Which tasks do vendors hand to agents?
Our work split dataset looks at five tasks. Evidence collection is the most common: every vendor here describes automated or agent-led evidence work. Security questionnaires come next: Vanta suggests answers, Scytale auto-fills with human expert review, Sprinto and Drata offer AI questionnaire automation or assistance. Policies are drafted by the Vanta AI Agent and assisted by AI at Sprinto; Scytale lists its AI Policy Generator as coming soon. Remediation is described by Vanta (code snippets) and Scytale (AI Remediation).
How should you read a vendor's agent claims?
Vendors attach numbers to agents: Vanta cites a 95% acceptance rate for questionnaire suggestions and Scytale says its AI Evidence Reviewer reduces manual effort by up to 90%. These are vendor claims. They may be true for the vendor's customer base, but they describe the vendor's measurement, not yours. What you can check is whether the task exists, what the agent produces, and who approves it.
Where does human review sit?
An agent that drafts is different from an agent that decides. Scytale describes AI questionnaire answers reviewed by a human expert. Vanta's remediation snippets are suggestions an engineer applies. In an audit, the auditor looks at the control and the evidence, not at who drafted the policy, so human sign-off on agent output remains your responsibility.
What does 'Not described' mean in our data?
It means the vendor's public pages we read on 2026-09-29 did not describe the task. Comp AI and Delve describe automation in general terms without a task list; that is why several of their cells read Not described. Ask the vendor to show the task in a demo.
Which tasks get harder with each extra framework?
Evidence collection scales well: the same integration feeds several frameworks. Questionnaires scale with sales volume rather than frameworks, which is why Vanta and Sprinto publish yearly allowances (25 and 144 on Vanta Plus and Professional, 20 on Sprinto Foundation). Policies multiply with frameworks because each has its own wording requirements, which makes an AI policy drafter more valuable at framework three than at framework one. Remediation work depends on how many controls fail when a new framework is switched on. If you expect several frameworks, weight the policy and remediation tasks more heavily when you read our work split.