Vanta

No entries match these filters. Clear filters

1. 1.0.0 Nov 1, 2026 · issue 127

   API surface changed: +11 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +11 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /vendors/{parentVendorId}/engagement-relationship/{engagementVendorId}
   • + GET /groups/{groupId}/task-requirement-set
   • + GET /task-requirement-sets
   • + GET /task-requirement-sets/custom-requirements
   • + GET /task-requirement-sets/{requirementSetId}
   • + PATCH /task-requirement-sets/custom-requirements/{customRequirementId}
   • + PATCH /task-requirement-sets/{requirementSetId}/details
   • + PATCH /task-requirement-sets/{requirementSetId}/requirements
   • + POST /task-requirement-sets
   • + POST /task-requirement-sets/custom-requirements
   • + PUT /vendors/{parentVendorId}/engagement-relationship/{engagementVendorId}
   • ~ GET /customer-trust/accounts: response schema changed
   • ~ GET /customer-trust/accounts/{accountId}: response schema changed
   • ~ PATCH /customer-trust/accounts/{accountId}: response schema changed
   • ~ PATCH /trust-centers/{slugId}/compliance-frameworks/{frameworkId}: request body changed
   • ~ PATCH /vendors/{vendorId}: request body changed
   • ~ POST /customer-trust/accounts: response schema changed
   • ~ POST /trust-centers/{slugId}/compliance-frameworks: request body changed
   • ~ POST /vendors: request body changed
   • Adds new endpoints DELETE /vendors/{parentVendorId}/engagement-relationship/{engagementVendorId} and PUT /vendors/{parentVendorId}/engagement-relationship/{engagementVendorId}.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new task requirement set endpoints: GET /groups/{groupId}/task-requirement-set, GET /task-requirement-sets, GET /task-requirement-sets/custom-requirements, GET /task-requirement-sets/{requirementSetId}, PATCH /task-requirement-sets/custom-requirements/{customRequirementId}, PATCH /task-requirement-sets/{requirementSetId}/details, PATCH /task-requirement-sets/{requirementSetId}/requirements, POST /task-requirement-sets, and POST /task-requirement-sets/custom-requirements.

   2 details in Everything

2. 1.0.0 Oct 28, 2026 · issue 123

   API surface changed: +2 endpoints, 10 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +2 endpoints, 10 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + POST /frameworks/{frameworkId}/reactivate
   • + POST /frameworks/{frameworkId}/snooze
   • ~ GET /vendor-assessment-types: response schema changed
   • ~ GET /vendor-assessment-types/{assessmentTypeId}: response schema changed
   • ~ GET /vendors: response schema changed
   • ~ GET /vendors/{vendorId}: response schema changed
   • ~ GET /vendors/{vendorId}/assessments: response schema changed
   • ~ GET /vendors/{vendorId}/assessments/{assessmentId}: response schema changed
   • ~ PATCH /vendors/{vendorId}: response schema changed
   • ~ POST /discovered-vendors/{discoveredVendorId}/add-to-managed: response schema changed
   • ~ POST /vendors: response schema changed
   • ~ POST /vendors/{vendorId}/set-status: response schema changed
   • New endpoint POST /frameworks/{frameworkId}/reactivate⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint POST /frameworks/{frameworkId}/snooze

   2 details in Everything

3. 1.0.0 Oct 24, 2026 · issue 119

   API surface changed: +6 endpoints, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +6 endpoints, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /vendor-categories/{categoryId}
   • + GET /vendor-categories
   • + GET /vendor-categories/{categoryId}
   • + PATCH /vendor-categories/{categoryId}
   • + POST /vendor-categories
   • + PUT /frameworks/{frameworkId}/variants
   • ~ GET /frameworks: param includeProgress (query) added; param purchasedOnly (query) added; response schema changed
   • ~ GET /frameworks/{frameworkId}: param includeRequirements (query) added; param requirementsScope (query) added; param variants (query) added; response schema changed
   • ~ PUT /trust-centers/{slugId}/videos: request body changed; response schema changed
   • New endpoint DELETE /vendor-categories/{categoryId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /vendor-categories
   • New endpoint GET /vendor-categories/{categoryId}
   • New endpoint PATCH /vendor-categories/{categoryId}
   • New endpoint POST /vendor-categories

   +3 more show less

   • New endpoint PUT /frameworks/{frameworkId}/variants
   • GET /frameworks: param includeProgress (query) added; param purchasedOnly (query) added
   • GET /frameworks/{frameworkId}: param includeRequirements (query) added; param requirementsScope (query) added; param variants (query) added

   8 details in Everything

4. 1.0.0 Oct 15, 2026 · issue 109

   API surface changed: +13 endpoints, 7 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +13 endpoints, 7 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /frameworks/{frameworkId}
   • + DELETE /risk-scenarios/{riskScenarioId}/mappings/accounts
   • + DELETE /risk-scenarios/{riskScenarioId}/mappings/custom-assets
   • + DELETE /risk-scenarios/{riskScenarioId}/mappings/integrations
   • + DELETE /risk-scenarios/{riskScenarioId}/mappings/issues
   • + GET /risk-scenarios/{riskScenarioId}/mappings/accounts
   • + GET /risk-scenarios/{riskScenarioId}/mappings/custom-assets
   • + GET /risk-scenarios/{riskScenarioId}/mappings/integrations
   • + GET /risk-scenarios/{riskScenarioId}/mappings/issues
   • + POST /risk-scenarios/{riskScenarioId}/mappings/accounts
   • + POST /risk-scenarios/{riskScenarioId}/mappings/custom-assets
   • + POST /risk-scenarios/{riskScenarioId}/mappings/integrations
   • + POST /risk-scenarios/{riskScenarioId}/mappings/issues
   • ~ GET /knowledge-base/answer-library: response schema changed
   • ~ GET /knowledge-base/answer-library/{id}: response schema changed
   • ~ PATCH /knowledge-base/answer-library/{id}: response schema changed
   • ~ PATCH /trust-centers/{slugId}/compliance-frameworks/{frameworkId}: request body changed
   • ~ POST /knowledge-base/answer-library: response schema changed
   • ~ POST /knowledge-base/answer-library/{id}/verify: response schema changed
   • ~ POST /trust-centers/{slugId}/compliance-frameworks: request body changed
   • New endpoint DELETE /frameworks/{frameworkId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new endpoints for managing risk-scenario mappings: DELETE /risk-scenarios/{riskScenarioId}/mappings/accounts, DELETE /risk-scenarios/{riskScenarioId}/mappings/custom-assets, DELETE /risk-scenarios/{riskScenarioId}/mappings/integrations, DELETE /risk-scenarios/{riskScenarioId}/mappings/issues, GET /risk-scenarios/{riskScenarioId}/mappings/accounts, GET /risk-scenarios/{riskScenarioId}/mappings/custom-assets, GET /risk-scenarios/{riskScenarioId}/mappings/integrations, GET /risk-scenarios/{riskScenarioId}/mappings/issues, POST /risk-scenarios/{riskScenarioId}/mappings/accounts, POST /risk-scenarios/{riskScenarioId}/mappings/custom-assets, POST /risk-scenarios/{riskScenarioId}/mappings/integrations, and POST /risk-scenarios/{riskScenarioId}/mappings/issues.

   2 details in Everything

5. 1.0.0 Oct 11, 2026 · issue 102

   API surface changed: +3 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +3 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /groups/{groupId}
   • + GET /custom-assets
   • + GET /risk-scenarios/{riskScenarioId}/mappings/enterprise-risk
   • ~ GET /frameworks: param includeStatus (query) added; response schema changed
   • ~ GET /frameworks/{frameworkId}: param includeStatus (query) added; response schema changed
   • New endpoint DELETE /groups/{groupId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /custom-assets
   • New endpoint GET /risk-scenarios/{riskScenarioId}/mappings/enterprise-risk
   • GET /frameworks: param includeStatus (query) added
   • GET /frameworks/{frameworkId}: param includeStatus (query) added

   5 details in Everything

6. 1.0.0 Sep 25, 2026 · issue 085

   API surface changed: +4 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +4 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /business-units
   • + GET /business-units/{businessUnitId}
   • + GET /program-scopes
   • + GET /program-scopes/{programScopeId}
   • ~ GET /customer-trust/questionnaires/{questionnaireId}/responses: response schema changed
   • ~ GET /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}: response schema changed
   • ~ GET /vendor-risk-attributes: response schema changed
   • ~ PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}: response schema changed
   • ~ PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}/owner: response schema changed
   • ~ PATCH /trust-centers/{slugId}/compliance-frameworks/{frameworkId}: request body changed
   • ~ POST /trust-centers/{slugId}/access-requests/{accessRequestId}/deny: request body changed
   • ~ POST /trust-centers/{slugId}/compliance-frameworks: request body changed
   • New endpoint GET /business-units⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /business-units/{businessUnitId}
   • New endpoint GET /program-scopes
   • New endpoint GET /program-scopes/{programScopeId}

   4 details in Everything

7. 1.0.0 Sep 14, 2026 · issue 074

   Vanta: New endpoint GET /personnel-notification-settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   Vanta: New endpoint GET /personnel-notification-settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /personnel-notification-settings
   • + PATCH /groups/{groupId}
   • + PATCH /personnel-notification-settings
   • ~ GET /controls: response schema changed
   • ~ GET /controls/controls-library: response schema changed
   • ~ GET /controls/deactivated-controls: response schema changed
   • ~ GET /controls/{controlId}: response schema changed
   • ~ GET /documents/{documentId}/controls: response schema changed
   • ~ GET /frameworks/{frameworkId}/controls: response schema changed
   • ~ PATCH /controls/{controlId}: response schema changed
   • ~ PATCH /trust-centers/{slugId}/compliance-frameworks/{frameworkId}: request body changed
   • ~ POST /controls: response schema changed
   • ~ POST /controls/add-from-library: response schema changed
   • ~ POST /controls/{controlId}/add-document-to-control: response schema changed
   • ~ POST /controls/{controlId}/add-test-to-control: response schema changed
   • ~ POST /controls/{controlId}/set-owner: response schema changed
   • ~ POST /trust-centers/{slugId}/compliance-frameworks: request body changed
   • New endpoint PATCH /personnel-notification-settings

   1 detail in Everything

8. 1.0.0 Sep 13, 2026 · issue 073

   API surface changed: +3 endpoints, 14 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +3 endpoints, 14 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /personnel-notification-settings
   • + PATCH /groups/{groupId}
   • + PATCH /personnel-notification-settings
   • ~ GET /controls: response schema changed
   • ~ GET /controls/controls-library: response schema changed
   • ~ GET /controls/deactivated-controls: response schema changed
   • ~ GET /controls/{controlId}: response schema changed
   • ~ GET /documents/{documentId}/controls: response schema changed
   • ~ GET /frameworks/{frameworkId}/controls: response schema changed
   • ~ PATCH /controls/{controlId}: response schema changed
   • ~ PATCH /trust-centers/{slugId}/compliance-frameworks/{frameworkId}: request body changed
   • ~ POST /controls: response schema changed
   • ~ POST /controls/add-from-library: response schema changed
   • ~ POST /controls/{controlId}/add-document-to-control: response schema changed
   • ~ POST /controls/{controlId}/add-test-to-control: response schema changed
   • ~ POST /controls/{controlId}/set-owner: response schema changed
   • ~ POST /trust-centers/{slugId}/compliance-frameworks: request body changed
   • New endpoint PATCH /groups/{groupId}

   1 detail in Everything

9. docs update Sep 12, 2026 · issue 072

   Vanta: Adds framework associations and deactivation reasons for deactivated controls through the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..

   └──▷ HOW TO FIND IT
   Set a wildcard domain auto-approval in Trust Center so all government email domains are approved without manual review.
   📍In the Vanta console, go to Trust Center › Settings › Access Requests, and add *.gov as a wildcard domain auto-approval rule.
   • Adds a Custom Agent trigger for when a risk scenario is created or updated.
   • Adds a Custom Agent event trigger for vendor residual risk score changes.
   • Supports multi-framework audits within a single engagement, with shared evidence reuse and framework-specific assessment preservation.
   • Adds approval workflows for Issues, supporting multi-step approval, validation before closure, change requests, and pending-approval tracking.
   • Introduces agentic onboarding for Questionnaire Automation: upload past questionnaires and files, prepare the Answer Library, identify content gaps, and rerun questionnaires to measure coverage.

   +7 more show less

   • Introduces Agentic Reporting Phase 1: natural-language questions to the Vanta Agent about historical risk and issue data using a SQL Generation Tool.
   • Introduces user-scoped memory in the Vanta Agent so users can add personal context used across their conversations, scoped to the individual.
   • Enables Knowledge Base management, Answer Library content, and tag workflows conversationally in Vanta or through MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-compatible tools, including bulk updates and semantic searches.
   • Adds Trust Center wildcard domain auto-approvals (e.g., *.gov, *.mil) for broad access-request audiences.
   • Enables adding custom controls directly to an audit without creating or uploading an information request list.
   • Adds direct links to newly created objects (frameworks, controls, and others) from Agent import conversations.
   • Allows review of linked information requests, metadata, and shared evidence directly within the Controls drawer.
   • Adds a Custom Agent trigger for when a risk scenario is created or updated.
   • Adds a Custom Agent event trigger for vendor residual risk score changes.
   • Supports multi-framework audits within a single engagement, with shared evidence reuse and framework-specific assessment preservation.
   • Adds approval workflows for Issues, supporting multi-step approval, validation before closure, change requests, and pending-approval tracking.
   • Introduces agentic onboarding for Questionnaire Automation: upload past questionnaires and files, prepare the Answer Library, identify content gaps, and rerun questionnaires to measure coverage.

