Scrut Automation

The Drafted IT Officer

Automated discovery that syncs cloud assets, devices and code repositories into one register, with owners, departments and criticality labels, is exactly the part of an ISMS I can keep alive next to my day job. But the risk side is only ever shown as linking — controls attach to risks, risks attach to assets — and we found no public information on a risk methodology, treatment tracking, or any incident handling, let alone statutory reporting clocks. Strong inventory, a risk process we cannot see. 3 4

Report an error

The Drafted IT Officer

The Statement of Applicability is generated on demand from live control data, with implementation details pre-filled from the framework module and policy references auto-populated at export, plus a version-control tab carrying owner, approver and revision history — that saves me a week of spreadsheet surgery. Audits come with findings, requests and corrective-action folders. We found no public information on measure tracking with owners, due dates, delegation or escalation, which is the difference between a checklist I babysit and a system that chases people for me. 3 5 6 9

Report an error

The Drafted IT Officer

Seventy-plus out-of-the-box frameworks including ISO 27001, SOC 2, NIS 2, TISAX and DORA, mapped onto a proprietary unified control set so one answer serves many frameworks, with collected evidence reusable across them — that is the multi-compliance workhorse a one-person security function actually needs. Custom frameworks are available on the upper tiers. We found no public information on a documented update cadence when a standard moves, so I am trusting the phrase 'growing library' rather than a maintenance promise. 4 6 7 8

Report an error

The Drafted IT Officer

The offline audit package is a genuinely defensible export: one zip organized per requirement, with policy, evidence, test, findings, requests and corrective-action folders an auditor can review without an account, and the summary readiness report includes structured data so their tooling can verify it. The developer console also logs every credential action with the actor named. We found no public information on revision-safe history across the wider records, auditor access roles, or reconstructing the state on a given date, so 'show me what it looked like in March' stays an open question. 9 10 11

Report an error

The Drafted IT Officer

A real API with scoped, expiring credentials available on every plan, automated asset sync from cloud platforms, MDM tools and code repositories, and continuous automated tests across the stack mean I am not re-typing my estate into a form. However, we found no public information on ticketing connectors, webhooks or SSO/SCIM provisioning, and the connector story beyond cloud, MDM and code repositories is undocumented, so the 'feeds from the real IT estate' claim is only half evidenced. 4 7 11

Report an error

The Drafted IT Officer

For the system that would hold my entire risk register, the captured terms place the contracting parties under Indian and Delaware law, and we found no public information on data residency, hosting locations, a subprocessor list, a data processing agreement or TOMs. The offboarding terms are at least concrete — thirty days of restricted access for retrieval, then deletion after a year in cross-region backup. As the person who would have to sign for this, that combination is the dealbreaker. 2

Report an error

The Drafted IT Officer

We found no public prices at all: the captured pages name the Foundation, Growth and Scale tiers and document which features sit in which, but we found no public information on figures, billing periods, setup fees or service bundles. The terms do spell out auto-renewal with thirty days' written non-renewal notice, so the renewal mechanics are readable even though the invoice itself is a sales conversation. 2 5

Report an error