# Scrut Automation — Information Security Scrut Automation by Scrut Automation Pvt. Ltd. holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-15. Provenance: provenance unknown; sovereignty: not determined. - Vendor: Scrut Automation Pvt. Ltd. (https://scrut.io) - Category: [Information Security](https://whats-best.ai/software/information-security.md) - Provenance (editorial classification): provenance unknown - Canonical page: https://whats-best.ai/software/information-security/scrut-automation - Alternatives: https://whats-best.ai/software/information-security/scrut-automation/alternatives ([markdown](https://whats-best.ai/software/information-security/scrut-automation/alternatives.md)) - Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: Scrut Automation Pvt. Ltd. - Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026 - Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026 - Free plan: Not stated on the vendor’s pages as of 13 Oct 2026 ## The panel's verdict Scrut Automation is a security-compliance platform whose strongest showing is framework coverage at 8-9: 70-plus out-of-the-box frameworks, including NIS 2, DORA and TISAX V5.1, mapped through a Unified Control Framework onto a single control set. Controls and statement-of-applicability work follows at 6-7 — the SoA is generated per ISO framework with justification and policy references auto-populated at export — and audit readiness sits at 7 on a per-requirement zip export with linked evidence, findings and corrective actions. The weak spots are sharp: information security management clusters at 4, since automated asset discovery from cloud, MDM and code repositories is real but we found no public information on risk methodology, treatment tracking or incident handling; sovereignty sits at 0-1, where the captured terms name Riversys under Indian law and Scrut Automation Inc. under Delaware law, with arbitration in New Delhi or San Francisco, and no public information on hosting locations, a DPA or a subprocessor list. The judges show no genuine split — no criterion spans more than one point. We found no public prices for the Foundation, Growth and Scale tiers. **Speaks for it:** - Framework coverage scores 8-9, with 70+ frameworks out of the box mapped through a Unified Control Framework onto one control set - The Statement of Applicability is generated per ISO framework with policy references auto-populated at export and a version-control tab carrying revision history - The Audit Package exports a per-requirement zip of linked policies, evidence, tests, findings, requests and corrective actions for offline review - Automated asset discovery syncs cloud platforms, MDM tools and code repositories with owner and criticality metadata - A documented API exchanges client credentials for short-lived tokens with credential audit logging, available on Foundation, Growth and Scale plans **Held against it:** - Information security management scores cluster at 4, and we found no public information on risk methodology, treatment tracking, risk acceptance or incident handling - Sovereignty scores sit at 0-1, with the captured terms naming Riversys under Indian law and Scrut Automation Inc. under Delaware law and arbitration seated in New Delhi or San Francisco - We found no public information on hosting locations, data residency, a data processing agreement or a subprocessor list - We found no public information on control-measure ownership, due dates, delegation or escalation - We found no public information on ticketing or CMDB connectors, webhooks, or SSO and SCIM provisioning **Best for:** - You run ISO 27001 alongside NIS 2, DORA or TISAX and want many frameworks answered from one control set with reusable evidence - You prepare ISO certifications in-house and want a generated Statement of Applicability with auto-populated policy references rather than a consultant's spreadsheet - You maintain your asset inventory by hand and want automated discovery from cloud platforms, MDM tools and code repositories with owner and criticality metadata - You want to script evidence uploads and vulnerability findings against an API available on the Foundation, Growth and Scale plans **Avoid if:** - You need a documented risk methodology, treatment tracking, risk acceptance with ownership and incident workflows with statutory reporting clocks before you sign — this is where the bench scored lowest on product depth - You must contract with a European entity or under European law; the captured terms name Indian and Delaware contracting paths with arbitration in New Delhi or San Francisco - You need to reconstruct the ISMS state on a past date or hand auditors dedicated access roles, which the captured pages