   +5 more show less

   • Introduces Agentic Reporting Phase 1: natural-language questions to the Vanta Agent about historical risk and issue data using a SQL Generation Tool.
   • Introduces user-scoped memory in the Vanta Agent so users can add personal context used across their conversations, scoped to the individual.
   • Adds Trust Center wildcard domain auto-approvals (e.g., *.gov, *.mil) for broad access-request audiences.
   • Enables adding custom controls directly to an audit without creating or uploading an information request list.
   • Allows review of linked information requests, metadata, and shared evidence directly within the Controls drawer.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. now provisions AuthUsers and manages Vanta access only; Personnel records are no longer provisioned through SCIM and must instead be provisioned through the connected identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
10. docs update Sep 12, 2026 · issue 072

    Vanta: Adds a Custom Agent event trigger for vendor residual risk score changes, improving responsiveness to shifts in vendor risk posture

    └──▷ HOW TO FIND IT
    Trigger a Custom Agent workflow the moment a vendor's residual risk score changes, so downstream Jira tickets or notifications fire automatically.
    📍In Custom Agents, create a new workflow and set the event trigger to Vendor Residual Risk Score Change, then configure the desired actions (e.g., create Jira ticket, send notification).
    Auto-approve Trust Center access requests from all government email addresses without manual review.
    📍In Trust Center settings, add a wildcard domain auto-approval rule for *.gov and *.mil under Auto-approve by domain.
    • Adds Inherent Risk Scoring by Factor, letting users break Impact and Likelihood into configurable factors, score each independently, and view breakdowns in risk details, auditor views, and CSV exports (Professional)
    • Adds Personnel Agent Tools so users can create personnel groups, manage membership, import identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups, and view or update reminder settings through the Vanta Agent (Enterprise)
    • Adds Knowledge Base management tools in the Vanta Agent and via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., including bulk updates, semantic searches, Answer Library content management, and tagging workflows (Essentials, Plus, Professional, Enterprise)
    • Adds Personnel Agent Tools so users can create personnel groups, manage membership, import identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups, and view or update reminder settings through the Vanta Agent (Enterprise)

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. no longer manages Personnel records — Personnel is now provisioned exclusively through the connected identity provider, not through SCIM.
11. 1.0.0 Sep 11, 2026 · issue 071

    Vanta: New endpoint GET /personnel-notification-settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    Vanta: New endpoint GET /personnel-notification-settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + GET /personnel-notification-settings
    • + PATCH /groups/{groupId}
    • + PATCH /personnel-notification-settings
    • New endpoint PATCH /personnel-notification-settings

    1 detail in Everything

12. 1.0.0 Sep 10, 2026 · issue 070

    API surface changed: +1 endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: +1 endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + PATCH /groups/{groupId}
    • New endpoint PATCH /groups/{groupId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

13. docs update Sep 10, 2026 · issue 070

    Vanta adds CLI, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server access for non-admins, multi-framework audits, TISAX ISA 2027TISAX ISA 2027A standardized automotive-industry information-security assessment catalog maintained by ENX Association, used by suppliers to prove their data-protection practices meet OEM requirements without repeated individual audits., and dozens of agent and API expansions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Trigger a reassessment reminder workflow at key vendor due-date milestones so vendors are re-evaluated before they lapse
    📍In the Vanta Custom Agents builder, set the event trigger to Vendor Assessment Due Date Milestone and select milestones: 30 days, 20 days, 10 days, or overdue.
    Automatically approve Trust Center access requests from government email domains without manual review
    📍In Trust Center settings, add a wildcard domain auto-approval rule for *.gov or *.mil to grant access automatically to matching requesters.
    • Expands the Deactivated Controls REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to include framework associations and deactivation reasons for deactivated controls, making it easier to validate control scope and review deactivation decisions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces the Vanta CLI for scripting and managing trust programs from the terminal or a coding agent, with built-in skills for risk scenarios, controls, testing procedures, and reporting
    • Opens Vanta's MCP server to users with editor, collaborator, or custom-role permissions, scoped to their existing permission set
    • Adds Trust Center wildcard domain auto-approvals (e.g. *.gov, *.mil) to automatically approve access requests from matching email domains (Essentials, Plus, Professional)
    • Adds a Custom Agents event trigger for Risks Created & Updated to fire workflows when a risk scenario is created or updated (Professional)

    +39 more show less

    • Adds a Custom Agents event trigger for New Knowledge Base Document to fire workflows automatically when a new document is added to a Knowledge Base
    • Adds a Custom Agents event trigger for Vendor Residual Risk Score Change to fire downstream workflows when a vendor's residual risk score changes
    • Adds a Custom Agents event trigger for Vendor Assessment Due Date Milestone at 30 days, 20 days, 10 days, and overdue
    • Introduces slash commands to invoke reusable Vanta Agent skills explicitly in full-page, side-panel, and Custom Agent experiences
    • Introduces Custom Agent Templates allowing one-click workflow creation from curated templates with adjustable schedules and event triggers
    • Adds user-scoped memory to the Vanta Agent so personal context persists across conversations without sharing with other users
    • Introduces Agentic Reporting Phase 1 with a SQL Generation Tool for natural-language queries over historical risk and issue data (Plus, Professional, Enterprise)
    • Adds Agent Read Tools for Continuous Monitoring, enabling questions to the Vanta Agent about vendor findings, alerts, incidents, breaches, and common vulnerabilities (Enterprise)
    • Introduces Agentic Onboarding for Questionnaire Automation, allowing users to upload past questionnaires, prepare an Answer Library via the Vanta Agent, identify content gaps, and measure coverage (Essentials, Plus, Professional, Enterprise)
    • Introduces TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Agentic Onboarding to upload vendor lists, map fields, configure inherent risk scoring, and import vendors with metadata
    • Introduces Agentic Answer Library Import where the Vanta Agent detects question-and-answer pairs, applies tags, and supports inline bulk approval or rejection (Essentials, Plus, Professional)
    • Adds QAuto answer generation from past CSV and Excel questionnaires uploaded to the Knowledge Base, without requiring prior Answer Library curation (Plus, Professional)
    • Adds Agentic Ticketing so users can ask the Vanta Agent to create and link Jira tickets across Documents, Tests, and Risk Scenarios
    • Adds Agent-led Custom Commitment Type Creation, allowing users to ask the Vanta Agent to draft new commitment type definitions with relevant contract examples
    • Adds Personnel Agent Tools for group lifecycle and reminder settings, including creating personnel groups, managing membership, importing identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups, and updating reminder settings (Enterprise)
    • Introduces a Personnel SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Guide in the Vanta Agent covering identity provider imports, personnel groups, task assignments, reminders, and blocker diagnosis
    • Adds Knowledge Base management tools with MCP parity, including bulk updates, semantic searches, Answer Library and tag management conversationally or through MCP-compatible tools (Essentials, Plus, Professional, Enterprise)
    • Adds Direct Links to Newly Created Objects in the Agent import flow so frameworks, controls, and other objects can be opened directly from the Agent conversation (Essentials, Plus, Professional)
    • Introduces Inherent Risk Scoring by Factor, breaking Impact and Likelihood into configurable factors scored independently, with breakdowns visible in risk details, auditor views, and CSV exports (Professional)
    • Adds Approval Workflows for Issues with multi-step approvals, validation before closure, change requests, and tracking through notifications and task views (Enterprise, Professional)
    • Adds Document Scoping (Private Preview) to split a document requirement into groups scoped to different business units (Professional)
    • Adds Vanta Agent tools to create, update, and delete risk categories and custom fields through natural-language requests (Professional)
    • Introduces Multi-framework Audits to prepare audits for multiple compliance frameworks in a single engagement, reusing shared evidence and preserving framework-specific assessments (Enterprise, Essentials, Plus, Professional)
    • Adds the ability to start audits by adding custom controls directly without creating or uploading an information request list (Enterprise, Professional)
    • Adds Azure Database Flexible Server test coverage evaluating high availability, backup resilience, encryption in transit, network exposure, and diagnostic logging
    • Adds TISAX ISA 2027 framework support with revised assessment-level variants, updated controls, and remapped evidence
    • Adds C5-specific security awareness training with employee completion tracking in Vanta
    • Introduces the Framework Overview Page redesign with readiness, certification timelines, and common questions accessible from a single page, with contextual Vanta Agent access (Essentials, Plus, Professional)
    • Upgrades Microsoft Intune integration through Integration Builder with detailed resource schemas, sync history, error guidance, Agent-assisted setup, and expanded data coverage (Essentials, Plus, Professional, Enterprise)
    • Adds Link Vendor Findings to Risk Register, including findings from Continuous Monitoring
    • Adds View IR Details Inside Controls Drawer to review linked information requests, metadata, and shared evidence without leaving the control context (Enterprise, Professional)
    • Adds ability to delete document evidence from vendor assessments to correct upload errors and keep documentation accurate
    • Adds AI-generated answer suggestions for single-select and multi-select assessment question types
    • Adds Vanta Agent background completions so long-running tasks continue while navigating away, with in-progress conversation indicators
    • Adds wildcard domain auto-approvals for Trust Center access requests (e.g. *.gov, *.mil) (Essentials, Plus, Professional)
    • Changes SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. to provision AuthUsers and manage Vanta access only, while Personnel records are provisioned through the connected identity provider
    • Adds sorting documents by owner in the Documents Tab, combinable with existing filters
    • Persists Risk Register search terms in the URL for easy navigation back to filtered results (Enterprise)
    • Adds Revamped SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 Guide Home Page consolidating recommended next steps, SOC 2 progress, outstanding items, audit details, and the full compliance journey (Essentials)
    • Expands the Deactivated Controls REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to include framework associations and deactivation reasons for deactivated controls, making it easier to validate control scope and review deactivation decisions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces the Vanta CLI for scripting and managing trust programs from the terminal or a coding agent, with built-in skills for risk scenarios, controls, testing procedures, and reporting
    • Adds Trust Center wildcard domain auto-approvals (e.g. *.gov, *.mil) to automatically approve access requests from matching email domains (Essentials, Plus, Professional)
    • Adds a Custom Agents event trigger for Risks Created & Updated to fire workflows when a risk scenario is created or updated (Professional)
    • Adds a Custom Agents event trigger for New Knowledge Base Document to fire workflows automatically when a new document is added to a Knowledge Base

    +29 more show less

    • Adds a Custom Agents event trigger for Vendor Residual Risk Score Change to fire downstream workflows when a vendor's residual risk score changes
    • Adds a Custom Agents event trigger for Vendor Assessment Due Date Milestone at 30 days, 20 days, 10 days, and overdue
    • Introduces slash commands to invoke reusable Vanta Agent skills explicitly in full-page, side-panel, and Custom Agent experiences
    • Introduces Custom Agent Templates allowing one-click workflow creation from curated templates with adjustable schedules and event triggers
    • Adds user-scoped memory to the Vanta Agent so personal context persists across conversations without sharing with other users
    • Introduces Agentic Reporting Phase 1 with a SQL Generation Tool for natural-language queries over historical risk and issue data (Plus, Professional, Enterprise)
    • Adds Agent Read Tools for Continuous Monitoring, enabling questions to the Vanta Agent about vendor findings, alerts, incidents, breaches, and common vulnerabilities (Enterprise)
    • Introduces Agentic Onboarding for Questionnaire Automation, allowing users to upload past questionnaires, prepare an Answer Library via the Vanta Agent, identify content gaps, and measure coverage (Essentials, Plus, Professional, Enterprise)
    • Introduces TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Agentic Onboarding to upload vendor lists, map fields, configure inherent risk scoring, and import vendors with metadata
    • Introduces Agentic Answer Library Import where the Vanta Agent detects question-and-answer pairs, applies tags, and supports inline bulk approval or rejection (Essentials, Plus, Professional)
    • Adds QAuto answer generation from past CSV and Excel questionnaires uploaded to the Knowledge Base, without requiring prior Answer Library curation (Plus, Professional)
    • Adds Agentic Ticketing so users can ask the Vanta Agent to create and link Jira tickets across Documents, Tests, and Risk Scenarios
    • Adds Agent-led Custom Commitment Type Creation, allowing users to ask the Vanta Agent to draft new commitment type definitions with relevant contract examples
    • Adds Personnel Agent Tools for group lifecycle and reminder settings, including creating personnel groups, managing membership, importing identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups, and updating reminder settings (Enterprise)
    • Introduces a Personnel SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Guide in the Vanta Agent covering identity provider imports, personnel groups, task assignments, reminders, and blocker diagnosis
    • Introduces Inherent Risk Scoring by Factor, breaking Impact and Likelihood into configurable factors scored independently, with breakdowns visible in risk details, auditor views, and CSV exports (Professional)
    • Adds Approval Workflows for Issues with multi-step approvals, validation before closure, change requests, and tracking through notifications and task views (Enterprise, Professional)
    • Adds Document Scoping (Private Preview) to split a document requirement into groups scoped to different business units (Professional)
    • Adds Vanta Agent tools to create, update, and delete risk categories and custom fields through natural-language requests (Professional)
    • Introduces Multi-framework Audits to prepare audits for multiple compliance frameworks in a single engagement, reusing shared evidence and preserving framework-specific assessments (Enterprise, Essentials, Plus, Professional)
    • Adds the ability to start audits by adding custom controls directly without creating or uploading an information request list (Enterprise, Professional)
    • Adds Azure Database Flexible Server test coverage evaluating high availability, backup resilience, encryption in transit, network exposure, and diagnostic logging
    • Adds TISAX ISA 2027 framework support with revised assessment-level variants, updated controls, and remapped evidence
    • Adds C5-specific security awareness training with employee completion tracking in Vanta
    • Adds Link Vendor Findings to Risk Register, including findings from Continuous Monitoring
    • Adds View IR Details Inside Controls Drawer to review linked information requests, metadata, and shared evidence without leaving the control context (Enterprise, Professional)
    • Adds ability to delete document evidence from vendor assessments to correct upload errors and keep documentation accurate
    • Adds Vanta Agent background completions so long-running tasks continue while navigating away, with in-progress conversation indicators
    • Adds wildcard domain auto-approvals for Trust Center access requests (e.g. *.gov, *.mil) (Essentials, Plus, Professional)

    10 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !SCIM now provisions AuthUsers and manages Vanta access only — Personnel records are no longer provisioned through SCIM and must instead be provisioned through the connected identity provider.
14. docs update Sep 10, 2026 · issue 070

    Vanta: Exposes GitLab repository paths, project IDs, and URLs through the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., enabling automation across Vanta and GitLab project catalogs (Enterprise).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Automate a risk-response workflow whenever a new or updated risk scenario requires stakeholder notification or ticket creation.
    📍In Custom Agents, create a new agent, select Risks Created & Updated as the Event Trigger, define the workflow steps (e.g., notify a Slack channel or create a Jira ticket), and save.
    Automatically grant Trust Center access to all government email domains without manual review per request.
    📍In Trust Center settings, navigate to Access Requests › Auto-Approvals, add wildcard domain rules such as *.gov and *.mil, and save.
    • Adds framework associations and deactivation reasons for deactivated controls through the REST API, making it easier to validate control scope and review deactivation decisions.
    • Extends MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server access to users with editor, collaborator, or custom-role permissions, allowing them to connect and use capabilities permitted by their existing role.
    • Adds Custom Agents event trigger for when a risk scenario is created or updated, enabling automated workflows on risk changes (Professional).
    • Adds Custom Agents event trigger for when a new document is added to a Knowledge Base, enabling automated workflows on document creation.
    • Adds Custom Agent templates so users can choose curated workflows, create them with one click, and adjust the schedule or event trigger before saving.

