They stack. Stop running a cage match.
Buyers ask "Vanta vs ScopeMantle" as if GRC and OAuth inventory compete. They do not. Vanta is good at control workflows, personnel evidence, device posture integrations, and the auditor room. ScopeMantle is good at listing every third-party grant on Google and Okta, scoring it, revoking it, and handing you a file the questionnaire was waving at.
Use both when budget allows. If an auditor already flagged OAuth and you can only buy one thing this quarter, buy the inventory. A green Vanta control with no live export fails the first time someone asks for twenty grant rows.
What Vanta is for
Policy attestations. Onboarding evidence. Access reviews of the human-login kind. Audit project management. A mature ecosystem for SOC 2 and ISO programs. I am not going to pretend we replace that. We do not have a personnel module. We do not pretend to.
Where the OAuth gap shows up
Questionnaires ask who has access to production data via vendors. People attach a logo spreadsheet. OAuth grants are delegate access. They do not appear in a standard UAR. Annual vendor surveys do not catch Tuesday's AI extension. That is the Tuesday ScopeMantle is for.
CC6.7 and CC9.2 get mashed together in Vanta because both say "access." Keep the packets separate. User-access reviews stay in their control. Grant exports attach to CC9.2. Educate the auditor once, in kickoff. See the checklist and mapping.
What ScopeMantle adds
- Daily grant inventory from Google Workspace and Okta (GA).
- Scope Sanity and the other three score dimensions.
- Attestation with ninety-day expiry.
- Bulk revoke and a log.
- DSAR processor list from the same data, if privacy wants it.
Entra is Beta. HIPAA is not attested. No BAA. No invented customer counts.
Joint operating model
- First business day after quarter close: export ScopeMantle CSV and PDF.
- Name it
oauth-CC9.2-YYYY-QX.csv(orVanta-control-CC9.2-YYYY-QX.csvif that is your house style). - Hash it. Attach to the Vanta evidence request the same week. View-only for the auditor.
- Link revoke tickets (Jira is GA; ServiceNow is Beta) to the Vanta task ID if you want traceability.
- Optional: DSAR median as a second attachment for GDPR programs that run in parallel.
- Same week: update the board slide. Minutes reference the OAuth sentence.
Questionnaire-only Vanta controls without a live export fail when the auditor samples grant detail. Walk through which controls are automated versus human-attested. That conversation is cheaper in week one than in the draft report.
What not to do
- Re-type grant counts into a Vanta text field and call it continuous monitoring.
- Claim ScopeMantle is a GRC platform.
- Claim Vanta inventories refresh tokens unless you have seen that export with client IDs and scopes.
- Promise ServiceNow workflows while that connector is Beta.
- Launder our design-partner phase into a "hundreds of joint customers" sentence. We do not publish that.
Pricing honesty
ScopeMantle: $5 per employee per month annual, $6 monthly, no seat min, custom 500+, 30-day trial. Vanta pricing is theirs. Check their site. TCO is both subscriptions plus the hours you no longer spend rebuilding a spreadsheet the week before fieldwork.
What to do this week
- Open the CC9.2 (or vendor-risk) control in Vanta. See what is attached. If it is a questionnaire, you have the gap.
- Export Google Admin apps once. Attach that CSV as a stopgap. Label it manual.
- Read the checklist. Schedule the quarterly export as a recurring ticket.
- Trial ScopeMantle if you want the file to stay current.
Walkthrough script for the auditor (joint)
Open Vanta on the CC9.2 (or vendor) control. Show the attached CSV. Open the hash in GRC. Open ScopeMantle (or Admin) and regenerate the same count. Explain one revoke that is also a Jira ticket linked in Vanta. Explain one exception with expiry. Close the UAR packet and say it is CC6.7. Total time: 20 minutes if you practiced. 90 minutes if you did not.
If Vanta's vendor questionnaire says "we review vendors annually" and your grant list shows 40 new AI tools this quarter, do not hide the list. Show both. The questionnaire is the intent. The export is the test. Auditors can tell.
Who pays for what
GRC budget already owns Vanta (or Drata, or Secureframe: same shape). Security / identity budget owns inventory. Do not steal the GRC renewal to buy us and then fail personnel evidence. Do not steal the identity budget to buy another questionnaire seat and then fail the OAuth sample. The complementary story exists so those two budgets can stop fighting.
We will not publish a "Vanta + ScopeMantle joint customer count." If a seller on either side does, ask for names. We will not provide them on customers until a design partner agrees to be named.
ISO and GDPR riders
ISO A.5.19 can reuse the same CSV with a different cover memo. GDPR Article 32 testing can reuse the tabletop. DSAR metrics are a second export, optional. Do not force privacy metrics into the SOC 2 slide if the committee did not ask. See the board template for how to split.
