Scoring Methodology
We score the eight things that decide how a compliance program runs day to day, from how much evidence collects itself to how fast a signed report arrives. A capability earns points only when it ships in the product. Scores show their date and sources. Vendors can ask for a re-check, and every change lands in the changelog below.
Scope
Compliance automation platforms that prepare a company for, and keep it in, SOC 2, ISO 27001, HIPAA, PCI DSS and adjacent frameworks.
The seven platforms scored to date are ranked in the GRC software ranking, the SOC 2 software ranking and the compliance management ranking. Two head-to-head comparisons also apply this rubric: Vanta vs Drata and OneTrust vs Drata.
Criteria
Each criterion runs from level 0, where the capability is missing, to level 5, its strongest form. A criterion's points are its level divided by five, times its weight, so a level 3 on a 20-point criterion earns 12.
FC
Framework coverage
Weight: 15 · How many frameworks can a customer run out of the box, without building them by hand?
The second framework usually arrives because a big customer asks for it. If the platform already ships that framework, the team reuses the controls it has and skips mapping a new standard by hand.
| Level | Description |
|---|---|
| 5 | All of level 3, plus three or more of ISO 42001, NIST CSF, NIST 800-53, FedRAMP or CMMC. |
| 4 | All of level 3, plus one or two of ISO 42001, NIST CSF, NIST 800-53, FedRAMP or CMMC. |
| 3 | SOC 2, ISO 27001, HIPAA, PCI DSS and GDPR. |
| 2 | SOC 2, ISO 27001 and one of HIPAA, PCI DSS or GDPR. |
| 1 | SOC 2 plus one other framework. |
| 0 | SOC 2 only. |
EV
Automated evidence
Weight: 20 · How much evidence does the platform collect and test on its own, and how much does a person still have to upload?
Evidence is where a compliance team's week goes. Every system that hands over proof on its own is one less screenshot to chase before the auditor arrives, so this criterion carries the most points.
| Level | Description |
|---|---|
| 5 | 300 or more integrations, continuous tests, and a public API or custom integration builder. |
| 4 | 200 to 299 integrations, continuous tests, and a public API or custom integration builder. |
| 3 | 100 to 199 integrations, with continuous automated control tests. |
| 2 | 50 to 99 integrations, with automated control tests. |
| 1 | Fewer than 50 integrations. |
| 0 | No integrations. Evidence is uploaded by hand. |
AU
Audit path
Weight: 15 · When the platform says you are ready, how short is the road to a signed report?
Being ready is half the job. The signed report is what a customer's security team asks for, and time is easy to lose on the way: finding a firm, booking fieldwork and passing evidence back and forth.
| Level | Description |
|---|---|
| 5 | The audit is delivered inside the platform by the vendor's in-house or affiliated audit firm, as one engagement. |
| 4 | The audit can be bought as part of the platform deal, through partner firms, with auditors working inside the platform. |
| 3 | Both a named partner network and auditor review of evidence inside the platform. |
| 2 | A named partner network of audit firms, or auditors can review evidence inside the platform. |
| 1 | A referral list of audit firms, with no auditor access to the platform. |
| 0 | No auditor pathway. The customer finds and manages an auditor alone. |
PT
Pricing transparency
Weight: 10 · Can a buyer estimate the cost before speaking to sales?
A team should be able to put a rough number in the budget before the first sales call. Most vendors in this market make that hard, so the ones that print prices earn credit for it.
| Level | Description |
|---|---|
| 5 | Per-plan prices, and the price of the audit or the main add-ons. |
| 4 | Per-plan prices, with what each plan includes. |
| 3 | Starting prices for more than one plan. |
| 2 | A single starting price. |
| 1 | Plan names and inclusions, with no numbers. |
| 0 | No price and no plan details. |
TR
Trust and questionnaires
Weight: 10 · Once certified, does the platform help the customer prove it to their own buyers?
A certification only pays off once a buyer sees it. Trust centers and questionnaire tools put the report in front of a customer's security team and cut the rows someone still answers by hand.
| Level | Description |
|---|---|
| 5 | Both, with AI-assisted answering drawn from the customer's own live evidence and policies. |
| 4 | Both, with AI-assisted questionnaire answering. |
| 3 | Both a trust center and questionnaire automation. |
| 2 | A trust center or questionnaire automation, not both. |
| 1 | A basic public security page, or questionnaire answering by hand from a library. |
| 0 | No trust center and no questionnaire tooling. |
VR
Vendor risk management
Weight: 10 · Can the customer assess and track the risk of their own suppliers inside the platform?
Auditors and customers both ask about your suppliers. Running those reviews next to your own controls keeps one record for both questions.
| Level | Description |
|---|---|
| 5 | All of level 4, plus continuous monitoring of vendor risk after onboarding. |
| 4 | All of level 3, plus automated review of vendor security documents. |
| 3 | Inventory, risk ratings, and questionnaires sent to vendors from the platform. |
| 2 | Inventory plus risk ratings entered by hand. |
| 1 | A vendor inventory only. |
| 0 | Not offered. |
CF
Customisation
Weight: 10 · Can the customer adapt the platform to controls and frameworks it does not ship?
No company's controls line up with a framework exactly. Custom controls, custom frameworks and tests that count toward several frameworks decide how much of the real program fits inside the platform.
| Level | Description |
|---|---|
| 5 | Custom frameworks, custom automated tests, and control mapping across frameworks so one test satisfies several. |
| 4 | Custom frameworks, plus custom automated tests. |
| 3 | Custom frameworks can be built. |
| 2 | Custom controls and custom policies. |
| 1 | Custom controls can be added to shipped frameworks. |
| 0 | No custom controls or frameworks. |
US
User sentiment
Weight: 10 · What do verified users report, weighted by how many of them there are?