    +14 more show less

    • Introduces wildcard domain auto-approvals for Trust Center, allowing access requests from matching email domains such as *.gov or *.mil to be approved automatically (Essentials, Plus, Professional).
    • Introduces inherent risk scoring by factor, allowing Impact and Likelihood to be broken into configurable sub-factors scored independently, with breakdowns visible in risk details, auditor views, and CSV exports (Professional).
    • Adds personnel group lifecycle and reminder-settings management directly through the Vanta Agent, including group creation, membership management, and identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. group imports (Enterprise).
    • Adds Agentic Onboarding for Questionnaire Automation, letting users upload past questionnaires and files, prepare their Answer Library, identify content gaps, and measure coverage improvements (Essentials, Plus, Professional, Enterprise).
    • Introduces Agentic Ticketing, enabling users to create and link Jira tickets across Documents, Tests, and Risk Scenarios through the Vanta Agent.
    • Adds Agentic Reporting Phase 1 with a SQL Generation Tool covering risk and issue data, letting users ask natural-language questions about historical compliance program changes (Plus, Professional, Enterprise).
    • Introduces TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Agentic Onboarding, letting users upload an existing vendor list to the Vanta Agent, map vendor data to standard or custom fields, configure inherent risk scoring, and import vendors.
    • Introduces Agentic Answer Library Import, letting users import Answer Library content via the Vanta Agent with automatic question-and-answer detection, tag application, and bulk approval or rejection (Essentials, Plus, Professional).
    • Adds QAuto answer generation from past questionnaires, letting users upload CSV and Excel questionnaires to the Knowledge Base and generate answers without first importing each into the Answer Library (Plus, Professional).
    • Adds Vanta Agent background completions, allowing long-running Agent tasks to continue while the user navigates away, switches tabs, or refreshes, with results available on return.
    • Adds ability to link vendor-level findings, including those from Continuous Monitoring, directly to risks in the risk register.
    • Enables deletion of document evidence from vendor assessments to correct upload errors in vendor exchange.
    • Redesigns the Framework Overview page to surface requirements, readiness, certification timelines, and common questions with contextual access to the Vanta Agent (Essentials, Plus, Professional).
    • Adds information request details, metadata, and shared evidence directly within the Controls drawer, including the ability to share or remove evidence without leaving the control context (Enterprise, Professional).
    • Adds Custom Agents event trigger for when a risk scenario is created or updated, enabling automated workflows on risk changes (Professional).
    • Adds Custom Agents event trigger for when a new document is added to a Knowledge Base, enabling automated workflows on document creation.
    • Adds Custom Agent templates so users can choose curated workflows, create them with one click, and adjust the schedule or event trigger before saving.
    • Introduces wildcard domain auto-approvals for Trust Center, allowing access requests from matching email domains such as *.gov or *.mil to be approved automatically (Essentials, Plus, Professional).
    • Introduces inherent risk scoring by factor, allowing Impact and Likelihood to be broken into configurable sub-factors scored independently, with breakdowns visible in risk details, auditor views, and CSV exports (Professional).

    +10 more show less

    • Adds personnel group lifecycle and reminder-settings management directly through the Vanta Agent, including group creation, membership management, and identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. group imports (Enterprise).
    • Adds Agentic Onboarding for Questionnaire Automation, letting users upload past questionnaires and files, prepare their Answer Library, identify content gaps, and measure coverage improvements (Essentials, Plus, Professional, Enterprise).
    • Introduces Agentic Ticketing, enabling users to create and link Jira tickets across Documents, Tests, and Risk Scenarios through the Vanta Agent.
    • Adds Agentic Reporting Phase 1 with a SQL Generation Tool covering risk and issue data, letting users ask natural-language questions about historical compliance program changes (Plus, Professional, Enterprise).
    • Introduces TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Agentic Onboarding, letting users upload an existing vendor list to the Vanta Agent, map vendor data to standard or custom fields, configure inherent risk scoring, and import vendors.
    • Introduces Agentic Answer Library Import, letting users import Answer Library content via the Vanta Agent with automatic question-and-answer detection, tag application, and bulk approval or rejection (Essentials, Plus, Professional).
    • Adds QAuto answer generation from past questionnaires, letting users upload CSV and Excel questionnaires to the Knowledge Base and generate answers without first importing each into the Answer Library (Plus, Professional).
    • Adds Vanta Agent background completions, allowing long-running Agent tasks to continue while the user navigates away, switches tabs, or refreshes, with results available on return.
    • Adds ability to link vendor-level findings, including those from Continuous Monitoring, directly to risks in the risk register.
    • Enables deletion of document evidence from vendor assessments to correct upload errors in vendor exchange.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. no longer manages Personnel records — Personnel records are now provisioned exclusively through the connected identity provider, not through SCIM.
15. 1.0.0 Sep 4, 2026 · issue 064

    API surface changed: 9 modified

    API change

    API surface changed: 9 modified

    • ~ GET /controls/controls-library: response schema changed
    • ~ GET /controls/deactivated-controls: response schema changed
    • ~ GET /customer-trust/questionnaires/{questionnaireId}: response schema changed
    • ~ GET /trust-centers/{slugId}/compliance-frameworks: response schema changed
    • ~ PATCH /customer-trust/questionnaires/{questionnaireId}: response schema changed
    • ~ POST /customer-trust/questionnaires/file: response schema changed
    • ~ POST /customer-trust/questionnaires/website: response schema changed
    • ~ POST /customer-trust/questionnaires/{questionnaireId}/approve: response schema changed
    • ~ POST /customer-trust/questionnaires/{questionnaireId}/complete: response schema changed
    • GET /controls/controls-library: response schema changed
    • GET /controls/deactivated-controls: response schema changed
    • GET /customer-trust/questionnaires/{questionnaireId}: response schema changed
    • GET /trust-centers/{slugId}/compliance-frameworks: response schema changed
    • PATCH /customer-trust/questionnaires/{questionnaireId}: response schema changed

    +4 more show less

    • POST /customer-trust/questionnaires/file: response schema changed
    • POST /customer-trust/questionnaires/website: response schema changed
    • POST /customer-trust/questionnaires/{questionnaireId}/approve: response schema changed
    • POST /customer-trust/questionnaires/{questionnaireId}/complete: response schema changed

    9 details in Everything

16. Vanta Week of August 30, 2026 Week of Aug 30, 2026 · release notes

    New Vanta Agent personnel group lifecycle controls, Custom Agent risk triggers, document scoping for requirements, expanded Intune sync via Integration Builder, and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.

    • Adds Personnel Agent Tools: Group Lifecycle and Reminder Settings to create groups, manage membership, import IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups, and update reminder settings in the Vanta Agent
    • Adds Custom Agents trigger on risk scenarios with new event types Risks Created and Risks Updated for workflow automation
    • Introduces Document Scoping Private Preview to split document requirements into business-unit scoped groups
    • Provides Revamped SOC 2 Guide Home Page command center showing recommended next steps, progress, outstanding items, and audit details
    • Upgrades Microsoft Intune integration with detailed resource schemas, sync history, error guidance, Agent-assisted setup, and expanded data coverage via Integration Builder

    +2 more show less

    • Adds framework associations and deactivation reasons to the REST API response for deactivated controls
    • Enables faster control export for large domains with reduced timeout and crash rates

    7 details in Everything

17. 1.0.0 Aug 28, 2026 · issue 058

    API surface changed: +9 endpoints, 10 modified

    API change

    API surface changed: +9 endpoints, 10 modified

    • + DELETE /customer-trust/tag-categories/{tagCategoryId}/product-contexts/{productContextId}
    • + GET /customer-trust/questionnaires/{questionnaireId}/responses
    • + GET /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}
    • + GET /groups/importable-idp-groups
    • + PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}
    • + PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}/owner
    • + POST /customer-trust/tag-categories/{tagCategoryId}/product-contexts
    • + POST /groups
    • + POST /groups/import-from-idp
    • ~ GET /customer-trust/questionnaires/{questionnaireId}: response schema changed
    • ~ GET /groups: response schema changed
    • ~ GET /groups/{groupId}: response schema changed
    • ~ PATCH /customer-trust/questionnaires/{questionnaireId}: response schema changed
    • ~ PATCH /trust-centers/{slugId}/compliance-frameworks/{frameworkId}: request body changed
    • ~ POST /customer-trust/questionnaires/file: response schema changed
    • ~ POST /customer-trust/questionnaires/website: response schema changed
    • ~ POST /customer-trust/questionnaires/{questionnaireId}/approve: response schema changed
    • ~ POST /customer-trust/questionnaires/{questionnaireId}/complete: response schema changed
    • ~ POST /trust-centers/{slugId}/compliance-frameworks: request body changed
    • New endpoint DELETE /customer-trust/tag-categories/{tagCategoryId}/product-contexts/{productContextId}
    • New endpoint GET /customer-trust/questionnaires/{questionnaireId}/responses
    • New endpoint GET /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}
    • New endpoint GET /groups/importable-idp-groups
    • New endpoint PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}

    +14 more show less

    • New endpoint PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}/owner
    • New endpoint POST /customer-trust/tag-categories/{tagCategoryId}/product-contexts
    • New endpoint POST /groups
    • New endpoint POST /groups/import-from-idp
    • GET /customer-trust/questionnaires/{questionnaireId}: response schema changed
    • GET /groups: response schema changed
    • GET /groups/{groupId}: response schema changed
    • PATCH /customer-trust/questionnaires/{questionnaireId}: response schema changed
    • PATCH /trust-centers/{slugId}/compliance-frameworks/{frameworkId}: request body changed
    • POST /customer-trust/questionnaires/file: response schema changed
    • POST /customer-trust/questionnaires/website: response schema changed
    • POST /customer-trust/questionnaires/{questionnaireId}/approve: response schema changed
    • POST /customer-trust/questionnaires/{questionnaireId}/complete: response schema changed
    • POST /trust-centers/{slugId}/compliance-frameworks: request body changed

    19 details in Everything

18. Vanta Week of August 23, 2026 Week of Aug 23, 2026 · release notes

    New Vanta CLI for scripting, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server access, agent slash commands, and AI-driven risk/ticket automation.

    • Adds Vanta CLI for scripting trust programs from the terminal with built-in skills for risk scenarios, controls, testing procedures, and reporting
    • MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for Non-Admins allows users with editor, collaborator, or custom-role permissions to connect to Vanta’s MCP server using existing permissions
    • Adds Slash Commands for the Vanta Agent in full-page, side-panel, and Custom Agent experiences to invoke reusable skills explicitly
    • Supports AI-generated answer suggestions for single-select and multi-select assessment questions
    • Enables multi-step approval workflows for Issues with validation before closure and pending approval tracking

    +3 more show less

    • Adds Vanta Agent support for risk custom fields and categories via natural-language requests (Professional package)
    • Introduces Agentic Ticketing to create and link Jira tickets across Documents, Tests, and Risk Scenarios using the Vanta Agent
    • Exposes GitLab repository paths, project IDs, and URLs via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for automation with GitLab project catalogs (Enterprise package)

    8 details in Everything

19. Vanta Week of August 16, 2026 Week of Aug 16, 2026 · release notes

    Enhanced Vanta Agent capabilities include creating custom commitments, querying risk data with SQL generation, and triggering actions on vendor milestones. Improved UI consistency across agent pages and easier audit setup via direct control addition.

