One of the first questions I hear from teams starting their first SOC 2 is some version of "do we have to buy Vanta or Drata?" The short answer: No.
Teams buy these platforms to save time, and most of that time is evidence collection. But compliance automation platforms can often cost as much or more than the audit itself, and if you're small or have relatively simple compliance requirements, these tools can be overkill.
What many first-time SOC 2 clients don't realize is that a good audit firm should already have an evidence collection system in place that you don't have to pay for. Choosing a firm with an efficient process and a good evidence collection platform (paid for by the auditor, rather than you) will often lower the total cost of your compliance program and can actually decrease the time it takes your team to get through the audit process.
Do you need Vanta or Drata to get a SOC 2 report?
No. A SOC 2 report comes from a CPA firm's examination of your controls, not from software, so no platform is required. A platform is worth buying when it saves more time than it costs, and that depends mostly on your size, your number of frameworks, and your questionnaire volume. If you're executing your first SOC 2 and don't have multiple other compliance frameworks that your customers are requesting, you likely don't need a Vanta, Drata or similar system just yet. A good auditor can advise you on the value of these systems and when they are likely to really save you enough time to justify their cost.
What's the difference between a compliance platform and an auditor-provided portal?
A compliance platform runs your security program all year, and you pay for it. An auditor-provided portal runs the audit itself, and the audit firm pays for it. Many audit firms already license their own audit automation software, such as Fieldguide, so you don't need to buy a second platform just for the audit. Both models are legitimate; they solve different problems.
| Customer-paid automation (e.g., Vanta, Drata) | Auditor-provided portal (e.g., Fieldguide, Yak) | |
|---|---|---|
| Who pays | You, as an annual subscription | Your audit firm; no separate cost to you |
| Built for | Running your compliance program year-round | Running the audit engagement |
| What you get | Continuous monitoring through cloud, identity and HR integrations; policy templates; training and background-check workflows; device agents; trust center; questionnaire automation; multiple frameworks | Request lists, secure uploads, status tracking, comments and evidence review |
| What it doesn't do | It doesn't include the audit itself | Year-round monitoring, a policy library or customer questionnaires |
| Usually fits | Larger or multi-framework teams with heavy questionnaire volume | Smaller teams with simple systems and one compliance framework |
How much does SOC 2 automation cost?
Public list prices start at about $14,000 a year for Vanta's smallest package, and Drata lists $25,000 plus $7,500 per framework. Buyers under 50 people report paying roughly $12,000–$28,000 a year. The actual audit is extra.
| Measure | Vanta | Drata |
|---|---|---|
| List price (SOC2ComplianceCost) | Essentials (1–20 employees) from $14,000/yr | $25,000 platform fee (100-person capacity) + $7,500 per framework |
| Buyer-reported, under 50 employees, one framework (PlatOps) | $12,000–$28,000/yr | $12,000–$28,000/yr |
| Median across all buyers (PlatOps) | About $20,000/yr | About $25,000/yr |
When can a small company skip compliance automation?
If you have about 50 people or fewer, one framework, one cloud provider and a simple identity setup, you can often do SOC 2 well without an automation platform like Vanta. At that size, a year's evidence is often a few dozen items that a good auditor portal and clear checklists can handle.
If you meet the following criteria, it's highly likely you do not yet need a SOC automation platform:
About 50 people or fewer
One framework, usually SOC 2
One cloud provider
Only a handful of security questionnaires a month
An auditor who provides a portal and captures evidence efficiently
When does SOC 2 automation pay for itself?
Usually at about 75–100+ people, or once you add a second framework such as ISO 27001 or HIPAA. At that point evidence requests and questionnaires come in at a volume where automation saves more hours than it costs. Do you need an automation platform? No. Might it save you time and money? Possibly, and in some cases it's a no-brainer.
If you meet the following criteria, you might start considering purchasing a SOC automation platform:
Onboarding, offboarding, and access reviews at volume
Multiple frameworks, where one control maps to several
Multi-cloud setups or many in-scope systems
Heavy questionnaire volume, where a trust center saves sales and engineering hours
Customers who expect continuous monitoring
No internal security owner to keep the program moving between audits
How can you collect evidence efficiently without an automation platform?
