What moved this quarter

SOC 2 compliance automation vendors used Q2 to move beyond checklist automation: Vanta, Delve, Scytale, Scrut, CyberSierra, RegScale and others expanded AI-governance frameworks, agentic GRC products, MSP delivery and federal-compliance coverage.

• AI Governance Expands — A Lign added AI Governance and AI ASCEND, Complyjet expanded to 25+ frameworks including ISO 42001, Delve added SOC 2, HIPAA, ISO 27001, GDPR, PCI-DSS and ISO 42001, and Scytale added AI governance plus CMMC. AI-risk coverage is becoming a visible buying criterion, not a buried roadmap item.
• Agentic GRC Arrives — Controlmap added an AI Copilot for evidence review and questionnaires, Scrut introduced AI-native architecture with an open MCP server, Anecdotes added Findings Management and Auto Risk Calculation, and A Lign launched AI ASCEND. Compliance vendors are packaging audit work as specialized AI teammates.
• MSP And Federal Push — Controlmap added GovCloud CMMC SSP and SPRS tools, Apptega targeted MSSPs with 75% manual-work reduction claims, Regscale added Government Contractors and FedRAMP 20x package messaging, and Trycomp added FedRAMP, NIST and PCI DSS. Distribution is shifting toward managed compliance and regulated markets.

Market signals on the board

Only lanes with tracked evidence for Q2 2026 are emphasized. No filler lanes just to make the page look busy.

• Product and capability — Public-web product and capability signals found in the SOC 2 Compliance Automation Software category for Q2 2026.
• Messaging and positioning — Public-web messaging and positioning signals found in the SOC 2 Compliance Automation Software category for Q2 2026.
• Security, compliance and access — Public-web security, compliance and access signals found in the SOC 2 Compliance Automation Software category for Q2 2026.
• Pricing and packaging — Public-web pricing and packaging signals found in the SOC 2 Compliance Automation Software category for Q2 2026.
• Integrations and APIs — Public-web integrations and apis signals found in the SOC 2 Compliance Automation Software category for Q2 2026.

Competitor changes for Q2 2026

Changed companies get evidence-backed cards. Quiet companies stay visible so the category file does not accidentally become a highlights reel.