    • Users can now navigate Vanta Agent, Custom Agent, and related agent pages through a consistent layout with shared navigation, headers, tabs, and breadcrumbs. Packages: Enterprise, Essentials, Plus, Professional
    • Users now benefit from automated, policy-checked deletion of churned domain data, with each step recorded for traceability.
    • Users can now add custom controls directly to an audit without creating or uploading an information request list, helping them define the right audit scope from the beginning. Packages: Enterprise, Professional
    • Users can now link vendor-level findings, including findings from Continuous Monitoring, directly to risks in the risk register.
    • Users can now return to the risk register with their previous search terms preserved, making it easier to continue reviewing filtered results. Packages: Enterprise

    +6 more show less

    • Users can now add personal context that the Vanta Agent uses in their conversations, while keeping that memory scoped to the individual user.
    • Users can now open newly created frameworks, controls, and other objects directly from the Agent conversation, making it easier to verify imported content. Packages: Essentials, Plus, Professional
    • Users can now import hundreds of controls in a single pass with one approval, avoiding repeated approval requests and reducing import errors. Packages: Essentials, Plus, Professional, Enterprise
    • Users can now ask the Vanta Agent to create custom commitment types by providing a name, with the Agent drafting the definition and finding relevant examples in their contracts.
    • Users can now ask Vanta Agent natural-language questions about historical risk and issue data, helping them understand how their compliance program has changed over time. Packages: Plus, Professional, Enterprise
    • Users can now manage Knowledge Base resources, Answer Library content, and tags conversationally in Vanta or through MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-compatible tools, including bulk updates, semantic searches, and organization workflows. Packages: Essentials, Plus, Professional, Enterprise

    11 details in Everything

20. Vanta Week of August 9, 2026 Week of Aug 9, 2026 · release notes

    Vanta adds TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Agentic Onloading, Answer Library import, and improved UI for IR details and background tasks.

    • Adds Vanta Agent for TPRM Agentic Onboarding to upload vendor lists, map fields, configure risk scoring, and import vendors
    • Adds Vanta Agent capability to import Answer Library content with automated detection of Q&A pairs and tag application
    • Improves onboarding by allowing users to resume compliance program imports via prefilled prompts and automatic upload opening
    • Adds ability for Vanta Agent tasks to run in the background while navigating away, switching tabs, or refreshing pages
    • Adds IR details viewing inside the Controls drawer, including linked info requests, metadata, evidence sharing, and removal

    5 details in Everything

21. 1.0.0 Aug 8, 2026 · issue 039

    API surface changed: 11 modified

    API change

    API surface changed: 11 modified

    • ~ GET /trust-centers/{slugId}: response schema changed
    • ~ GET /trust-centers/{slugId}/control-categories: response schema changed
    • ~ GET /trust-centers/{slugId}/control-categories/{categoryId}: response schema changed
    • ~ GET /trust-centers/{slugId}/controls/{controlId}: response schema changed
    • ~ PATCH /trust-centers/{slugId}: request body changed; response schema changed
    • ~ PATCH /trust-centers/{slugId}/control-categories/{categoryId}: request body changed; response schema changed
    • ~ PATCH /trust-centers/{slugId}/control-categories/{categoryId}/controls: response schema changed
    • ~ POST /trust-centers/{slugId}/control-categories: response schema changed
    • ~ POST /trust-centers/{slugId}/controls: response schema changed
    • ~ PUT /trust-centers/{slugId}/control-categories/order: response schema changed
    • ~ PUT /trust-centers/{slugId}/control-categories/{categoryId}/controls/order: response schema changed
    • GET /trust-centers/{slugId}: response schema changed
    • GET /trust-centers/{slugId}/control-categories: response schema changed
    • GET /trust-centers/{slugId}/control-categories/{categoryId}: response schema changed
    • GET /trust-centers/{slugId}/controls/{controlId}: response schema changed
    • PATCH /trust-centers/{slugId}: request body changed; response schema changed

    +6 more show less

    • PATCH /trust-centers/{slugId}/control-categories/{categoryId}: request body changed; response schema changed
    • PATCH /trust-centers/{slugId}/control-categories/{categoryId}/controls: response schema changed
    • POST /trust-centers/{slugId}/control-categories: response schema changed
    • POST /trust-centers/{slugId}/controls: response schema changed
    • PUT /trust-centers/{slugId}/control-categories/order: response schema changed
    • PUT /trust-centers/{slugId}/control-categories/{categoryId}/controls/order: response schema changed

    11 details in Everything

22. 1.0.0 seen Aug 4, 2026 · issue 035

    API surface changed: 1 deprecated

    API change

    API surface changed: 1 deprecated

    • ⚠ GET /controls/controls-library
    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint GET /controls/controls-library (still works)
23. Vanta Week of August 2, 2026 Week of Aug 2, 2026 · release notes

    Vanta adds Wildcard Trust Center approvals, QAuto multi-language support, C5 framework, and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. scope reduction.

    • Trust Center: *.gov and *.mil wildcard domain auto-approvals
    • QAuto: Generate answers from past CSV/Excel questionnaires in the Knowledge Base
    • SCIM now manages Vanta access only (Personnel via IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.)
    • Dark mode GA follows system theme, enabled by default for Dark mode systems
    • Vulnerabilities No Limits Q3: Manage up to 30M vulnerabilities total and 1M per asset

    +12 more show less

    • Framework Q&A pills on framework detail pages open Vanta Agent conversations
    • Trust Center control access gating via tag-based controls with separate status visibility
    • QAuto On hold and No longer needed questionnaire statuses
    • Eliminate Hybrid Storage: retain policy content ownership, filter inactive policies
    • Auto-generate Privacy Data Inventory Activities from existing vendor details
    • Aggregated Test and Control Statuses across segments using worst-case status
    • Inherent risk scoring by configurable dimensions (financial, operational, brand impact)
    • Asset Context & Role Classification within findings and alerts
    • New Framework: C5 (BSI C5:2026) with prebuilt criteria and evidence mappings
    • QAuto answer questionnaires across 50 languages
    • Editable Canvas for Policies on SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Guide with WYSIWYG toolbar
    • Seamless deprovisioning in Offboarding workflow

    17 details in Everything

24. Vanta Week of July 26, 2026 Week of Jul 26, 2026 · release notes

    Vanta adds agent-led screenshots, Tailscale offboarding, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. variants, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27701, and Smartsheet rebuild to its compliance toolchain

    • Adds Agentic screenshot collection via Vanta Agent to capture evidence from settings and public websites before upload.
    • Introduces automatic Tailscale account deprovisioning during personnel offboarding workflows to free seats and prevent auth.
    • Enables contract analysis against live GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. programs to identify uncovered commitments and prioritize follow-ups.
    • Adds 20 additional out-of-the-box commitment types for automatic classification and tracking of customer contract obligations.
    • Provides a redesigned Connected Integrations Page with improved filtering, search, and sorting for integration health review.

    +24 more show less

    • Launches SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Guide: Risk Module with agent-guided workflows for risk registers, scenario recommendations, and treatment plans.
    • Adds Semgrep Integration for automated vulnerability data ingestion into Vanta for unified security issue views.
    • Enables Slack notifications via direct message for Custom Agent runs requiring approval.
    • Adds TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Continuous Monitoring: Asset Context to display affected URLs, domains, IPs with active/resolved asset distinctions.
    • Introduces Process Studio: SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 System Description generation in a guided workspace with pre-filled company info and DOCX output.
    • Supports ISO 27701:2025 as a first-class framework with guided upgrades, automated mappings, and program variants.
    • Allows selection of GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. variants, including EU-US Data Privacy Framework requirements, to scope appropriate controls.
    • Updates UK Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. framework to v3.3 with revised scoping guidance for cloud, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., and software development.
    • Adds Framework Version Manager 3.1 for drafting framework changes and reviewing impacts before publishing live.
    • Exposes CrowdStrike Last Seen timestamps and power states for monitored resources to distinguish offline vs. removed assets.
    • Consolidates Policy Editing Tools into a single Vanta Agent skill for unified policy editing experience.
    • Adds CrowdStrike SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Integration for ingesting Falcon Next-Gen SIEM detections as Security Alerts with SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. tracking.
    • Enables natural language queries to the Vanta Agent about integration resources, fields, permissions, and setup requirements.
    • Exposes lastLoginTime data for Entra and Google Workspace synced users to identify stale privileged accounts.
    • Improves AI control-to-evidence mapping suggestion quality for custom controls via the Vanta Agent.
    • Auto-opens Canvas during agent-led compliance program imports when reviewable content is available.
    • Rebuilds Smartsheet integration powered by Integration Builder with detailed schemas, sync history, and Agent-assisted setup.
    • Adds Risk to Asset Mapping Suggestions via Vanta Agent for linking risks to assets and browsing risk libraries.
    • Launches SOC 2 Guide: Policy Module with agent-guided workflows for the 15 required policies.
    • Adds Salesforce integration for continuous contract ingestion with source objects, filters, and daily synchronization.
    • Enables Bulk Export of Audit Information Request List and Evidence as a structured ZIP file with metadata and comments.
    • Enhances Vanta Agent capabilities to view enterprise risks, risk-scenario relationships, Action Tracker tasks, and libraries.
    • Adds contextual integration guidance within the connection flow via Vanta Agent for setup, diagnosis, and remediation.
    • Pulls Vendor and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application data from Torii into Vanta to create a complete audit-ready vendor inventory.

    29 details in Everything

25. Vanta Week of July 19, 2026 Week of Jul 19, 2026 · release notes

    Vanta adds Gov Cloud Jira sync, DSAR portal, custom agent API, policy generation MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool and more.

    • Adds generatePolicy MCP tool for automated policy text generation
    • New public API fields for AWS, CrowdStrike, and JumpCloud resources
    • Adds Data Subject Request Management via configurable intake portal
    • Creates Custom Agents runnable on schedule or demand via dashboard
    • Adds Jira for Government integration with FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. support

    5 details in Everything

26. docs update seen Jul 18, 2026 · issue 019

    Vanta adds control assessments in audits, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support for Commitments, Issues API, 764 FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Rev 5 automated tests, dark mode, and 20+ more capabilities.

    • Enables auditors to formally assess controls in Vanta for IRL audits, assigning framework-specific statuses (Conforming/Non-conformity for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.; Satisfied/Not Satisfied for FedRAMP) with mandatory justification comments.
    • Adds an Internal Auditor Role, letting an internal employee take on an auditor-scoped view of IRL, request tracker, and population views without requiring an external audit firm.
    • Introduces Custom Commitment Types, allowing users to define named commitment types with definitions and example clauses; Vanta retroactively extracts them from all previously uploaded contracts.
    • Adds Commitments MCP Support so users can query Customer Commitments data in natural language from Claude, Copilot, Airtable, or any MCP-compatible AI tool.
    • Launches a public Issues API with paginated list and get-by-ID endpoints, supporting rich filtering by status, severity, source, type, owner, due date, and returning full issue detail including root cause, corrective action, custom fields, and mapped controls.

    +27 more show less

    • Adds 764 automated tests mapped to FedRAMP Rev 5, significantly reducing reliance on manual documentation for compliance demonstration.
    • Surfaces externalId in the Vulnerabilities API, enabling reliable reconciliation of findings with external asset inventories.
    • Adds the SIG Lite questionnaire as a fifth out-of-the-box TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. template, with AI answer generation, vendor Exchange flow, and standing-answer reuse.
    • Enables automatic deprovisioning of departing employees from Dropbox (team account, synced devices, Paper documents) during offboarding workflows (GA).
    • Introduces '/' slash-command shortcuts in the Vanta Agent, including /triage-issues, /evaluate-evidence, and /explore-capabilities.
    • Allows agents to assign control owners inline during agentic control program onboarding, with bulk review before finalizing.
    • Enables creation of custom frameworks directly within the Agent when imported controls reference a framework not yet in Vanta.
    • Adds inline control-to-evidence and policy-to-control mapping review inside the Agent canvas, replacing the previous CSV download/re-upload flow.
    • Adds Custom Common Controls within the Vanta Control Framework, supporting unique program obligations and custom framework mappings.
    • Supports duplicating existing IRL audits, carrying forward request lists, control mappings, and configuration with fresh Vanta-managed evidence attached automatically.
    • Allows uploading multiple audit reports per audit engagement, removing the previous single-report limitation.
    • Increases IRL audit upload limit from 500 to 2,000 entries.
    • Adds bulk auditor assignment to audit engagements, eliminating per-auditor individual addition.
    • Adds audit name search directly in the Auditor Portal.
    • Introduces the HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. Privacy Rule framework variant for covered entities, extending Vanta's HIPAA coverage beyond the Security Rule.
    • Adds Datadog Security Findings (Assets, Vulnerabilities, Security Alerts) as an automated import into Vanta for SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. tracking and compliance evidence.
    • Rebuilds the Slack integration on the Integration Builder platform with an AI-summarized activity log, improved sync performance via Fetcher V2, and editable connection settings without full reconnection.
    • Adds detailed integration listing pages for AWS, Azure, and GCP, showing supported features, API permissions, synced fields, automated tests, and a dedicated security page.
    • Adds a dedicated Agent Details Page for Custom Agents, showing prompt/configuration, scoped run history, manual run trigger, and direct edit access (Early Access).
    • Launches opt-in Dark Mode within Vanta for low-light or visually sensitive users.
    • Enables live OSCAL export published as a real-time, access-gated Trust Center resource for FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. machine-readable compliance requirements.
    • Improves Questionnaire Automation (QAuto) accuracy by passing surrounding question rows as context to the answering model for dependent and follow-up questions.
    • Adds CSV export of selected controls via a new bulk action on the controls page.
    • Allows selecting a specific policy version when attaching it as evidence to an information request.
    • MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Dashboard now supports sorting client list by company friendly name or domain name, with per-page count persisting across sessions.
    • Releases GrantGuard, Vanta's first open-source project, which audits Claude Code permission grants by risk level via a local web UI or CLI report.
    • Preserves unsaved audit creation progress when clicking outside the modal, prompting before destructive actions.

    32 details in Everything

27. docs update seen Jul 18, 2026 · issue 019

    Vanta adds control assessments in audits, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support for Commitments, Issues API, 700+ FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Rev 5 tests, dark mode, and 20+ more capabilities.