A good auditor wants to run an efficient process that saves you and them time while still providing a high-quality report. Unfortunately, many audit firms have traditionally asked clients to capture evidence through a laborious process of taking screenshots of various systems and a lot of back-and-forth task assignments. This can be frustrating for clients who often misinterpret the request and grab the wrong screenshots.
At Eye & Co., evidence doesn't come from screenshots. It comes from observation meetings. Before each one, we send an agenda grouped by theme, such as change management, HR, monitoring or infrastructure. Then your team shares a screen and walks us through how things actually work: one change through code review, testing, and deployment; a real security alert and who responded; backup configuration settings; and so on. Most sessions run 15 minutes to an hour and a half. We record the call and use AI to process the transcript, so each control is tied to a timestamp in the recording and the screenshots come from the video, not from your team. That replaces the "death by screenshot" approach of traditional firms, saves your team hours, and doesn't require a platform that can cost $20,000 or more a year. A secure upload portal handles the documents that remain.
What I see in practice
Recently, a two-person startup came to us after being quoted about $20,000 a year for a compliance platform, before anyone had scoped their audit. At that size, the subscription costs more than the audit, and they didn't need most of what it does. Growing teams tell me automation pays off once headcount, systems, and frameworks add up, particularly if they rely on common software and cloud hosting providers that integrate with the platforms.
How should you decide?
Choose your auditor yourself, not through your platform's bundle. A discounted audit that comes with your subscription often means you don't pick the firm, and that firm depends on the platform for referrals. The AICPA has flagged this setup: its ethics staff warn that heavy referral ties, platform-set audit fees, and platform-driven deadlines can threaten an auditor's independence (Journal of Accountancy, April 2026).
Ask your auditor how they collect evidence, and how they make the evidence collection process easy and efficient for your team.
Assess your real evidence load: people, systems, frameworks and questionnaires.
Model your full first-year cost: platform and audit together.
If you already have a platform, ask your auditor directly how much work they've done inside it.
At Eye & Co., we're software-agnostic. We work inside Vanta, Openlane, and other platforms with clients who have them, and we're just as comfortable telling a 15-person team they may not need one yet.
So buy automation when your program needs it, not because the audit does.
FAQ
Does the AICPA require compliance software for SOC 2?
No. The AICPA sets the criteria and attestation standards for the examination. It doesn't require any particular software.
Can my auditor work inside our existing Vanta or Drata account?
Usually, yes. These platforms give auditors their own access, and your auditor should work from your platform rather than duplicate your evidence requests.
Is the audit included in the platform price?
Usually not. Most platform pricing covers software only, though some platforms sell a bundle that includes an audit by a firm they pick. The audit is a separate engagement with a CPA firm. If you're offered a bundle, ask who sets the audit fee and whether the firm pays the platform for referrals. The AICPA says the audit fee has to be set by the auditor, not the tool provider, and payments that are really referral fees have to be disclosed to you in writing (Journal of Accountancy, April 2026).
How do I know if my SOC 2 auditor is independent?
I'd ask any firm three things: who referred you to them, who sets their fee, and how they tailor scope and sampling to your systems. Then check their peer review results. This matters more than ever. In May 2026, the AICPA told peer reviewers to compare several of a firm's SOC 2 reports and flag work with identical risk assessments, sample sizes and testing procedures as nonconforming (Journal of Accountancy, May 2026). It has also said it's looking into allegations about a compliance vendor's SOC services and will act against members who didn't follow professional standards (AICPA ethics notice). If an offer sounds unrealistically fast, easy or cheap (Journal of Accountancy, Feb. 2026), treat that as a warning sign.
Does a compliance platform guarantee a clean report?
No. A platform automates evidence collection and monitoring, but your controls still have to operate, and your auditor still tests them.
Can we start without a platform and add one later?
Yes. Many teams start with auditor-led evidence collection and add automation as they grow. Decide your trigger points (headcount, a second framework, questionnaire volume) up front.
Want a second opinion on tooling fit?
Book a free readiness and tooling-fit call with Kate Eye, our CEO and Lead Partner. You'll talk with a partner, not a salesperson. We'll look at your size, scope and customer asks, and tell you plainly whether a platform fits your stage and what a realistic first-year budget looks like.
