What does the dataset cover?
For each of six vendors we read the public pages on 2026-09-29 and classified five tasks: evidence collection, policies, security questionnaires, audit management and remediation. Each cell is AI agents, human experts, both, coming soon, or not described. The result is 30 cells, shown as a split bar per vendor on our agents vs humans page. The data describes what vendors say, not what their products do in a customer account.
Where do vendors agree?
Evidence. Scytale says its agents collect evidence and monitor controls, with an AI Evidence Reviewer on top. Vanta lists automated evidence on every plan. Sprinto describes continuous monitoring across 300+ integrations, Drata pre-built integrations, Comp AI automation with 580+ integrations, and Delve AI agents that automate evidence collection. If evidence is your main pain, all six address it on paper, and the integration list matters more than the agent label.
Where do they differ?
Policies and remediation. Vanta says its AI Agent drafts policies and writes remediation snippets in Terraform, AWS CLI and CloudFormation. Sprinto lists AI-assisted policies. Scytale lists AI Remediation and an AI Policy Generator marked coming soon. Drata, Comp AI and Delve did not describe either task on the pages we read. Questionnaires sit in between: Vanta, Sprinto and Drata describe AI help, and Scytale describes AI auto-fill with a human expert reviewing the answers.
Who manages the audit?
This is the task where people still dominate. Scytale describes a dedicated compliance expert who manages the audit process with the customer's chosen auditor. Vanta and Drata route audit work to auditor networks and partners. Sprinto combines in-platform audit management with network auditors or your own, which we count as both. Comp AI and Delve did not describe the audit arrangement.
How should you use this?
Count the tasks your team does not want to own. If it is evidence and questionnaires, most platforms here will do. If it includes policies and remediation, Vanta and Sprinto describe more AI coverage. If it includes running the audit, Scytale is the one vendor here that describes its own people doing it. Then check the cells marked Not described in a demo: ask the vendor to show the task, and note whether an agent or a person performs it.
What are the limits of this data?
A cell reflects one reading of public pages on one date. Vendors change pages often, and many describe features in sales decks rather than on the web. We mark coming-soon features separately so they do not count as available. If a vendor shows us a public page that describes a task we marked Not described, we will update the cell and the counts will recompute.
What does the support channel add?
Under each split bar we show the support channel the vendor describes, because it tells you who you will talk to when a task goes wrong. Scytale describes a dedicated compliance expert with weekly meetings. Comp AI and Delve describe 1:1 Slack support with experts, each with its own response-time claim. Vanta routes expert work to partners such as vCISOs, MSPs and MSSPs, and Drata to its 1300+ partners. Sprinto describes 24x5 standard email and in-app support on its Foundation plan. The channel matters most at the moments agents cannot handle: a failed control the day before fieldwork, an auditor question about scope, or a customer questionnaire with an unusual requirement. Match the channel to how your team prefers to work, and ask whether it changes when you add a framework or move up a plan.