    └──▷ HOW TO FIND IT
    Use /triage-issues in the Vanta Agent to surface and prioritize compliance issues that need immediate attention.
    📍In the Vanta Agent chat, type: /triage-issues
    • Adds ability to select a specific policy version when attaching it as evidence to an information request during audits.
    • Enables auditors to formally assess controls in Vanta for internal and external IRL audits, with framework-specific statuses (Conforming/Non-conformity for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability., Satisfied/Not Satisfied for FedRAMP) and required justification comments.
    • Introduces an Internal Auditor Role, allowing an internal employee to be designated as auditor on an internal audit engagement with a scoped auditor view.
    • Supports custom commitment types with user-defined names, definitions, and example clauses, with automatic extraction from future and retroactive application to previously uploaded contracts.
    • Allows the Agent to assign control owners inline during agentic control program onboarding, with bulk review before committing.

    +26 more show less

    • Adds automated Dropbox deprovisioning during personnel offboarding (GA), removing departing employees from Dropbox team accounts, synced devices, and Paper documents.
    • Enables duplicating existing IRL audits to carry forward request lists, control mappings, and configuration into a new audit cycle.
    • Adds the SIG Lite questionnaire as a fifth out-of-the-box TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. template, with AI answer generation, vendor Exchange flow, and standing-answer reuse.
    • Supports querying Customer Commitments data via MCP-compatible AI tools (Claude, Copilot, Airtable) in natural language.
    • Introduces '/' skill shortcuts in the Vanta Agent (Proof of Concept), including /triage-issues, /evaluate-evidence, and /explore-capabilities.
    • Removes the single-report limitation for audit engagements, allowing multiple audit reports to be uploaded per engagement.
    • Enables bulk assignment of multiple auditors to an audit engagement at once.
    • Raises the IRL audit upload limit from 500 to 2,000 entries.
    • Allows the Agent to detect missing frameworks during control import, parse the uploaded file, and create a custom framework within the onboarding flow.
    • Adds audit name search in the Auditor Portal for faster navigation across concurrent engagements.
    • Adds MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Dashboard sorting by company name or domain name, with persistent per-page client count across sessions.
    • Surfaces externalId in the Vulnerabilities API for reconciling findings with external asset inventories.
    • Rebuilds the Slack integration on the Integration Builder platform with an AI-summarized activity log, improved syncing via Fetcher V2, and editable connection settings without full re-setup.
    • Adds a dedicated details page for Custom Agents (Early Access), showing prompt, configuration, scoped run history, and manual run trigger.
    • Introduces opt-in Dark Mode for the Vanta UI.
    • Adds a HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. Privacy Rule framework variant for covered entities, extending existing HIPAA coverage beyond the Security Rule.
    • Releases GrantGuard, an open-source tool for auditing Claude Code permission grants by risk level via a local web UI or CLI report.
    • Imports Datadog Security Findings (Assets, Vulnerabilities, Security Alerts) into Vanta for SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. tracking and automated compliance evidence.
    • Adds public REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. read endpoints for Issues, with paginated list filtering by status, severity, source, type, owner, and due date, plus a get-by-ID endpoint returning full issue detail.
    • Adds 764 mapped automated tests to the FedRAMP Rev 5 framework.
    • Enables exporting only selected controls as a CSV via a new bulk action on the controls page.
    • Supports creating custom common controls within the Vanta Control Framework, mappable to framework controls for evidence and test rollup.
    • Replaces CSV-based control and policy mapping review with an inline canvas in the Agent, allowing conversational adjustments.
    • Publishes Vanta's OSCAL export as a real-time, access-gated Trust Center resource for FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. machine-readable compliance.
    • Adds detailed integration listing pages for AWS, Azure, and GCP, showing supported features, API permissions, synced fields, automated tests, and security details.
    • Improves QAuto accuracy on follow-up and dependent questionnaire questions by passing surrounding row context to the answering model.

    31 details in Everything

28. June 2026 seen Jul 11, 2026 · issue 012

    Vanta June 2026 adds audit commenting, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. expansion, AIUC-1 pilot, CrowdStrike CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps., Twilio integration, and 20 new privacy MCP tools.

    └──▷ HOW TO FIND IT
    Discuss a specific control gap with your auditor in-context during an audit, without leaving Vanta.
    📍In the Vanta console, go to Audits › [your audit] › Controls, click a control row, select Comments, type your message, and @mention your auditor to notify them directly.
    Connect a custom or internal MCP-capable tool to Vanta's MCP to automate compliance workflows without waiting for manual allowlisting.
    📍In the Vanta console, go to Integrations › MCP, copy the MCP connection URL, paste it into your MCP-capable tool. If the redirect URL is not Vanta-owned, acknowledge the warning banner to proceed.
    Ingest CrowdStrike CSPM cloud misconfiguration findings into Vanta to track remediation SLAs and generate audit evidence.
    📍In the Vanta console, go to Integrations › CrowdStrike, select Add Connection, choose your CrowdStrike tenant, and enable CSPM Alerts ingestion. Repeat for additional tenants under the same Vanta domain.
    • Adds threaded, @mention-enabled commenting on individual controls directly within a Vanta audit, replacing out-of-band email and Slack threads.
    • Enables one-click export of the full controls table from within a Vanta audit for direct use in audit reports.
    • Expands Vanta MCP connectivity to any MCP-capable tool (not just officially supported ones), with a warning banner when the redirect URL is outside Vanta-controlled origins.
    • Adds 20 new privacy MCP tools covering data inventory and privacy assessments, enabling agentic automation of privacy program tasks.
    • Introduces early-access pilot for AIUC-1, the new security standard for AI agents, available at no cost during the preview period.

    +7 more show less

    • Adds Azure DevOps multi-tenant support, allowing multiple Azure DevOps organizations to be connected and managed under a single Vanta domain.
    • New Twilio integration (OAuth-based) automatically imports active Twilio users for access reviews and audit-ready evidence, with AI-summarized activity log.
    • Adds CrowdStrike CSPM ingestion into Vanta Security Alerts for SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. tracking and audit evidence, plus multi-tenant CrowdStrike support.
    • Adds optional reason field when deactivating controls (individually or in bulk), surfaced in a new Deactivation Reason column and control history.
    • Upgrades AI evidence evaluation model to Gemini 3.5 Flash, delivering a 10% latency improvement and 5% higher evidence pass rate.
    • SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Guide users can now have the Vanta Agent automatically generate a Trust Center and Letter of Engagement pre-filled with key details within their first days.
    • Unmanaged auto-renewal users can now preview a full line-item bill breakdown on the billing page before renewal processes.

    12 details in Everything

29. Vanta Week of July 5, 2026 Week of Jul 5, 2026 · release notes

    Vanta adds Agents details page, Datadog integration, Issues API, GrantGuard, OSCAL live export and more

    • Add Custom Agents: Agent Details Page for early access to view agent prompt, config, scoped run history, trigger manual runs, and edit from a dedicated page
    • Add Dark Mode (Opt-In Launch) with System Mode support planned for follow-on
    • Add HIPAA Privacy Rule framework variant for covered entities extending Vanta's existing HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. coverage beyond the Security Rule
    • Add GrantGuard: Vanta's First Open Source Project to audit permission grants for AI agents using Claude Code, classifying rules by risk level and allowing removal via local web UI or CLI report
    • Add Datadog Cloud Security Vulnerabilities and Security Alerts integration to automatically import Datadog Security Findings into Vanta for tracking SLAs and generating automated compliance evidence

    +8 more show less

    • Add Issues API: Read Endpoints with paginated list supporting rich filtering and get-by-ID endpoint returning full issue detail including root cause, corrective action, custom fields, mapped controls, risks, and policies
    • Add 700+ Automated Tests Added to FedRAMP Rev 5 with 764 mapped automated tests reducing reliance on manual documentation for compliance demonstration
    • Add Export Selected Controls to CSV bulk action allowing users to export specific controls as CSV without downloading the full list
    • Add Custom Common Controls feature to create own common controls within Vanta Control Framework covering unique obligations or internal requirements and mapping them to framework controls
    • Add No More CSV: Review Mappings Right in the Agent inline canvas for reviewing and adjusting control-to-evidence and policy-to-control mappings conversationally without downloading, editing, and re-uploading CSV files
    • Add Trust Center: Live OSCAL Export for FedRAMP publishing Vanta's OSCAL export as real-time access-gated Trust Center resource satisfying FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. requirements for machine-readable continuously updated compliance data
    • Add Detailed Integration Listing Pages for AWS, Azure, and GCP showing every feature supported, API permissions flagged as required or optional, fields and API synced, automated tests and frameworks enabled, and dedicated security page explaining how Vanta protects user's data
    • Add QAuto: Surrounding Question Context passing surrounding rows of each question to answering model for more accurate answers on follow-up and dependent questions

    13 details in Everything

30. July 2026 Jul 1, 2026 · issue 019

    Vanta July 2026 adds internal auditor roles, control assessments, Dropbox deprovisioning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, and 8 more capabilities.

    └──▷ TRY IT
    Use the Vanta Agent's /triage-issues shortcut to immediately surface the highest-priority compliance gaps without manually scanning every control.
    copy

    $ In the Vanta Agent chat, type: /triage-issues

    • Adds version-specific policy selection when attaching policies as evidence to information requests, giving auditors precise control over which policy version is submitted.
    • Enables auditors to formally assess controls directly in Vanta for internal and external IRL audits, with framework-specific statuses (Conforming/Non-conformity for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.; Satisfied/Not Satisfied for FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one.) and required justification comments.
    • Introduces an Internal Auditor Role, allowing an internal employee to be designated as auditor on an internal audit engagement with a scoped IRL, request tracker, and population views without requiring an external audit firm.
    • Adds Custom Commitment Types for Customer Commitments, letting users define their own contract commitment types with a name, definition, and example clauses — Vanta automatically extracts them from future and previously uploaded contracts.
    • Enables the Vanta Agent to assign control owners inline during agentic Control Program Onboarding, with validation of missing descriptions, ineligible owners, and ambiguous entries before bulk-review commit.

    +7 more show less

    • Adds GA support for automatic Dropbox account deprovisioning during personnel offboarding, removing departing employees from their Dropbox team account, synced devices, and Paper documents.
    • Supports duplicating existing IRL audits to carry forward request lists, control mappings, and configuration into the next audit cycle, with automatic fresh evidence attachment.
    • Adds the official SIG Lite questionnaire as a fifth out-of-the-box TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. template, licensed by Vanta, with AI answer generation, vendor Exchange flow, and standing-answer reuse.
    • Introduces MCP support for Customer Commitments, enabling natural-language queries from Claude, Copilot, Airtable, and other MCP-compatible AI tools, and programmatic access to commitments data.
    • Adds '/' skill shortcuts in the Vanta Agent (Proof of Concept), with preset commands /triage-issues, /evaluate-evidence, and /explore-capabilities to steer the Agent toward specific compliance tasks.
    • Supports uploading multiple audit reports per audit engagement, removing the previous single-report limitation for multi-framework scenarios.
    • Enables bulk auditor assignment for audit engagements, allowing multiple auditors to be added at once instead of one at a time.

    12 details in Everything

31. Vanta Week of June 28, 2026 Week of Jun 28, 2026 · release notes

    TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. questionnaire builder adds select types and evidence; SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Guide gains Cloud module and Agent-led policy workflow; performance boost for vulnerabilities.

    • Adds single-select and multi-select question types to the TPRM Questionnaire Builder for richer vendor assessments
    • Enables attachment of multiple follow-up questions to a single answer using conditional logic in TPRM questionnaires
    • Allows vendors to attach evidence directly to individual questions within the TPRM questionnaire builder
    • Supports import of questionnaires from spreadsheets including select questions and sections in TPRM
    • Adds Agent support for querying Customer Commitments data against GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. program data with natural language

    +11 more show less

    • Enables notifications via email, Slack, and Teams for new vendor incidents, weekly digests, and external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. alerts in TPRM
    • Allows Trust Center preview, review, edit, publish, and go-live actions directly from the Vanta Agent instead of the dedicated Trust Center page
    • Generates assessment shells only for a vendor's tier and risk score in TPRM Assessment Quality
    • Adds ability to set due dates and owners on scheduled assessments upfront in TPRM
    • Automatically assigns default owners inherited from assessment rules in TPRM
    • Allows safe deletion of assessment types with full visibility into in-progress assessments in TPRM
    • Introduces a new Assessment Types API for programmatic differentiation in TPRM
    • Provides an Agent-led workflow to guide users through reviewing and approving all 15 required SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 policies end-to-end with pre-generated drafts and progress tracking
    • Adds a new SOC 2 Guide Module: Cloud that generates compliance plans, connects cloud integrations via the Agent, groups tests for batch remediation, and tailors instructions
    • Implements approximately 80% improvement in Findings by Vulnerability page load times (from ~5.2s to ~1.0s at p99) and elimination of API timeout spikes causing 5xx errors
    • Reduces Reopen Vulnerabilities processing from 1,000 MongoDB operations to 50 for faster performance

    16 details in Everything

32. Vanta Week of June 21, 2026 Week of Jun 21, 2026 · release notes

    New Vanta MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools for privacy and API endpoints for risk-control linking; new audit export and agent onboarding.

    • Adds GET and POST REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints to manage risk-to-control link relationships
    • Adds Privacy Read and Write MCP Tools (20 new tools) via MCP for managing privacy data inventory
    • Enables exporting the full controls table directly from within a Vanta audit
    • Adds multi-tenant support for Azure DevOps and CrowdStrike CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. integrations
    • Adds Deactivation Reason column on deactivated controls page

    +1 more show less

    • Adds optional reason input when deactivating controls individually or in bulk

    6 details in Everything

33. Vanta Week of June 14, 2026 Week of Jun 14, 2026 · release notes

    Vanta adds TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. commenting, Agent-driven vendor guides, and in-app framework purchases.

