This is not an argument against your tooling
If you already run Vanta, Drata, Sprinto or Secureframe, you made a reasonable decision. Continuous evidence collection is genuinely tedious to do by hand, and automating it is worth paying for.
What follows is not a case for ripping it out. It is a description of the work that sits outside the tool's boundary, because that work is where SOC 2 timelines actually slip.
What the platform does, and where its boundary is
| Activity | Platform | Still yours |
|---|---|---|
| Continuous evidence collection | Yes | — |
| Control monitoring and alerting | Yes | — |
| Policy templates | Yes | Adapting them to how you actually operate |
| Deciding scope and boundaries | No | Yours |
| Remediating the red checks | No | Yours |
| Writing the system description | No | Yours |
| Preparing people for interviews | No | Yours |
| Fieldwork representation | No | Yours |
| Issuing the report | No | Independent CPA firm |
None of that is a criticism. It is the product boundary, and every vendor in this category has roughly the same one.
The four places platform-equipped teams still slip
1. Green dashboard, gappy window
The most common one. A Type 2 tests samples drawn across the whole observation window. A control implemented in month three shows green today and produces an exception for months one and two. The dashboard describes now; the auditor examines then.
2. Scope decided by default
Platforms onboard by connecting what you have. That is not the same as deciding what belongs inside the audit boundary. Teams routinely end up with more in scope than a customer ever asked about, which means more controls, more evidence, and a longer audit for no commercial benefit.
3. The system description nobody owns
Section III of the report describes your system, boundaries and subservice organizations. No tool writes it, and it is where procurement teams look to check the report covers the thing they are buying. A generic description is how a clean opinion still fails to answer the customer's question. See what a SOC 2 audit actually involves.
4. Remediation capacity
The platform tells you MFA is not enforced everywhere. Enforcing it is engineering work, competing with your roadmap. Automation converts an unknown problem into a known one; it does not create the capacity to fix it.
What a consultant adds on top of a tool you keep
Scoping the boundary before onboarding widens it by default. Closing the findings rather than tracking them. Writing the system description so Section III survives a procurement review. Rehearsing the people who will sit interviews. Standing with you through fieldwork so the auditor's questions get answered accurately the first time.
Avantcert readiness engagements run from $7,000 for a 5–50 employee company, around $16,000 at 51–200, and up to $25,000 at 201–500 or complex scope. That sits alongside your subscription and your CPA firm's fee — see the full SOC 2 cost breakdown.
The line neither of us crosses
Your platform cannot issue a SOC 2 report, and neither can we. Only an independent licensed CPA firm can, and the firm that prepares you is not permitted to audit you. Any vendor implying they can take you end to end through the report is describing something that is not a SOC 2 report.
That constraint is worth knowing before you buy anything, from anyone.
FAQs
Does Vanta get you SOC 2 certified?
No. Vanta monitors controls and collects evidence; it does not issue a SOC 2 report. Only an independent licensed CPA firm can do that. Vanta shortens evidence collection, which is real value, but the audit is a separate engagement with a separate firm.
What does Vanta not do for SOC 2?
It does not remediate findings, write your system description, decide your scope, prepare your team for auditor interviews, or represent you during fieldwork. It shows you red checks; closing them is engineering work that still belongs to someone.
Can I use Vanta and a consultant together?
Yes, and it is a common setup. The platform handles continuous evidence collection; the consultant does scoping, remediation, the system description and audit preparation. Avantcert works with whatever tooling you already run rather than asking you to replace it.
Why do companies with Vanta still fail or delay SOC 2?
Usually because a dashboard turning green is not the same as a control operating across the observation window. Type 2 tests samples over months, so a control implemented late leaves a gap the tool shows as resolved but the auditor records as an exception.
Where to go next
Work through the SOC 2 compliance checklist against what your platform reports, read what happens during the audit, or if you are still choosing tooling, compare the done-for-you model. See the full SOC 2 compliance guide for requirements, scope and cost in one place.