Man #Vanta is so bad…
Their Entra MFA enforcement check is horrible.
It only checks if a conditional access policy exists, and if it has ‘MFA’ in the builtinControls. If it does, it’s a pass.
But it doesn’t check…
-
if any users are excluded from the policy
-
if any groups are excluded
-
if the policy covers all users even after exclusions (e.g. if the exclusions are service accounts for any reason)
-
if the geoblocking is functional
-
if any of the excluded users are privileged
Vanta is a tool designed to mislead auditors, presenting as a third-party authority with their ‘trust center’ and all the flashy shiny dashboards.
Yet the core is rotten.
I haven’t been this insulted since I found out that #vanta has a barely functional risk API (was trying to sync our risk register from our internal repo… long story).
Just… I lack words.
#infosec #cybersec #grc #privacy #compliance #fintech #informationsecurity #audit #soc2