Failure modes
- Green Vanta control, empty attachment.
- Attachment from last year.
- Threshold edited the night before fieldwork.
- ServiceNow promised while Beta.
- HIPAA implied because Vanta has a HIPAA product. We do not.
Quarterly calendar you can share with GRC
Week 1 after quarter close: export, hash, attach, board slide. Week 2: GRC owner confirms the Vanta request is not still "in progress" with no file. Mid-quarter: weekly digest stays operational and does not go into Vanta. Week before fieldwork: regenerate nothing unless the hash is lost, in which case you regenerate and explain. After fieldwork: one improvement ticket (cadence, threshold, cascade), not a twelve-item wish list.
If GRC wants "continuous monitoring" language, the event stream to Splunk or Datadog (GA) is the honest version. A questionnaire answered each Monday is not continuous. Elastic is Beta. Chronicle is Roadmap. Say the words.
Procurement FAQ
Can we drop Vanta? Only if you like rebuilding personnel evidence by hand. Can we drop ScopeMantle after year one? Only if you like rebuilding the grant CSV the week before audit. Can we get a bundle discount from us for Vanta? No. We do not resell Vanta. $5 / $6, no seat min, custom 500+, trial via /demo. Their price is theirs.
Field guide: the first joint quarter
Agree the filename in week one, not in week twelve. Agree who clicks attach in Vanta. Agree that weekly digests never go into the auditor room. Agree the threshold change process (change ticket, not a Slack poll). Then run one quarter. If the attachment is still a questionnaire, you did not run the joint model. You ran a meeting.
If Vanta's CSM promises an OAuth integration, ask to see client IDs and scopes. If they cannot, keep attaching our CSV. Complementary remains the word. Cage match remains a waste of budget theater.
We do not resell Vanta. They do not resell us. $5 / $6, no seat min, custom 500+, Entra Beta, HIPAA not attested, ServiceNow Beta, Jira GA. Trial.
Mistakes I keep seeing after the first workshop
People export once and call it culture. People revoke by display name after a rebrand. People promise Entra completeness. People put OAuth rows in the user-access matrix. People send DSAR mail without a case ID. People treat a CASB invoice as grant inventory. People change a score threshold the night before audit. People staff an MSSP sprint with someone who cannot read a scope string. Each of those has a fix already on this page. The failure is skipping the fix because the demo looked polished.
Write the one thing you will not skip this week. Put it on a calendar. If you want the inventory to stay current, the 30-day trial is the productized version of the export. Five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom terms at 500+ employees. Microsoft Entra stays labelled Beta. HIPAA is not attested. Templates stay operator-reviewed. No fabricated customer counts on the customers page.
If you are evaluating us next to a GRC tool, keep both jobs honest. If you are evaluating us next to a consent-intercept tool, stack prevention and inventory. If you are an MSP, register the deal before the demo and keep the counsel gate in the SOW. If you are writing a board slide, use last quarter as the only benchmark we will stand behind. That is enough program for a quarter. The next quarter is whether the leftover-grant count actually moved.
A note for the GRC analyst who has to click attach
You are not failing if the file is ugly. You are failing if the file is missing. First quarter can be a manual Admin CSV labelled manual. Second quarter should be the product export if the trial converted. Do not re-type counts into a text field. Do not store the only copy in Slack. View-only for the auditor. Hash in GRC. That is the job. The cage-match meeting is not the job.
If someone asks for a joint customer count, send them to customers. It will not list names we do not have. That is intentional.
What you can do without buying anything
Export the IdP list. Deduplicate on client ID. Revoke three rows you cannot explain. Write the CC9.2 versus CC6.7 sentence for your auditor. Add OAuth grants equals zero to offboarding. Put an extension allow-list in one OU. Schedule a Friday tabletop with a fictional client ID. Hash a file and put it in GRC. Those steps do not require ScopeMantle. They do require a calendar and a human who will not skip them.
When those steps start to rot (and they will, usually by week six), the productized version is daily Google and Okta sync, scores, attestation expiry, bulk revoke, and DSAR snapshot on the same inventory. Price is public. Beta labels stay on the page. We will not invent a case study to make the last paragraph feel finished. Start the trial if the calendar is already losing.
Agree the filename in week one of the quarter, not in week twelve. The analyst who clicks attach deserves a boring convention. Slack is not a repository. The auditor room gets view-only. That is the joint model in one paragraph.
Related reading stays on the internal paths already linked above: platform, integrations, demo, and the companion resources or blog posts for this topic. Use those links when you brief a colleague so they get the same product truth: public $5 / $6 pricing, no seat minimum, custom at 500+, Entra labelled Beta, DSAR templates operator-reviewed, no HIPAA attestation, no invented logos. That is the briefing. Everything else is the procedure you can run this week.