    • Adds internal and external commenting on individual TPRM questionnaire items
    • Enables the Vanta Agent to suggest controls for risk scenarios via natural language
    • Delivers proactive notifications for new domain tests and test owner alerts via email or Slack/Teams
    • Introduces an Agentic SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Guide module for vendor management setup and documentation analysis
    • Allows customization of risk scoring scales at the individual register level with a heatmap grid view

    +3 more show less

    • Moves the Vanta Agent interface into a slide-in panel that sits alongside page content
    • Supports creating, renaming, updating, and deleting risk registers via the Vanta Agent or MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol
    • Enables direct purchase of GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., AUE8, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. v8, and CRI frameworks in-app with user-selectable variants

    8 details in Everything

34. Vanta Week of June 7, 2026 Week of Jun 7, 2026 · release notes

    Vanta adds Vanta Agent search, privacy processor writes, SIG Lite QAuto template, Splunk on-prem integration

    • Adds a persistent top-nav entry point for Vanta Agent with Command+K shortcut and rotating prompt suggestions
    • Enables filtering and sorting framework/certification commitments by structured commitment type across the entire contract base
    • Extends Vanta Agent agentic write capabilities to the processor side of the Privacy Data Inventory (create, update, delete processing categories and data controllers)
    • Allows mapping requests directly to controls during IRL upload with real-time Control ID validation against Vanta
    • Adds a SIG Lite questionnaire template in QAuto as the new default starter or via Import modal

    +3 more show less

    • Links existing controls to risks from a new risk context section on the risk detail page
    • Allows creation of custom assessment templates (free text, single/multi-choice) for Privacy assessments
    • Adds Splunk Enterprise (on-prem) integration via the new Integration Builder platform

    8 details in Everything

35. Vanta Week of May 31, 2026 Week of May 31, 2026 · release notes

    Vanta adds per-risk access management, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools for data reading, and Trust Center AWS Marketplace integration.

    • Adds ability to delete files from risk tasks by showing file names instead of just a count
    • Trust Center: AWS Marketplace Integration allows featuring Trust Center on AWS Marketplace listings

    2 details in Everything

36. Vanta Week of May 24, 2026 Week of May 24, 2026 · release notes

    Vanta introduces Agent-driven SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. onboarding, native billing, Wiz integration, and sandboxed agent analysis.

    • Adds a guided Agentic SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 setup flow for startups in the SOC 2 Guide package that generates tailored compliance plans via the Vanta Agent
    • Adds a new in-app native billing page that replaces the previous Stripe redirect and serves invoices directly from Netsuite
    • Ingests Wiz configuration findings as SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments.-trackable security findings for Professional and Enterprise (Modular) users
    • Enables admins to customize personnel reminder emails using template variables and send them from a verified company domain instead of Vanta's default
    • Adds bulk edit and delete capabilities with a permanent table view for Privacy Data Inventory items

    +2 more show less

    • Allows collaboration with the Vanta Agent to create, update, and delete processing activities in the Privacy Data Inventory with multi-field updates
    • Supports 10% rollout of Vanta Agent Sandbox to run bash commands, execute Python scripts, and export files for large file/dataset analysis

    7 details in Everything

37. Vanta Week of May 17, 2026 Week of May 17, 2026 · release notes

    New Sharepoint contract integration, BU-scoped reports, flexible user provisioning options, and a Personnel Setup Wizard.

    • Adds Sharepoint as a configurable contract source in the Commitments settings page for automated inventory population
    • Enables Program Segment lens on the Program Overview report to scope Framework Progress, Test Remediation chart, and Audits widgets to a specific BU

    2 details in Everything

38. Vanta Week of May 10, 2026 Week of May 10, 2026 · release notes

    Vanta adds Knowledge Base API for Answer Library management and several UI-driven compliance features

    • Adds Knowledge Base API with LIST endpoints allowing programmatic CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. of Answer Library entries
    • Trust Center admins can now fulfill GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. Article 17 erasure requests directly from Settings by entering a viewer's email to trigger an automated workflow that anonymizes their PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.
    • Users are now immediately notified via email when a monitored vendor experiences a confirmed or suspected security breach, and can view a structured incident detail page showing confirmation status, severity, data breach status, a summary of what happened, source evidence links, and a basic incident timeline all in one place
    • Users now receive an AI-generated recommendation (Approve, Deny, or Needs Review) for every account at the start of an access review, each surfaced with the signals behind it such as employment status, last login, and prior decisions
    • Users can map Trust Center tag values directly to Salesforce fields so that when a customer requests access, the right documents are automatically delivered based on their Salesforce data

    +7 more show less

    • Users setting up Commitments for the first time are now guided through a four-step onboarding flow with a welcome modal, a persistent progress banner, and Chameleon-powered tours pointing to the exact UI needed at each step
    • Users can export test data in bulk from the Tests page via CSV, with a configuration modal that gives them control over exactly what gets included in the export
    • Users on VantaGov now have access to all reports including the Issues Report, powered by the same Snowflake-based reporting data pipeline available in Vanta's commercial product
    • Users on CMMC Level 2 can track their Supplier Performance Risk System (SPRS) Score directly in Vanta via a new reporting widget that updates as they make progress on controls
    • Users managing compliance across multiple Business Units can now access a single My Program home page that provides cross-BU and cross-framework visibility into their entire compliance program
    • Users on NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework., NIST 800-171, FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Rev 5, and CMMC frameworks can capture three additional fields per control including control type, implementation status, and implementation details
    • Users running vendor assessments in TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. can request access to private documents from Safebase, Secureframe, and Conveyor trust centers directly within an assessment using a computer use agent

    12 details in Everything

39. Vanta Week of May 3, 2026 Week of May 3, 2026 · release notes

    Vanta adds Event Logs API, Akamai integration, Jira doc automation, and issue snapshots.

    • Adds the Event Logs API for continuous fetching of Vanta event logs to detect suspicious user behavior and ingest activity into SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point.
    • Adds Akamai Domain Protection integration to monitor managed domains, proxy status, and WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./bot/DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. configuration with automated tests
    • Adds automated Jira ticket creation for Documents (Beta) to automatically create Jira issues when evidence is needed
    • Adds Issue Snapshots with Audit Integration to take point-in-time snapshots of filtered issues for auditors
    • Adds support for mapping spreadsheet columns to tag categories during Answer Library imports

    5 details in Everything

40. Vanta Week of April 26, 2026 Week of Apr 26, 2026 · release notes

    Vanta adds IRL GA, Standard Commitments AI, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 22301 framework, OSCAL export, and Vanta Agent search.4

    • Adds ability to upload auditor's Information Request List (IRL) for unified audit workflows.
    • Adds automatic identification of non-standard commitments in customer contracts via AI analysis of standard papers.
    • Adds one-click persistent quick views on the People page to filter personnel by actionable states.
    • Adds custom structured metadata fields to Issues for enterprise tracking needs.
    • Adds ISO 22301 as a new out-of-the-box compliance framework.

    +6 more show less

    • Adds Vanta Agent access via top navigation search bar with rotating prompt suggestions.
    • Adds team ownership for controls with configurable Slack channel alerts.
    • Updates TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Assessment Evidence Status to distinguish fulfilled requests from total required.
    • Implements partial materialization refresh on the Tests page to update assignments faster.
    • Adds OSCAL export capability for FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. R5, NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework., and CMMC frameworks.
    • Introduces Vanta Control Framework (Private Preview) as a unified view of overlapping compliance commitments.

    11 details in Everything

41. Vanta Week of April 19, 2026 Week of Apr 19, 2026 · release notes

    New Vanta capabilities: Outbound Webhooks, DPIADPIAA Data Protection Impact Assessment — a structured process, required under GDPR, for identifying and mitigating privacy risks before deploying a system that processes personal data at scale. AI drafts, custom doc renewal dates, and processor-side ROPA tracking.

    • Adds GA Outbound Webhooks for real-time notifications on vendor creation, Trust Center access requests, and questionnaire status changes
    • Introduces DPIA Generation with Vanta AI to draft Data Protection Impact Assessments from processing activities and risk scenarios
    • Enables Custom Document Renewal Dates for individual or bulk document updates independent of upload dates
    • Delivers SOC 2 Guide in Slack notifications and policy reminders via the Vanta Agent
    • Improves QAuto: Section Context Awareness by surfacing section headings to AI for more accurate questionnaire answers

    +8 more show less

    • Makes TPRM: Next Review Date available during vendor import to trigger automated evidence collection workflows
    • Adds Asana & ClickUp Ticket Linking + Evidence Sync to sync task status and attachments from those platforms to Vanta Documents
    • Introduces Enforce Policy Review setting requiring employees to open and review policies before acceptance
    • Implements Auto Account Assignment & Creation to match or create accounts for uploaded contracts via AI
    • Launches Agent-led Risk Onboarding in the SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Guide to generate personalized risk scenario recommendations
    • Opens Early Access for Redesigned Portal Automation in QAuto using full-page AI scan and agentic navigation
    • Adds Processor-Side of the Data Inventory (Processor ROPA) by splitting data inventory into Data you control and Data you process for others
    • Introduces QAuto: Object-Level Permissions for Questionnaires for granular access control based on ownership or approver roles

    13 details in Everything

42. Vanta Week of April 12, 2026 Week of Apr 12, 2026 · release notes

    Vanta adds public REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for contract management, remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server beta, and agent image/PDF attachments.

    • Adds upload, read, and delete capabilities to the public REST API for programmatic contract management
    • Releases Vanta remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. as a public beta feature for all customers
    • Enables attaching images and PDFs to Vanta Agent via the paperclip icon
    • Makes the Controls Page available in IRL audits for viewing in-scope controls and progress tracking

    4 details in Everything

43. Vanta Week of April 5, 2026 Week of Apr 5, 2026 · release notes

    Vanta adds Personnel, QAuto, Privacy, and spreadsheet questionnaire support to Vanta Agent

    • Adds Personnel (V2) context to the Vanta Agent for personnel compliance posture queries
    • Adds expanded Spreadsheet Questionnaire support for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. as a first-class in-app experience
    • Adds QAuto context to the Vanta Agent allowing pasting security questionnaire questions for answers from knowledge base and questionnaires
    • Adds Privacy context to the Vanta Agent for privacy product data queries including processors and impact assessments

    4 details in Everything

44. Vanta Week of March 29, 2026 Week of Mar 29, 2026 · release notes

    Vanta adds Claude Code plugin for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. remediation, auto-indexing of public webpages to Knowledge Base with sub-pages, and AI-assisted policy version history.

    • Adds Vanta Plugin for Claude Code (Private Preview) allowing discovery of failing compliance tests and generation of infrastructure-as-code fixes directly in the code editor via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server connection.
    • Enables include sub-pages option for public webpage indexing to automatically capture content one level deep from a single URL using LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-based filtering.
    • Introduces automatic version history for AI-assisted edits in the Policy Editor, saving every edit with summaries and allowing one-click restoration.

    3 details in Everything

45. Vanta Week of March 22, 2026 Week of Mar 22, 2026 · release notes

    Vanta streamlines Risk page by moving Risk Snapshots to the '…' menu

    • Moves Risk Snapshots into the “…” menu on the Risk page alongside a link to Risk Settings

    1 detail in Everything

46. Vanta Week of March 15, 2026 Week of Mar 15, 2026 · release notes

    New Splunk access sync integration, ENUM support in custom tests, multiple parallel vendor assessments, and agentic onboarding for small teams.

    • Adds automatic syncing of user, group, role, and access data from Splunk to enable continuous monitoring of access controls
    • Adds ENUM data type support in the test builder for creating custom tests with enumerated values
    • Enables creation of multiple assessment types (e.g., privacy, legal, financial) for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. with parallel AI-powered evaluations
    • Introduces an agentic onboarding experience for 1-10 HC customers including company research, policy creation, and Vanta Agent support

    4 details in Everything

47. Vanta Week of March 8, 2026 Week of Mar 8, 2026 · release notes

    Vanta adds business unit scoping for vendors, structured TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. questionnaires, and GA Privacy Hub Impact Assessments with Vanta AI suggestions

    • Adds Business Unit-level vendor scoping to manage different vendor scopes for each audit leading to faster and more complex audit strategies
    • Adds new sidebar navigation for managing TPRM questionnaire sections (create, rename, duplicate, delete, reorder) in the Privacy Hub
    • GA of Impact Assessments in the Privacy Hub with Vanta AI DPIADPIAA Data Protection Impact Assessment — a structured process, required under GDPR, for identifying and mitigating privacy risks before deploying a system that processes personal data at scale. suggestions, approval workflows, and customizable review cadences
    • GA of TPRM Multiple Assessments Phase 1 allowing different assessment types per vendor, single decisioning, and evergreen exchanges

    4 details in Everything

48. Vanta Week of March 1, 2026 Week of Mar 1, 2026 · release notes

    Vanta adds Linear ticket linking with evidence sync, Miradore MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integration, and QAuto agent response approvals.