Verified reviews show how a platform holds up after the contract is signed. Volume counts as much as the average, so a 4.8 from 30 reviews scores below a 4.6 from 900.
| Level | Description |
|---|---|
| 5 | Average 4.5 or higher with 200 or more reviews. |
| 4 | Average 4.5 or higher with 25 to 199 reviews. |
| 3 | Average 4.0 to 4.4 with 25 or more reviews. |
| 2 | Average 3.5 to 3.9, or fewer than 25 reviews at any score. |
| 1 | Average below 3.5. |
| 0 | No verified review profile on any independent platform. |
Score bands
The eight criteria add up to 100 points, and the total puts each platform in one of five bands.
| Band | Range | What it means | Platforms today |
|---|---|---|---|
| Deficient | 0 to 34 | A weighted average level below 1.75 across the eight criteria; for scale, level 0 on automated evidence is "No integrations. Evidence is uploaded by hand". | None scored yet |
| Limited | 35 to 54 | A weighted average level from 1.75 up to 2.75 across the eight criteria; for scale, level 1 on automated evidence is "Fewer than 50 integrations". | Thoropass (52) |
| Adequate | 55 to 69 | A weighted average level from 2.75 up to 3.5 across the eight criteria; for scale, level 2 on automated evidence is "50 to 99 integrations, with automated control tests". | OneTrust (64) |
| Strong | 70 to 84 | A weighted average level from 3.5 up to 4.25 across the eight criteria; for scale, level 3 on automated evidence is "100 to 199 integrations, with continuous automated control tests". | Sprinto (84), Vanta (82), Drata (76), Secureframe (75), Scrut (72) |
| Exemplary | 85 to 100 | A weighted average level of 4.25 or higher across the eight criteria; for scale, level 4 on automated evidence is "200 to 299 integrations, continuous tests, and a public API or custom integration builder". | None scored yet |
Pricing disclosure tiers
Each platform also sits in one of three tiers for where its prices appear. The tier is separate from the score.
| Tier | Definition | Platforms today |
|---|---|---|
| List price | The vendor lists a dollar price. | Secureframe |
| Marketplace price only | The vendor lists no dollar price. A starting price appears on its AWS Marketplace listing. | Sprinto, Vanta, Drata, Scrut, Thoropass |
| Quote only | The vendor lists no dollar price and has no AWS Marketplace price. | OneTrust |
Changelog
v0.9 · 2026-10-11
Six totals change. Vanta moves from 80 to 82: vendor risk management 4 to 5 (vanta.com/products/third-party-risk-management, a TPRM Agent that continuously monitors vendors, sold as an add-on). Customisation stays at 4, because vanta.com/products/custom-frameworks maps one control to several frameworks without stating that one test satisfies several. Sprinto moves from 82 to 84: vendor risk management 4 to 5 (sprinto.com/pricing, Enterprise TPRM with continuous vendor risk monitoring and breach alerting). Secureframe moves from 73 to 75: vendor risk management 1 to 2 (secureframe.com/features/vendor-risk-management, vendor profiles, risk assessments and custom risk scores). Scrut moves from 67 to 72, into the Strong band: audit path 2 to 3 (scrut.io/post/human-element-compliance-scrut-automation, a partner network of auditors with named audit partners), vendor risk management 3 to 5 (scrut.io/platform/vendor-risk-management, automatic document assessment and monitoring of breach data) and customisation 5 to 4 (scrut.io lists custom frameworks, custom controls and custom tests; its mapping across frameworks is control-level, the same standard that holds Vanta at 4). OneTrust moves from 60 to 64: automated evidence 4 to 5 (onetrust.com/solutions/tech-risk-and-compliance, 500+ pre-built system connectors). Thoropass moves from 49 to 52: framework coverage 4 to 5 (thoropass.com/platform/compliance-ai, ISO 42001 support). Ranks are unchanged: Sprinto, Vanta, Drata, Secureframe, Scrut, OneTrust, Thoropass. A capability counts when the vendor lists it on any plan or add-on. Automated evidence scores on the largest integration figure a vendor states for the scored product, with "hundreds" counted at 200.
v0.9 · 2026-10-06
OneTrust added and scored 60. Framework coverage 4, automated evidence 4, audit path 2, pricing transparency 1, trust and questionnaires 0, vendor risk management 5, customisation 3 and user sentiment 4. OneTrust ranks sixth, and Thoropass, unchanged at 49, moves to seventh.
v0.9 · 2026-10-04
Vanta rescored from 75 to 80. Audit path moved from 2 to 3 and customisation from 3 to 4.
v0.9 · 2026-10-04
Drata rescored from 73 to 76. Audit path moved from 2 to 3. Drata now ranks third alone, and Secureframe, unchanged at 73, ranks fourth.
v0.9 · 2026-10-04
Scrut rescored from 63 to 67. Vendor risk management moved from 1 to 3.
v0.9 · 2026-10-04
Thoropass rescored from 47 to 49. Trust and questionnaires moved from 0 to 4, and pricing transparency from 3 to 0. Pricing transparency credits only a vendor's list prices and plan details; marketplace listings and review-site prices do not count.
v0.9 · 2026-09-23
First version. Eight criteria worth 100 points in total.