Product Updates

Linear integration, rebuilt: you choose what Vanta can do The Linear integration has been rebuilt around what you want from it, instead of one access level for everything. What’s new:

Syncs are also faster and more reliable, with better data coverage. Your Linear, your rules. & tagging in Jamie F. bc what would a post about linear be without you, jamie???? --- Availability: Available today for customers connecting Linear for the first time. Existing Linear customers will move over progressively, with no action required

Manage more of your controls from the Vanta Agent and MCP Keeping your controls library tidy no longer means leaving your agent workflow. Authorized users can now handle more control tasks from the in-app Vanta Agent or any tool connected through MCP, with existing permissions applied. Custom controls Delete them: Remove custom controls along with their framework, test, and evidence mappings. Only custom controls can be deleted. Vanta-managed controls and Vanta controls your org has modified are rejected, with a reason for each. Deletions are recorded in the event log and attributed to the person who made them. Common controls (MCP)

Deactivated controls Review past decisions: Retrieve an individual deactivated control, with its details and state, through the Agent or MCP. It’s strictly read-only, so nothing is reactivated or changed --- Availability: MCP users, per appropriate access levels

Jira integration, rebuilt: you choose what Vanta can do The Jira integration has been rebuilt around what you want from it, instead of one access level for everything. What’s new:

Syncs are also faster and more reliable. Your Jira, your rules. Some photos in thread 🧵 --- Availability: Available today for customers connecting Jira for the first time. Existing Jira-connected customers will will see this as a progressive rollout across the coming weeks, with no action required.

Connect DocuSign to Customer Commitments Your executed agreements already live in DocuSign, so there’s no reason to upload them again by hand. Now, connect your DocuSign account directly to Vanta, and eligible contracts flow into the Customer Commitments processing you already use, ready to extract, organize, and analyze. You can see how it’s configured, check what was ingested, and get clear failure handling when something goes wrong, so you know what to fix. Beautiful. --- Availability: Customer Commitments customers

15 new automated tests for Azure and Azure Government More of your Azure environment is now covered by continuous monitoring. Fifteen new automated tests span network security, data protection, logging and auditing, application security, threat detection, and operational resilience, across services including Firewall, SQL Database, App Service, Storage, and Microsoft Defender. They cover both the Azure and Azure Government integrations and their compliance frameworks, so you see compliance gaps sooner and catch regressions earlier. --- Availability: Across all plans, where Azure integration is used

A weekly digest of overdue documents, on your schedule Chasing document owners one by one is nobody’s favorite job. The new Evidence Tasks Report, a custom agent template, builds a weekly digest of every document that’s overdue or due soon, with links, owners, due dates, status, and suggested next steps. It runs on the schedule you choose, so compliance leads can follow up without tracking anything by hand. Beautiful! Your follow-up list, ready when you are. --- Availability: Across plans with AI opt-in/custom agents enabled

Automate vendor intake with the Vanta Agent When a vendor request lands in your inbox, someone has to research the vendor, size up the risk, and scope the right assessments. Now the Vanta Agent can run that intake for you, using the context you’ve set in TPRM settings and your custom agent, facts from public sources, and your answers when it needs a human decision. What it handles:

Want to make it yours? Fork the Vendor Intake template and edit the prompt with your own rules. The five skills behind it (intake, placement, fact sourcing, risk profile review, and assessment scoping) can also be run on their own, any time, in the Agent. --- Availability: Customers with TPRM Advanced, TPRM Advanced with Continuous Monitoring

Sharing evidence in TPRM just got smoother, for vendors and for you Evidence moves between vendors and buyers on every assessment, so small bits of friction add up fast. Here’s what’s cleaner now:

--- Availability: TPRM customers

Update vendor details in chat with the Vanta Agent Managing your vendor inventory through the Vanta Agent no longer stops once a vendor is created. Ask the agent to update nearly every field on a vendor, not just risk scores: name, website, category, and headquarters; status; business owner and authentication method; point of contact details; services provided and additional notes; contract details; and custom fields. Changes show up on the vendor record in the UI, so there’s no second pass to finish setup by hand. Consider this vendor upkeep, minus the clicking. --- Availability: TPRM customers

Early Access: Per-document approval chains: the right approvers for every document This is currently in private preview, but if you want access earlier, keep reading. One approval chain for every document never fit complicated approval processes. You can now assign an approval chain unique to each document, mirroring the policy approval experience you already know. Approvers automatically get access to exactly what they need to review, and that access ends when they’re removed from the chain, so no one needs broad org-level document permissions just to sign off. Existing global-chain approvals keep working as they do today. Want in early? Complete the workflow. ⚠️ Deadline to express interest: Friday, November 6, 12pm EST. --- Availability: Plus plans and above

Bitbucket integration, rebuilt The Bitbucket integration has been rebuilt from the ground up, giving you more control before the first sync and more clarity when something needs fixing. Choose which repositories Vanta syncs before the first sync: all of them, all except specific ones, or only specific ones. During setup, a permission check tells you right away if the connecting account can’t read a workspace, so you hear about it in the connection flow instead of after the first sync. Once you’re connected, you get more visibility:

Syncs are also faster and more reliable, with better data coverage. --- Availability: Available today for customers connecting Bitbucket for the first time. Existing Bitbucket customers will move over progressively, with no action required. Stay tuned

Make Vanta’s risk scoring speak your language Your risk methodology has its own terms, so your risk scoring should too. Admins can now view and edit their scoring profile, stage names, and descriptions right in risk settings, so reviewers see familiar guidance at every stage instead of translating Vanta’s labels into yours. Each scoring stage, such as inherent, residual, and target risk, has a name and a description. Defaults are prefilled if you haven’t set any, and any custom text you already have is preserved. 🎥 demo! --- Availability: New customers now. Existing customers can join early access starting Nov 2, with sign-up required.

Ask the Vanta Agent about your risk score definitions Need to check what your risk score stages mean, or change them? You can now ask the Vanta Agent about your configured stage names and definitions, and make supported updates right in the conversation, with no detour through a separate settings flow. If you change your profile types, the agent walks you through whether your existing scores should count as Inherent or Residual, since teams define “inherent risk” differently, either before or after controls are applied. Your risk vocabulary, one question away. 🎥 demo! A note on timing: This release is for new customers to Vanta. For current customers: If you're interested, early access opens for you starting Nov 2, and you can sign up here. If you have the Advanced Risk Management sku, also get early access to several other new Risk features, shown in this demo. --- Availability: Essentials, Plus, Professional, Scale, and Enterprise (Modular) plans with Compliance & Audit Management, Advanced Risk Mgmt (where applicable).

Automated tests for your AI use cases and AI assessments Proving that your AI documentation stays maintained shouldn’t mean checking it by hand. New automated tests now monitor your AI use cases and AI assessments, and you can link them to controls in AI frameworks, so continuous, automated evidence backs up your compliance work. Let the tests keep watch over your AI documentation. UPDATE: More to come on this at VantaCon!

Iru integration, rebuilt The Iru integration has been rebuilt from the ground up, with more control before the first sync and more visibility when something goes wrong. You decide what comes in before anything syncs. Choose device groups to exclude before the first sync, so there’s no more connecting, letting every device flow in, and cleaning up afterward. Every platform Iru returns now syncs too, including iPhone, iPad, Apple TV, and Android, where the previous integration covered only Mac and Windows. When something needs attention, you get the details:

Syncs are also faster and more reliable, with better data coverage.