What Comes Before Vanta

Every few years, a new generation of enterprise platforms appears. Some help us manage projects, others help us run infrastructure — and today, a growing number of platforms help organizations demonstrate compliance. Vanta is one of them. So are Drata, Sprinto and Secureframe.

They solve a genuine problem. Modern organizations are expected to prove that security controls are not only documented, but continuously operating — and collecting that evidence manually is expensive, repetitive and error-prone. Automating it makes perfect sense.

But there is a question that interests me even more. Not "How do we prove compliance?" — but "Compliance with what?"

The question before the platform

Compliance platforms are remarkably good at answering questions like: Has this control been implemented? Is this policy reviewed? Is multi-factor authentication enabled? Those are important questions. They are just not the first questions.

Before any evidence can be collected, someone has to decide which controls matter, why they matter and which regulations actually apply to the organization. That work cannot be automated away. It requires understanding the business, its responsibilities and the environment in which it operates.

Technology is rarely the starting point

Organizations introducing AI often begin by looking for tools. In my experience, that is usually backwards. The first task is not selecting a platform — it is understanding the organization itself. Which systems already use AI? Which decisions could affect individuals? Which regulations apply? How do procurement requirements need to change? Who owns the responsibility once an AI-enabled system moves from implementation into operational management?

Those questions define the controls. Only then does it make sense to automate them.

A pattern I keep seeing

Over the years I have noticed the same pattern repeating itself. Before ServiceNow comes strategy. Before Vanta comes the requirements picture. Before AI agents comes architecture. Before procurement comes analysis.

Technology rarely creates clarity. More often, clarity determines which technology becomes valuable.

Good tools deserve good decisions

This is not an argument against compliance automation — quite the opposite. Platforms like Vanta become far more valuable when they are built on a clear understanding of the organization's obligations, risks and long-term governance.

The difficult work is rarely collecting evidence. The difficult work is deciding what is worth proving in the first place.

That work always comes first.