• A Lign — a-lign.com
  • Product and capability: Added AI Governance and AS9100 services and unveiled AI ASCEND platform capabilities.
  • Product and capability: Expanded NIST 800-171 services from one assessment to six: readiness, self-assessment scoring, third-party assessment, remediation, CMMC Level 2 certification, and ongoing monitoring.
  • Messaging and positioning: Homepage hero text changed to 'Rigor, made repeatable' and value proposition shifted to emphasize expert judgment, technology, and proven process.
• Anecdotes — anecdotes.ai
  • Security, compliance and access: Anecdotes added 'Stop Compromising' value-proposition framework across governance, risk, compliance, and accuracy pillars.
  • Product and capability: Added enterprise features: Findings Management, Auto Risk Calculation, and Multi-Entity Management.
  • Product and capability: Anecdotes removed legacy capabilities: Data Delegation, Scale Advisor, and Screenshot Activator.
• Apptega — apptega.com
  • Security, compliance and access: Apptega released a report finding that 90% of security providers face market differentiation challenges.
  • Integrations and APIs: Apptega Hero copy rewritten to target MSSPs and security teams, citing 75% manual work reduction and fast ROI.
  • Product and capability: Learn menu featured headline changed from Third-Party Risk Manager enhancement to Operating System for security, risk, and compliance transformation.
• Auditboard — auditboard.com
  • Product and capability: Added Controls Management, Autonomous Testing, and AI Governance products; removed SOXHUB; renamed ITRM to Cyber Risk Management.
  • Product and capability: Replaced ESG product with Business Continuity Management (BCM) in platform product listings; 1 related product and capability change reinforced the same Business Continuity Management signal.
  • Messaging and positioning: Redesigned homepage hero and value proposition, pivoting from 'AI-first GRC' to 'GRC Intelligence' with agentic positioning and solution-based modules.
• Certification Automation By Onetrust — onetrust.com
  • Integrations and APIs: Certification Automation By Onetrust added AI agents, data discovery across 200+ connectors, dynamic data graphs, and AI-accelerated assessments.
  • Pricing and packaging: Removed free trial offer; hero and nav CTAs changed from 'Free trial' to 'Contact Sales' / 'Talk to Sales'.
  • Product and capability: Certification Automation By Onetrust expanded framework library from over 20 to 50+ and added NIS2 as a newly supported framework.
• Trycomp — trycomp.ai
  • Pricing and packaging: Trycomp reduced free-plan emphasis and pushed demo bookings and workflow-fit language, shifting conversion toward sales-led evaluation.
  • Product and capability: Trycomp added expert-run penetration testing with remediation tracking and final report generation.
  • Product and capability: Added FedRAMP, NIST, and PCI DSS to supported compliance frameworks.
• Complyjet — complyjet.com
  • Integrations and APIs: Complyjet Increased supported integrations from 200+ to 350+.
  • Product and capability: Added product modules: Questionnaire Automation, Risk Management, Vendor Risk Management, Access Reviews, Policy Management, Personnel Management, Security Awareness Training, MDM Agent, and Vulnerability Management.
  • Product and capability: Expanded supported compliance frameworks to over 25, adding NIST CSF, HITRUST, ISO 42001, and custom frameworks.
• Compyl — compyl.com
  • Product and capability: Added FAIR-based risk quantification with Monte Carlo simulations.
  • Product and capability: Introduced industry-specific GRC programs for Financial Services, Healthcare, Legal, Insurance, Energy & Utilities, and Higher Education.
  • Security, compliance and access: Compyl expanded framework coverage to include ISO 42001, CCPA, and NIS2.
• Controlmap — controlmap.io
  • Product and capability: Controlmap added AI Copilot module to interpret requirements, review evidence, draft documentation, and answer questionnaires.
  • Product and capability: Added CMMC SSP and SPRS generation tools with GovCloud hosting for defense industrial base clients.
  • Product and capability: Replaced employee-facing My Compliance Portal with multi-tenant client-facing Trust Portals and Trust Center.
• Cybersierra — cybersierra.co
  • Security, compliance and access: Cybersierra removed "Who It Is For" buyer persona section featuring CISO, Head of Compliance, Group CISO, and IT Governance/CII Operator roles.
  • Product and capability: Added air-gapped, on-premises, and bring-your-own-model deployment options with 140+ integrations to existing stacks.
  • Product and capability: Cybersierra Rebranded product name from "Controls Break AI Analyst" to "Continuous Controls Monitoring AI Analyst" throughout the page.
• Cypago — cypago.com
  • Product and capability: Added support for ISO 42001 and NIST AI RMF compliance frameworks.
  • Messaging and positioning: Added contact form with name, company, email, and country fields to pricing page.
• Delve — delve.co
  • Pricing and packaging: Added Startup, Midmarket, and Enterprise segments with tailored value propositions.
  • Product and capability: Delve added segment- and framework-based top navigation.
  • Product and capability: Expanded product offering to cover SOC 2, HIPAA, ISO 27001, GDPR, PCI-DSS, and ISO 42001 compliance frameworks.
• Drata — drata.com
  • Messaging and positioning: Top promo banner swapped from AI Agent Governance early-access pitch to The State of GRC in the Age of AI report.
  • Messaging and positioning: Replaced featured resource card: 'The Modern Enterprise GRC Buyer's Handbook' swapped for 'State of GRC in the Age of AI'.
• Hicomply — hicomply.com
  • Pricing and packaging: Hicomply Demo form stripped of contact fields; only Company headcount and referral source remain.
  • Product and capability: Added United States regional site with country selector and /en-us localized page paths.
