What does compliance automation software do?
Governance, risk and compliance (GRC) work turns a framework such as SOC 2 or ISO 27001 into a set of controls, proves each control works with evidence, and hands that evidence to an auditor. Compliance automation platforms connect to your cloud accounts, identity provider, code repositories and HR system, pull configuration and records as evidence, and show which controls pass or fail. The six platforms on this site all do this; they differ in how much of the rest of the work they take on.
Where do AI agents come in?
An AI agent, in vendor language, is software that carries out a task with some autonomy rather than waiting for a person to click. On the pages we reviewed, vendors describe agents that collect and review evidence (Scytale, Delve), draft policies (Vanta), suggest questionnaire answers (Vanta, Scytale), monitor vendor risk (Vanta, Sprinto, Drata) and propose remediation, such as Vanta's snippets in Terraform, AWS CLI and CloudFormation. Some vendors describe the category in bigger terms: Vanta calls itself an 'Agentic Trust Platform' and Sprinto an 'Autonomous Trust Platform'. Those are positioning statements; the task list is what you can check.
What still needs a person?
Frameworks require people to own decisions: which risks to accept, which controls apply, how exceptions are handled. Audits are performed by people: for SOC 2, a CPA firm; for ISO 27001, a certification body. Between those two ends sits a lot of coordination work (scoping, evidence review, auditor scheduling) that some vendors hand to a dedicated human expert and others leave to the customer or to partners. That split is what our agents vs humans dataset tracks.
Why does this matter more at framework two?
A first framework is a one-off project. A second and third multiply the evidence requests, the policy updates and often the audits. A platform that maps controls across frameworks and has agents or experts carrying the repeat work changes the cost of each additional framework. That is the lens this site uses.
How should you read the rest of this guide?
The next two lessons cover the frameworks most teams start with and how controls map between them. Track 2 looks at who does the work: agents, human experts and auditors. Track 3 is about the second and third framework, and Track 4 about buying: what vendors publish on price and how to test an agent claim yourself. Each lesson links to the data pages it draws on, so you can check any statement against the vendor page it came from. Where a vendor's pages did not describe something, the lesson says so rather than guessing.