    • Adds Linear ticket linking to Vanta Documents with automatic attachment syncing for audit evidence
    • Adds Miradore MDM integration for continuous device inventory sync and posture evaluation against controls
    • Introduces QAuto (public preview) for optional auto-approval of unflagged agent answers and automated questionnaire completion
    • Adds privacy impact assessment task tracking in the My Work view

    4 details in Everything

49. Vanta Week of February 22, 2026 Week of Feb 22, 2026 · release notes

    Vanta adds SSPSSPA System Security Plan — a formal document required by NIST SP 800-18 that describes how a federal system meets its security controls, giving cyber tools a structured artifact to parse or generate for compliance workflows. generation, Calendly deprovisioning, bulk Trust Center imports, multi-resource custom tests

    • GenerateSystemSecurityPlan integration now supports FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. R5, NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework., NIST 800-171, CMMC with DOCX/PDF output stored in Vanta Documents
    • [Open beta] Calendly.deprovision action enabled during offboarding workflows
    • Trust Center UI show_failing_control_indicators toggle added to display non-passing controls
    • QAuto team_assignment capability allows assigning teams as approvers with RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. support
    • Custom Tests now support join logic across two resource types with enum value dropdowns in test authoring

    5 details in Everything

50. Vanta Week of February 15, 2026 Week of Feb 15, 2026 · release notes

    Vanta adds unified scoping homepage, QAuto auto-approval for spreadsheets, customizable privacy policy acceptance in Trust Center, automated offboarding task assignment, and

    • Adds a Unified Scoping home page for configuring scope across multiple levels including AWS assets by tags, regions, and asset names
    • Enables QAuto to skip manual review for spreadsheet columns detected with high confidence
    • Adds toggle and markdown link support in Trust Center access request forms to require and customize privacy policy acceptance
    • Introduces [Open beta] automated assignment of deprovisioning tasks to system admins during personnel offboarding with auto-verification
    • Enables inline editing of processing activities in the privacy data inventory overview page drawer view

    5 details in Everything

51. Vanta Week of February 1, 2026 Week of Feb 1, 2026 · release notes

    Vanta QAuto adds bulk questionnaire actions, CTM conflict detection, granular Trust Center access controls, and improved evidence/audit UX

    • Adds ability to identify and manage conflicting and duplicate content within the Customer Trust Management (CTM) knowledge base
    • Enables bulk actions across multiple questionnaire questions in QAuto to reduce manual clicks during review
    • Allows configuration of more granular access settings for Trust Center documents
    • Improves evidence upload workflow in TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. reviews with clearer status indicators
    • Enhances audit issue status visibility within audit workflows

    5 details in Everything

52. Vanta Week of January 25, 2026 Week of Jan 25, 2026 · release notes

    Vanta adds Issues reporting, code-changes access for lower tiers, URL evidence, Agent memory/framework overlap drill-down and TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. intake form.

    • Adds /code-changes page access to Essentials and Plus packages, replacing the old /changes experience
    • Adds URL Evidence in Issue Management allowing URLs to be attached directly to issues as evidence
    • Adds Agent Memory (M1: Create and Use Memory) to store company-specific context for personalized responses
    • Adds Framework Evidence Overlap Drill-Down showing exactly which tests and documents overlap across frameworks
    • Adds [GA] TPRM Intake Form with configurable vendor fields, evidence uploads, magic links, and default risk assignment

    +1 more show less

    • Adds Issues report surfaced in UI with trends by severity/status, filters by owner/status/source/audit, and near real-time updates

    6 details in Everything

53. Vanta Week of January 18, 2026 Week of Jan 18, 2026 · release notes

    Vanta adds AI Shadow Mode for SOC2SOC2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. scoping, Jira linking, Agent UX improvements and DPIADPIAA Data Protection Impact Assessment — a structured process, required under GDPR, for identifying and mitigating privacy risks before deploying a system that processes personal data at scale. history

    • Enables AI Auto Consent & Provisioning Agents (Shadow Mode) for SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 Studio Pilot users to auto-generate policies from public data without applying changes yet.
    • Adds approval workflows for impact assessments, allowing users to assign approvers and track status within Vanta.
    • Makes the Vanta Agent globally available via top navigation with context-aware prompts on any page.
    • Links existing Jira issues to Vanta documents to improve traceability without creating duplicate tickets.
    • Expands Personnel Tools for the Vanta Agent to answer questions about task completion, training, and background checks via natural language.

    +2 more show less

    • Adds business unit segmentation for tests, enabling views of impacted units, resource counts, and segment-specific remediation.
    • Introduces versioning and history tracking for Impact Assessments (DPIAs) with draft creation from approved versions and comparison capabilities.

    7 details in Everything

54. Vanta Week of January 11, 2026 Week of Jan 11, 2026 · release notes

    AI Auto Consent agents in shadow mode, Jira doc linking, Vanta Agent global availability, and scalable product tests.

    • Adds AI-driven provisioning agents for SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. policy generation (shadow mode) that auto-opt Core and Core Plus domains
    • Enables linking existing Jira issues directly to Vanta documents for traceability
    • Makes the Vanta Agent globally available via top navigation with context-aware prompts
    • Allows assigning approvers and tracking status within the impact assessment workflow
    • Supports personnel queries for the Vanta Agent including training progress, background checks, and policy acceptance rates

    +2 more show less

    • Links impact assessments to processing activities bidirectionally
    • Redesigns product test infrastructure with paginated processing to support large data volumes

    7 details in Everything

55. Vanta Week of December 21, 2025 Week of Dec 21, 2025 · release notes

    Vanta adds CSV export columns for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. answers, experimental Security Assessment Agent, and per-channel Slack auto-reply configuration

    • CSV exports for TPRM Security Assessments now include AI answer, Vendor answer, and Flagged Findings columns to improve transparency during reviews

    1 detail in Everything

56. Vanta Week of December 14, 2025 Week of Dec 14, 2025 · release notes

    Vanta adds segment-based asset pages, Kolide MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integration, privacy data inventory automation, and issue querying via Vanta Agent

    • /computers, /access, and /vulnerabilities pages now use Business Unit Segments for asset visibility filtering.
    • Automated Test for Data Inventory in Privacy Frameworks provides continuous monitoring of data inventory state, replacing document-based tests.
    • Vanta Agent now supports natural language queries for issue metadata (counts, trends, ownership, statuses).
    • First-party Vanta-built Kolide MDM integration replaces third-party version with device group filtering and multi-OS support.
    • QAuto Quick-Add feature allows direct addition of questionnaire responses to the Answer Library.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Draft state for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. reviews is removed; simplified status model (Not Started, In Progress, Complete) is now in effect.
57. Vanta Week of December 7, 2025 Week of Dec 7, 2025 · release notes

    Vanta adds agent-driven policy editing, Oracle EU Sovereign Cloud support, and audit creation by segment.

    • Enables the Vanta Agent to draft, review, and apply policy edits via natural language prompts
    • Adds support for connecting Oracle OC19 and DRCC cloud environments in Enterprise editions
    • Allows creating audits by program segment with UI filtering and scope summaries on audit cards

    3 details in Everything

58. Vanta Week of November 30, 2025 Week of Nov 30, 2025 · release notes

    Vanta adds custom notes to personnel records, datetime support for custom tests, and GA data inventory/ROPA management in Privacy Frameworks

    • Adds a new Custom Note field to personnel records for storing internal context like employment status or test user details.
    • Enables datetime data type values when writing custom tests, allowing verification of time-sensitive controls and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. timelines.
    • Promotes Data Inventory and ROPA Management within Privacy Frameworks to General Availability (GA), enabling import/export capabilities directly in the tool.

    3 details in Everything

59. Vanta Week of November 16, 2025 Week of Nov 16, 2025 · release notes

    Per-business unit scope tracking, manual offboarding accounts via Access Requests, object-level policy approvers, and Privacy ROPA XLSX export.

    • Business Units Scope Overview lets users see changes to scope on a per-business unit basis for streamlined scope changes and updated metrics.

    1 detail in Everything

60. Vanta Week of November 9, 2025 Week of Nov 9, 2025 · release notes

    Vanta introduces Agent-generated policies, TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. unified view, Slack Trust Center approvals, QAuto digests, and custom test author visibility.

    • TPRM Navigation merges Discovery, Procurement, and Managed Vendors into a unified view with Continuous Monitoring
    • Approve or deny Trust Center access requests directly in Slack via one-click actions
    • Vanta Agent generates editable custom policies from natural language prompts
    • QAuto sends daily reminder digests to questionnaire owners and approvers when due dates approach or pass
    • Custom test details view shows the author name for newly created tests

    5 details in Everything

61. Vanta Week of November 2, 2025 Week of Nov 2, 2025 · release notes

    New GCP connector with automated setup, Slack CTM bot, Modular Enterprise package, and HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. leave/email sync.

    • Adds a new Google Cloud Platform (GCP) connector with a streamlined flow and smart defaults for faster onboarding
    • Introduces a Cloud Shell script to automate policy and role setup for the GCP integration
    • Enables asking security and compliance questions directly in Slack via the CTM knowledge base
    • Launches the new Modular Enterprise package replacing Scale and previous Enterprise GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. packages
    • Adds automatic pull of leave data and personal email addresses from HRIS integrations (Bob, Personio, PayFit, Employment Hero, Rippling, Trinet)

    5 details in Everything

62. Vanta Week of October 26, 2025 Week of Oct 26, 2025 · release notes

    Vanta adds non-admin custom test creation, Agent framework context, CTM account-level tracking, simplified GitHub connection, and Bedrock model inventory.

    • Adds ability for users with View and edit permissions on Tests and Documents to create custom tests without Admin access
    • Enables Vanta Agent to use framework and control context in Public Preview for tailored GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. responses
    • Adds account-level tracking of questionnaires in CTM alongside existing Trust Center access and commitments
    • Introduces streamlined OAuth flow for GitHub connection to eliminate redundant configuration steps
    • Improves evidence eval accuracy by reducing false positives in analysis by approximately 50%

    +1 more show less

    • Adds Bedrock AI Model Inventory tab with metadata (last use, detection date, usage frequency) and export support for AWS Bedrock users

    6 details in Everything

63. Vanta Week of October 19, 2025 Week of Oct 19, 2025 · release notes

    Vanta adds ROPA import, CRI v2.1 framework, Trust Center layout customization, and Cloudflare domain inventory.

    • Adds ability to import data inventory directly from a ROPA spreadsheet
    • Introduces Cyber Risk Institute (CRI) Profile v2.1 framework with 319 mapped controls
    • Enables Trust Center layout customization with drag-and-drop section reordering and visibility toggles via Customize layout
    • Adds custom fields for processing activities in the Data Inventory and ROPA dashboard
    • Allows attaching supporting evidence (files or knowledge base links) to QAuto responses, exported in a zip file

    +5 more show less

    • Provides access to FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. Low and Moderate frameworks with control inventories and baseline toggling
    • Enables multi-select filters for Integrations and Controls on the Tests page
    • Supports customizable policy renewal cadences (quarterly, monthly, every two years)
    • Displays domain inventory for Cloudflare connections, including proxy and protection status
    • Adds three new tests for verifying Cloudflare protections

    10 details in Everything

64. Vanta Week of October 12, 2025 Week of Oct 12, 2025 · release notes

    Vanta adds Controlled Audit View GA, URL evidence evaluation, Existence Custom Tests, native Issue Management tasks, and direct Jira task creation.

    • Introduces the Controlled Audit View (GA) to limit auditor visibility on population pages and allow setting a default audit view.
    • Enables automatic evidence evaluation for documents uploaded via URL in Evidence Eval.
    • Adds Existence Custom Tests (formerly Any/All tests) that pass when any entity meets criteria.
    • Allows creation and management of native tasks directly within Issue Management.
    • Enables creation of Jira tasks directly from Vanta Issues.

    5 details in Everything

65. Vanta Week of October 5, 2025 Week of Oct 5, 2025 · release notes

    Vanta adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for risks/vulns/people/docs/integrations, auto scoping GA, custom test filters, and framework scope overview

    • Adds Vanta MCP Server endpoint enabling queries for risks, vulnerabilities, people, documents, and integrations from external tools
    • Reaches General Availability (GA) of Auto Scoping for Personnel with instant scope updates across linked assets
    • Adds filter logic support to Custom Tests to target specific resource subsets
    • Adds Framework Scope Overview view showing total/percentage of scoped systems/people and change logs
    • Adds new Notification Preferences section under Team Settings for managing team alert toggles

    5 details in Everything

66. Vanta Week of September 28, 2025 Week of Sep 28, 2025 · release notes

    Vanta introduces Collaborator role for Issue Management and question reordering/duplication in TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. builder

    • Adds Collaborator role to Issue Management, enabling object-level access to specific issues without full module permissions.
    • Enables duplication and reordering of questions within the TPRM questionnaire builder.

    2 details in Everything

67. Vanta Week of September 21, 2025 Week of Sep 21, 2025 · release notes

    Vanta adds Moxso/Sat/LatticeFlow/Watchpoint integrations, Issue Source filtering, and QAuto redesign.

    • Adds Issue Source field to filter/tag issues by Internal Audit, External Audit, Incident, or Other, visible in CSV exports
    • Adds Moxso Security Awareness integration for passing SAT information and evidence collection
    • Adds LatticeFlow Access integration for marketplace visibility and access monitoring
    • Adds Watchpoint live vulnerability integration for monitoring security findings

    4 details in Everything

68. Vanta Week of September 14, 2025 Week of Sep 14, 2025 · release notes

    ABV partner integration and domain-restricted Vanta Exchange secure login for external users

    • Adds ABV as an integrable partner system in Vanta.
    • Adds domain-based secure login restriction to specific Vanta Exchanges.

    2 details in Everything

69. Vanta Week of September 7, 2025 Week of Sep 7, 2025 · release notes

    Redesigned TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Security Review workflow and early access Data inventory & ROPA builder

    • New redesigned TPRM Security Review workflow that auto-resumes the last step and separates tasks by status
    • Early Access feature to build a data inventory and generate a ROPA directly in Vanta with spreadsheet import

    2 details in Everything

70. Vanta Week of August 31, 2025 Week of Aug 31, 2025 · release notes

    Vanta adds Issue Management access for Editors role and SentinelOne alert monitoring in public preview.

    • Expands the Editor role to allow users to create, update, and oversee issues in the Issue Management module
    • Adds SentinelOne alerts management in public preview, displaying them on the CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. Alerts page for SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. tracking and remediation

    2 details in Everything

71. Vanta Week of August 24, 2025 Week of Aug 24, 2025 · release notes

    New Tailscale, Keeper, Bocada, and HirePass integrations; Trust Center granular subscriptions and code changes scoping

    • Add Tailscale integration to sync user accounts hourly for access monitoring and deprovisioning compliance tests.
    • Add Keeper integration via SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. to sync users and groups hourly for account access tracking and offboarding evidence.
    • Add Bocada as an integration partner with an initial access-only integration.
    • Enable HirePass integration using the Connectors API Background Check schema.
    • Allow Trust Center buyers to subscribe to granular updates instead of receiving all content.