  • Product and capability: Page localization changed from United Kingdom to United States; 1 related product and capability change reinforced the same United Kingdom signal.
• Hyperproof — hyperproof.io
  • Product and capability: Hyperproof added product screenshot showing the "Standardize your risk intake" interface.
  • Product and capability: Added Policy Management as a standalone product module with a dedicated page.
  • Product and capability: Launched a dedicated Audit Management product page (previously linked to the Compliance product page).
• Kertos — kertos.io
  • Product and capability: Refreshed integration partner showcase, adding Hive, Okta, Rippling, Workday, UKG Pro, Zelt, and other logos.
  • Product and capability: Added Privacy Management, Information Security, and AI Governance compliance platform modules.
  • Product and capability: Kertos removed DORA from supported regulations.
• Orbiq — orbiqhq.com
  • Security, compliance and access: Orbiq Rebranded page as B2B SaaS compliance hub; updated title and description; added GDPR Article Cluster link table; condensed Articles 28 and 32.
  • Product and capability: Added AI Search, Vendor Assurance, and Slack Integration as platform modules.
  • Messaging and positioning: Removed Trust Center detail blocks: Branded Public Profile, Restricted Evaluation Space, and NDA-protected Deep Dive.
• Regscale — regscale.com
  • Pricing and packaging: Regscale replaced homepage statistics with updated framework count and FedRAMP 20x package timeline claims.
  • Product and capability: Added Government Contractors industry vertical to Solutions mega-menu with dedicated page; 3 related product and capability changes reinforced the same Added Government Contractors signal.
  • Product and capability: Compliance profiles expanded from 7 to 83, adding CCF V4 frameworks and High, Low, and Moderate impact-level filters.
• Scrut — scrut.io
  • Security, compliance and access: Scrut Startup offering messaging shifted from speed-to-compliance to continuous audit-readiness.
  • Product and capability: Introduced AI-native architecture featuring a common data layer, reinforcement learning, cross-domain intelligence, and an open MCP server.
  • Product and capability: Scrut Increased supported frameworks from 60+ to 70+.
• Scytale — scytale.ai
  • Integrations and APIs: Scytale added Azure Monitor, GCP Cloud Logging, GCP Cloud Monitoring, GCP Security Command Center, Azure Databases for MySQL Flexible Server, Azure Resource Manager, and NinjaOne integrations.
  • Product and capability: Added AI governance, People compliance, executive insights, and Regulatory Radar as platform capabilities.
  • Product and capability: Added CMMC framework support and expanded framework coverage from 40+ to 60+ security, privacy, and AI frameworks.
• Secureframe — secureframe.com
  • Pricing and packaging: Secureframe added Germany, Spain, and France locale options linking to localized pricing pages.
  • Product and capability: Secureframe added User Access Reviews and Auditor Module.
  • Product and capability: Replaced C3PAO Partner Network feature with Real-time SPRS Scoring and redirected Expert Support and Assessment-Ready Package toward self-assessment and SPRS submission.
• Sprinto — sprinto.com
  • Messaging and positioning: Homepage hero and value proposition rewritten as 'world's first Autonomous Trust Platform' with trust-stage journey and competitive comparison messaging.
• Strikegraph — strikegraph.com
  • Product and capability: Added Trust Center feature to the platform's Product menu; 1 related product and capability change reinforced the same Added Trust Center signal.
  • Product and capability: Moved 'System Security Plan (SSP)' to 'Pen testing' section in product navigation.
  • Messaging and positioning: Replaced inline lead-capture forms and email fields with button-only CTAs for demos and downloads.
• Thoropass — thoropass.com
  • Integrations and APIs: Thoropass added ADP integrations, clarifying ecosystem fit for buyers evaluating workflow coverage.
  • Product and capability: Thoropass added Vulnerability Scanning to product offerings.
  • Product and capability: Added Sam Li (CEO & Co-founder) and Austin Ogilvie (Executive Chairperson & Co-founder) to leadership team.
• Trustcloud — trustcloud.ai
  • Security, compliance and access: Trustcloud added 'hallucination-free' accuracy claim to the Security Assurance Platform description.
  • Product and capability: Enhanced TrustLens with agentic third-party cyber assessments using outside-in security signals and inside-out control assurance.
  • Messaging and positioning: Added top banner citing IDC analyst recognition of Application Assurance as a GRC advancement.
• Trustero — trustero.com
  • Product and capability: Trustero added RCSA automation solution for risk and controls self-assessment programs.
  • Product and capability: Added modules: Evidence Management, Continuous Control Monitoring, Policy and Control Assessment, TI Playbooks, Requests, Reports and Dashboards, and Trust Portal.
  • Messaging and positioning: Product messaging pivoted from standalone AI tools (AI Suite, Control Assurance) to an agent-driven functional architecture.
• Vanta — vanta.com
  • Pricing and packaging: Vanta removed inline demo request form from 'Request a demo to get started' section.
  • Product and capability: Added Customer Commitments product to track and manage commitments.
  • Security, compliance and access: Vanta Framework overlap stats changed: HIPAA 65%→40%, GDPR 40%→35%.

No material public-web move found

These competitors were included in the quarterly sweep, but no material public-web moves showed up during the window.

• Isms. — isms.online
• Oneleet — oneleet.com

Prior quarter files

This is the first generated quarterly file for this category.

Get the next SOC 2 Compliance Automation Software report

The public page is the short read. The inbox dossier carries source URLs, screenshots, change notes, quiet companies and the sharper operator memo.