do not document - Your toolchain depends on ticketing or CMDB connectors, webhooks or SSO and SCIM provisioning beyond the documented cloud, MDM and code-repository feeds ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price. | Criterion | The CISO | The GRC Consultant | The Drafted IT Officer | The Lead Auditor | The Evidence Integrator | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Asset & risk management depth | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | | Controls, SoA & measures | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Framework & standard coverage | 4/5 | 4.5/5 | 4/5 | 4/5 | 4/5 | 4/5 | | Audit readiness & evidence | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Integrations & automation | 3/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 | | European sovereignty | 0/5 | 0.5/5 | 0.5/5 | 0/5 | 0.5/5 | 0/5 | | Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r | | **Weighted verdict** | **2.5/5** | **3/5** | **2.5/5** | **3/5** | **3/5** | **2.5/5** | ### The judges - **The CISO** (v1.0): Owns the ISO 27001 certificate and the NIS2 exposure of a 400-employee company. Optimizes for a real risk backbone: methodology, inheritance, incident clocks, a statement of applicability that is never stale. Rejects checklist theater and risk registers that cannot answer who accepted what. - **The GRC Consultant** (v1.0): Builds and runs ISMSs for a dozen clients at once. Optimizes for reusable control catalogs, multi-framework mapping that answers a control once, and templates that make client twelve cheaper than client one. Rejects single-tenant tools and frameworks bolted on as checklists. - **The Drafted IT Officer** (v1.1): SME IT admin who became the information security officer by an email from management. Optimizes for guided setup, sane defaults, plain-language controls and a tool that runs alongside the day job. Rejects platforms that assume a security team and a consultant on retainer. - **The Lead Auditor** (v1.0): Certifies ISMSs for a living and has seen every folder of screenshots. Optimizes for revision-safe history, an SoA generated from live control status, and a defensible answer to "show me the state on date X". Rejects audit trails assembled the week before the audit. - **The Evidence Integrator** (v1.0): Believes evidence that is typed is evidence that is stale. Optimizes for connectors to the live estate — directory, CMDB, ticketing, cloud — continuous control checks, and an API with parity to the UI. Rejects data islands with a CSV drawbridge. - **The Skeptic** (v1.1): Hunts "100% audit success" claims, framework logos that link nowhere, "coming soon" integrations sold as shipped, consulting bundled as software, and customer counts that disagree between pages. Exists to keep the rest of the bench honest. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Ownership | Not determined | — | — | | Data residency | Not determined | — | — | | Subprocessors | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - Anti bribery: FCPA 1977 · UK Bribery Act 2010 · UK Modern Slavery Act 2015 · California Transparency in Supply Chains Act 2010 [S2] - DPA reference: https://www.scrut.io/dpa · yes [S2] - Export controls: yes [S2] - Scc incorporated: yes [S2] **Data** - Post termination export: 30 · 1 [S2] - Retention after offboarding: yes · 5 · one year [S2] - Security measures: commercially reasonable industry standard measures · yes [S2] **Integrations** - API credentials: API credentials consist of client ID and client secret exchanged for short-lived access token [S11] - API plans: Foundation · Growth · Scale [S11] - Audit logging: yes [S11] - Client secret shown once: yes · no [S11] - Credential expiry options: 12 months (default) · Never · Custom Date [S11] - Credential name limits: yes · yes · 50 [S11] - Credential revocation: yes · no [S11] - Credential scopes: Read Only · Read & Write [S11] - Credentials admin required: Org Admin [S11] **Legal** - Contracting entity india: Riversys Technologies Private Limited · India [S2] - Contracting entity outside india: Scrut Automation Inc. · outside India · Delaware corporation [S2] - Legal notices email: legal@scrut.io [S2] - Sales contact email: sales@scrut.io [S2] - Terms last updated: 2025-06-26 [S2] - US government provisions: software licensed as Commercial Items under FAR/DFARS restricted rights [S2] **Pricing** - Account deactivation nonpayment: 30 [S2] - Billing error window: 15 [S2] - Billing model: fees per Order Form; currency specified by Company [S2] - Fee revision: yes [S2] - Plans availability: Foundation · Growth · Scale [S3] - Suspension nonpayment: 1 [S2] - Tax treatment: yes · yes [S2] **Product** - Asset criticality labels: Critical · Monitored · Ignored · Asset status classification [S4] - Asset discovery: cloud platforms · MDM tools · code repositories · Automated asset discovery [S4] - Asset inventory scope: cloud assets · devices · code repositories · yes [S4] - Asset metadata: owners · regions · departments · criticality · Asset metadata capture [S4] - Asset owner assignment: centralized employee directory · MDM tools · Asset owner assignment [S4] - Asset risk linking: Asset-to-risk linking · application name · assignees · department [S4] - Audit package contents: folder per requirement named by identifier, e.g. ART5.1.a [S9] - Audit package filename: framework and export date · GDPR_Audit_Package_2024-01-23.zip [S9] - Audit package format: zip · offline review outside Scrut [S9] - Audit package optional inclusions: , out-of-scope requirements · out-of-scope artifacts [S9] - Audit package plans: Foundation · Growth · Scale [S9] - Audit package requirement folder items: requirementinfo.txt · linked policy folders · linked evidence folders · linked test folders · Findings folder · Requests folder · Corrective Actions folder [S9] - Audit readiness report contents: artifacts included in audit, reported findings or requests, status of audit controls [S10] - Audit readiness report distinction: Audit Readiness Report = summary report; Audit Package = full folder-by-folder offline export [S9] - Audit readiness report plans: Foundation · Growth · Scale [S10] - Audit report delivery: Notification Center [S10] - Audit report download timing: yes [S10] - Audit report export via audit center: yes [S10] - Audit report export via reports module: yes [S10] - Audit report optional items: Out-of-scope requirements · Out-of-scope artifacts [S10] - Audit report structured data: yes [S10] - Automated evidence collection: Integrates with tech stack to collect evidence automatically, reusable across frameworks [S7] - Case studies consent: 10 [S2] - Columns selector: Columns selector customizes table display; Control Name is a non-removable default column [S6] - Compliance compass: Compliance Compass tool produces a report on frameworks aligned with business priorities [S7] - Continuous monitoring: monitored · ignored · Continuous asset monitoring [S4] - Continuous monitoring: Real-time compliance gap detection with continuous automated tests across the tech stack [S7] - Control scope default filter: In Scope · yes [S6] - Controls dashboard navigation: Compliance → Controls [S6] - Custom asset onboarding: Custom asset onboarding · CSV [S4] - Custom framework creation: yes [S8] - Custom framework link entity: yes [S8] - Custom framework plans: Growth · Scale [S8] - Custom framework premapped controls: Prebuilt control library premapped to popular frameworks can be used to create custom frameworks [S7] - Custom frameworks: Users can build custom frameworks with unique controls [S7] - Customer count: 2500+ [S4] - Expert guided compliance: Compliance experts support from framework selection to audit readiness [S7] - Framework categories: Security Frameworks · Privacy Frameworks · Others · Custom Frameworks [S7] - Framework comparison view: Compliance can be compared per framework via an interactive graph with clickable filtered drill-down [S6] - Frameworks library: Frameworks Library provides visibility and management of out-of-the-box frameworks and standards in one place [S7] - Frameworks supported: Unified Control Framework · 1500 · 70 [S4] - Governing law india: India · New Delhi [S2] - Governing law US: Delaware · San Francisco, California, AAA [S2] - Inline asset actions: edit · lock · delete · Inline asset actions [S4] - Ip infringement indemnity: yes [S2] - License grant: limited, revocable, non-transferable, non-sub-licensable, non-exclusive license to Software provided as SaaS [S2] - Other frameworks supported: NIST AI RMF, ISO 42001:2023, CIS, ISO 22301:2019 BCMS, ISO 13485:2016, Essential Cybersecurity Controls, CMMC 2.0 Level 1, CMMC 2.0 Level 2, Saudi Arabia PDPL, SAMA Cyber Resilience Fundamentals, ISO 27018:2019, COBIT 2019 [S7] - Plans supported: Foundation · Growth · Scale [S6] - Privacy frameworks supported: GDPR, ISO 27701, HIPAA, CCPA, PIPEDA, PDPA Singapore, NIST 800-171A, NIST 800-171 Revision 2, NIST 800-53 Revision 5, RBI DPSC, DPDPA, COPPA, FERPA, PHIPA, Botswana Data Protection Act, GLBA, New Jersey Data Privacy Law, Seychelles Data Pr… [S7] - Ready framework library: yes [S8] - Reference customer rights: yes [S2] - Risk control linking: Controls can be linked/unlinked to risks via Risk Register > Controls & Requirements tab [S3] - Risk register sync: Asset-linked risks sync to risk register [S4] - Security frameworks supported: SOC 2, PCI DSS V 4.0, ISO 27001:2022, DORA, ISO 