    +6 more show less

    • Restrict framework scoping settings to view-only access for users with limited permissions.
    • Expand Trust Center Private Preview design customization to include buttons, fonts, colors, and borders.
    • Add CTM knowledge base features including ownership assignment, content health visibility, and automated re-verification.
    • Add a corrective action card in Issue Management for documenting ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-aligned records.
    • Filter code changes on /code-changes by scoping and segmentation tags to align pull requests with repo scope.
    • Allow bulk marking of personnel as service accounts or reverting them via the Personnel Hub.

    11 details in Everything

72. Vanta Week of August 17, 2025 Week of Aug 17, 2025 · release notes

    Vanta introduces Policy Library, auto-generated rationale on control drawers, vendor TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. alerts, and improved Issue Mgmt formatting.

    • Adds new Policy Library UI to manage standard policies (add/remove) for GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. program alignment
    • Improves direct policy linking on control drawers with auto-generated rationale context
    • Enables @mentions in policy comments with centralized thread view including approval messages
    • Introduces TPRM Continuous Monitoring Alerts for high-severity vendor findings (filterable by category/severity/risk)
    • Improves Issue Management text formatting by preserving line breaks and paragraph spacing

    5 details in Everything

73. Vanta Week of August 10, 2025 Week of Aug 10, 2025 · release notes

    Vanta adds vendor subprocessor visibility in TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data., new Issue Management filters/comments, and Trust Center Account workflows; deprecates public GraphQL API.

    • TPRM: See Vendor Subprocessors allows viewing vendor subprocessors with details like product names, processing purposes, and geographic locations.
    • [GA] Trust Center Accounts + Account Workflows enables managing Trust Center Accounts to track trust engagement, manage NDAs/access per account, and monitor activity.
    • New control scoping via survey in compliance roadmap or settings to automatically unmap unnecessary controls, tests, and evidence.
    • Issue Management due date filter allows filtering issues by upcoming (7/30 days) or past-due deadlines on the My Work page.
    • Users can now leave comments directly within Issue Management for discussion and decision documentation.

    +2 more show less

    • Assign teams as system approvers/admins for Access Requests allows any team member to act on requests and receive notifications.
    • Dedicated My Work page groups assigned work by urgency with filters like Needs my approval.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The public GraphQL API has been fully deprecated; all requests are now redirected to Vanta’s REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
74. Vanta Week of August 3, 2025 Week of Aug 3, 2025 · release notes

    Vanta adds delegated access request submission, TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Q&A export, and Agent SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. remediation with one-click fixes.

    • Adds the ability to submit access requests on behalf of other users via the Vanta app and Slack flows
    • Adds export functionality for security review questions and answers from the TPRM flow
    • Adds Vanta Agent SLA remediation that automatically detects policy/SLA mismatches with one-click fixes

    3 details in Everything

75. Vanta Week of July 27, 2025 Week of Jul 27, 2025 · release notes

    Vanta adds auto-scoping for personnel, a policy chatbot, and structured access levels.

    • Adds Bulk Group Updates to auto-scope personnel configurations across employee groups
    • Adds Auto-scoping to keep devices and accounts in sync based on employee ownership
    • Adds plain-English Policy Chatbot integration within Policies view for querying approved and draft policies
    • Adds structured access levels configuration for Access Requests to enforce predefined entitlements

    4 details in Everything

76. Vanta Week of July 20, 2025 Week of Jul 20, 2025 · release notes

    Vanta adds TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. vendor AI answers with inline citations, file uploads in Issue Mgmt, and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. remediation via Agent beta.

    • Adds TPRM Vendor AI Answers public preview for pre-filling vendor portal responses
    • Enables file uploads (screenshots, PDFs, docs) directly to issues in Issue Management
    • Introduces Vanta Agent SLA Remediation beta via the new AI insights banner in the Policies tab
    • Adds QAuto support for automating spreadsheet questionnaires with custom dropdown responses (private preview)
    • Adds inline citations to TPRM AI answers referencing specific evidence and page locations

    +1 more show less

    • Updates Trust Center chatbot to respect applied tags for resource filtering

    6 details in Everything

77. Vanta Week of July 13, 2025 Week of Jul 13, 2025 · release notes

    New REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for policies and CSV issue export

    • Adds GET /api/v1/policies endpoint to list policies via the Vanta REST API
    • Adds GET /api/v1/policies/{id} endpoint to retrieve a specific policy by ID via the Vanta REST API
    • Adds .csv download for issues and their metadata in the UI for offline tracking

    3 details in Everything

78. Vanta Week of July 6, 2025 Week of Jul 6, 2025 · release notes

    Vanta adds issue-to-risk mapping, QAuto verbosity control, and CSV exports for Answer Library and Access Requests

    • Adds a new setting in the Audit Visibility section to control whether auditors can see control history (Growth+ plans only)
    • Enables exporting all access requests directly from the Access Requests page
    • Adds CSV export capability for the filtered Answer Library
    • Implements an AI classifier for QAuto to automatically determine optimal answer verbosity

    4 details in Everything

79. Vanta Week of June 29, 2025 Week of Jun 29, 2025 · release notes

    Vanta adds bulk Adaptive Framework Scoping by resource group, redesigned Azure DevOps code-changes auditor (beta), Pen Test import from Assets, and Wiz Vulns GA integration.

    • Adds Adaptive Framework Scoping capability to bulk mark resources in/out of scope by resource group for frameworks like PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27017
    • Introduces redesigned /code-changes auditor pages (beta) with support for Azure DevOps review groups
    • Enables direct access to Penetration Tests from the Assets > Vulnerabilities section for streamlined visibility
    • Makes the Wiz Vulns and Alerts integration generally available (GA) for all customers

    4 details in Everything

80. Vanta Week of June 22, 2025 Week of Jun 22, 2025 · release notes

    Vanta adds owner, category, and status filters across all risk report charts and AI-powered column detection for spreadsheet questionnaires.

    • Apply owner, category, and status filters to every chart in the risk report view
    • Use Vanta AI to automatically detect column types in spreadsheet questionnaires

    2 details in Everything

81. Vanta Week of June 15, 2025 Week of Jun 15, 2025 · release notes

    New Oracle Cloud integration, auditor action restrictions, and test SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. customization in Vanta.

    • Adds Test SLA Customization allowing users to customize a test’s SLA category to adjust priority or assign different SLAs based on organizational needs
    • Introduces Oracle Cloud GA integration featuring new product tests, expanded networking component support, region editing, and multi-tenant configurations
    • Provides compliance settings to limit auditor actions by preventing auditors from creating audits, modifying controls, or adding additional auditors

    3 details in Everything

82. Vanta Week of June 8, 2025 Week of Jun 8, 2025 · release notes

    Vanta adds Vanta MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. policies in Policy Builder, and new test visibility UI.

    • Adds Vanta MCP Server (Public Preview) to interact with Vanta data using LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for audit prep and automated remediation
    • Expands Policy Builder with two new GDPR policy templates alongside SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. and ISO 27001
    • Adds failing test entities by segment view on the Test Details page
    • Adds framework-specific tests table in the Tests section for streamlined navigation
    • Consolidates comment threads into a new Comment Notifications inbox

    +1 more show less

    • Redesigns the AWS Integration Overview Page with tabs for overview, capabilities, prerequisites, permissions, synced resources, and automation details

    6 details in Everything

83. Vanta Week of June 1, 2025 Week of Jun 1, 2025 · release notes

    Personal email tracking for 17 Merge HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. platforms, QAuto column adjustments, and TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. review locking.

    • Adds personal email tracking support for 17 additional Merge HRIS platforms to expand visibility into employee data.
    • Enables adjusting answer columns in spreadsheet questionnaires and selectively re-running AI responses for unapproved answers in QAuto.
    • Allows marking TPRM questions as reviewed to lock the primary answer while retaining visibility of latest AI and vendor responses.

    3 details in Everything

84. Vanta Week of May 25, 2025 Week of May 25, 2025 · release notes

    New comments/tagging on risks/controls, risk filter UI overhaul, personnel task filtering, QAuto verbosity settings, and Vanta AI link evidence for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data.

    • Adds the ability to comment on and tag teammates directly in Controls and Risks sections
    • Updates the Risk Register and Action Tracker with a new filter overflow pattern and default key filters
    • Adds filtering of the personnel table by individual security tasks and customizable column views for task progress
    • Enables manual adjustment of QAuto answer verbosity (Concise, Standard, Extensive, or AI-recommended) at the answer level
    • Allows Vanta AI to auto-populate vendor security questionnaires by accepting a link as evidence input

    5 details in Everything

85. Vanta Week of May 4, 2025 Week of May 4, 2025 · release notes

    Vanta adds granular control ownership, Wiz integration, and AI change summaries

    • steps In the People tab, access the new personnel in-app hub for step-by-step setup guidance.
    • Adds object-level owner role on controls to restrict user access to specific controls and mapped evidence.
    • Enables Wiz Issues integration for Growth+ customers to view misconfigurations and risks within Vanta.
    • Adds Vanta AI draft approval notes that compare policy drafts against last approved versions.

    4 details in Everything

86. Vanta Week of April 20, 2025 Week of Apr 20, 2025 · release notes

    Vanta adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. team sync, scheduled report delivery, TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. questionnaire library, document quick views, and policy approval messages.

    • Adds SCIM support to sync Vanta Teams with IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Groups for programmatic user management
    • Enables scheduling of reports for daily, weekly, or monthly email delivery with live links
    • Introduces a curated TPRM Questionnaire Library for creating customizable vendor questionnaires, including AI-specific use cases
    • Adds Document Quick Views to filter and display relevant documents based on required actions
    • Allows adding messages to policy approvals to provide context for approvers

    5 details in Everything

87. Vanta Week of April 14, 2025 Week of Apr 14, 2025 · release notes

    Vanta adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. team sync, AI policy mapping, and a new collaborator role for granular access.

    • Enables syncing Vanta Teams to IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Groups via SCIM for programmatic management
    • Adds AI-assisted mapping of security controls back to policies in the default or custom templates
    • Introduces a new collaborator role for object-level assignments and granular access control

    3 details in Everything

88. Vanta Week of March 31, 2025 Week of Mar 31, 2025 · release notes

    Report Center now exposes test breakdown metrics by status for program progress tracking.

89. Vanta Week of March 24, 2025 Week of Mar 24, 2025 · release notes

    Adds custom metadata fields (text, date, number, picklist) to Vendor Risk Management

90. Vanta Week of March 17, 2025 Week of Mar 17, 2025 · release notes

    Vanta adds standard TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. fields (contract amount, headquarters) and preserves evidence when merging vendors.

    • Adds Contract Amount and Vendor Headquarters as standard fields in Vendor Risk Management
    • Preserves security reviews, evidence, and findings from both sources during vendor merge operations

    2 details in Everything

91. Vanta Week of March 03, 2025 Week of Mar 3, 2025 · release notes

    Vanta adds team ownership for tests/docs, Trust Center privacy controls, and vendor risk Slack notifications.

    • Assign Teams as owners of tests and documents to improve accountability
    • Disable Full access requests on the public Trust Center via admin settings
    • Receive Slack notifications when questionnaires are submitted, evidence is complete, or security review is ready

    3 details in Everything

92. Vanta Week of February 24, 2025 Week of Feb 24, 2025 · release notes

    Vanta adds Merge.dev multi-tenancy, framework-scoped JumpCloud resources, questionnaire row deletion, AI vendor summaries, and vendor status migration

    • Adds Merge.dev Multi-Tenancy Support to manage multiple instances of the same integration
    • Allows scoping JumpCloud resources by framework for MDMsMDMsMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.
    • Enables deleting individual rows after importing a questionnaire response
    • Organizes Vendor AI answers in bullet points
    • Lets users move a vendor from Discovery into Procurement

    5 details in Everything

93. Vanta Week of February 17, 2025 Week of Feb 17, 2025 · release notes

    New framework scoping controls for Azure, GCP, AWS Organization sub-accounts and GitHub Organizations/Projects.

    • Adds framework scoping capabilities for Azure Organization sub-accounts, allowing users to scope individual accounts within organizations.
    • Introduces framework scoping for GCP Organization sub-accounts, enabling granular control over assets in sub-accounts.
    • Enables framework scoping for AWS Organization sub-accounts, providing more granular control over assets.
    • Adds configuration options to control which frameworks include GitHub Organizations and Projects as assets.

    4 details in Everything

94. Vanta Week of February 10, 2025 Week of Feb 10, 2025 · release notes

    Vanta adds an approval workflow to Questionnaire Automation with status tracking.

    • Adds approval workflow support within Questionnaire Automation, allowing approvers to be assigned and notified when a questionnaire is ready for review.

    1 detail in Everything

95. Vanta Week of February 3, 2025 Week of Feb 3, 2025 · release notes

    Vanta adds bulk one-time reminders for specific people via People Page table with Slack or email options

    • Admins can now send a bulk one-time reminder to selected people on the People Page table
    • Reminders can be sent over Slack, email, or both when selecting multiple personnel

    2 details in Everything

96. Vanta Week of January 28, 2025 Week of Jan 28, 2025 · release notes

    New Sensitivity Flag column on Documents table, streamlined control mapping via UI button, and ability to transition flagged evidence back to ready status.

    • Adds a new Sensitivity Flag column in the documents table to indicate if a document is sensitive
    • Adds an Add Controls button directly on the Policy details page for streamlined control mapping
    • Enables users to transition flagged evidence back into ready for audit status

    3 details in Everything

97. Vanta Week of January 20, 2025 Week of Jan 20, 2025 · release notes

    Vanta adds auditor evidence filtering and view-only RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permissions

    • Adds auditor-created evidence filter to the evidence list for users
    • Enables view-only permission option in custom role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles
    • Displays risk ID when mapping risk scenarios to a control

    3 details in Everything