anymore. As soon as your environment ceases to resemble your average customers (e.g., on-premises Exchange, unusual data residency requirements, three regulatory environments simultaneously, an AI product that requires governance that has never been templated before), the generic control set will begin to fight against you rather than work for you.

If I were paying for the compliance platform, I would ask myself the following question: what does this compliance platform do that a knowledgeable operator running an agent inside my environment could not do just as well for my business this quarter?

At one point in time, that question had viable responses. Today, I don't believe it does.

‍