27001:2013, NIS 2 Directive, NIST CSF v1.1, NIST CSF 2.0, CSA STAR, ISO 9001:2015, ISO 20000-1:2018, NYDFS 23 NYCRR 500, MAS TRM 2021, ISR V2, NYDFS NCRR 500, RBI CSF, RBI PA/PG, ISO 27017:20… [S7] - Soa definition: SoA lists every control, scope status, justification, implementation details, and references policies backing each control [S5] - Soa dependent frameworks: ISO 27701 · ISO 27017 · ISO 27018 · ISO 42001 [S5] - Soa document version control tab: Document Version Control tab: title, owner, approver, version, effective date, distribution scope, revision history [S5] - Soa export columns: Clause and section reference · Control name and objective · Control requirement description · Applicability · Justification · Implementation Details · Document Reference [S5] - Soa export delivery: XLSX · email download link [S5] - Soa export format: XLSX · 2 [S5] - Soa implementation details char limit: 10000 [S5] - Soa multiple reviewers: ; · yes [S5] - Soa out of scope field behavior: yes · yes [S5] - Soa plan availability: Foundation · Growth · Scale [S5] - Soa supported frameworks: ISO 27001:2022 · ISO 27017:2015 · ISO 27018:2019 · ISO 27701:2019 · ISO 27701:2025 · ISO 42001:2023 [S5] - Soa versioning: SoA details can be edited and regenerated as a new version; email link delivered [S5] - Term renewal: yes · 30 [S2] - Termination for breach: 30 · yes [S2] - Unified control framework: Predefined controls align with multiple frameworks to eliminate duplicate work [S7] - Unified controls framework: Proprietary Unified Controls Framework maps compliance requirements from various standards to a single set of controls [S6] **Support** - Audit package questions: support@scrut.io [S9] - Channels: email · 8:00 am–5:00 pm EST weekdays · 8:00 am–5:00 pm IST weekdays · yes [S2] - Response time: 3 [S2] ## Questions ### Is Scrut Automation European? Not determined: the vendor’s pages as captured do not say where Scrut Automation is based. ### Where does Scrut Automation store data? Not stated on the vendor’s pages as of 13 Oct 2026. ### Does Scrut Automation have a free plan? Not stated on the vendor’s pages as of 13 Oct 2026. ### What are the best alternatives to Scrut Automation? As of 21 Oct 2026, the panel rates [6clicks (3.5/5)](https://whats-best.ai/software/information-security/6clicks), [preeco | informationssicherheit (3.5/5)](https://whats-best.ai/software/information-security/preeco-informationssicherheit) and [Secfix (3.5/5)](https://whats-best.ai/software/information-security/secfix) highest among the other 26 Information Security products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | informationssicherheit](https://whats-best.ai/software/information-security/preeco-informationssicherheit) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Scrut Automation alternatives](https://whats-best.ai/software/information-security/scrut-automation/alternatives). ## What this page leaves out - 60 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. - 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. ## Sources - [S1] Vendor page: https://scrut.io (checked 2026-10-13) - [S2] Terms of service — found from the homepage: https://www.scrut.io/terms-of-use (checked 2026-10-13) - [S3] Asset & risk management depth — found from sitemap: https://help.scrut.io/docs/risk-assessment (checked 2026-10-13) - [S4] Asset & risk management depth — found from sitemap: https://www.scrut.io/platform/asset-management (checked 2026-10-13) - [S5] Controls, SoA & measures — found from sitemap: https://help.scrut.io/docs/download-soa-for-iso-frameworks (checked 2026-10-13) - [S6] Controls, SoA & measures — found from sitemap: https://help.scrut.io/docs/understanding-controls (checked 2026-10-13) - [S7] Framework & standard coverage — found from sitemap: https://www.scrut.io/solutions/all-frameworks (checked 2026-10-13) - [S8] Framework & standard coverage — found from sitemap: https://help.scrut.io/docs/creating-your-own-framework (checked 2026-10-13) - [S9] Audit readiness & evidence — found from sitemap: https://help.scrut.io/docs/export-an-audit-package (checked 2026-10-13) - [S10] Audit readiness & evidence — found from sitemap: https://help.scrut.io/docs/downloading-audit-readiness-report (checked 2026-10-13) - [S11] Integrations & automation — found from sitemap: https://developer.scrut.io/create-api-credentials (checked 2026-10-13) - [S12] Integrations & automation — found from sitemap: https://www.scrut.io/integrations/github (checked 2026-10-13) --- Cite as: whats-best.ai, "Scrut Automation — Information Security", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/information-security/scrut-automation Corrections: https://whats-best.ai/correct/472?target=page