Stepwork logoStepwork logo
ProcedureDeterministic AgentsMarketplace

By department

  • ITAccounts, access, helpdesk requests
  • Security & ComplianceAccess reviews, evidence, audits
  • Finance & AccountingInvoices, billing, month-end close
  • Sales & RevOpsCRM to ERP, orders, quotes
  • OperationsOrders, deliveries, dispatch
  • HR & PeopleOnboarding and offboarding
See every use case

By industry

  • HealthcareReferrals, eligibility checks, EHR entry
  • 3PL and warehousingPDF orders, WMS entry, client billing
  • Freight and truckingRate confirmations, carrier checks, TMS
  • Fuel and convenience storesStore staff, POS IDs, back office
  • ConstructionJob setup, subcontractor insurance
  • Manufacturing and distributionPO entry, supplier dates, legacy ERPs
  • Accounting firmsMonth-end across every client file
  • Field services and tradesService calls to jobs to invoices
  • MSPsNew users and license true-ups
See every industry
Security
Log inBook a Demo
ProcedureDeterministic AgentsMarketplace

By department

  • ITAccounts, access, helpdesk requests
  • Security & ComplianceAccess reviews, evidence, audits
  • Finance & AccountingInvoices, billing, month-end close
  • Sales & RevOpsCRM to ERP, orders, quotes
  • OperationsOrders, deliveries, dispatch
  • HR & PeopleOnboarding and offboarding
See every use case

By industry

  • HealthcareReferrals, eligibility checks, EHR entry
  • 3PL and warehousingPDF orders, WMS entry, client billing
  • Freight and truckingRate confirmations, carrier checks, TMS
  • Fuel and convenience storesStore staff, POS IDs, back office
  • ConstructionJob setup, subcontractor insurance
  • Manufacturing and distributionPO entry, supplier dates, legacy ERPs
  • Accounting firmsMonth-end across every client file
  • Field services and tradesService calls to jobs to invoices
  • MSPsNew users and license true-ups
See every industry
Security
Log inBook a Demo
  1. Home
  2. Use cases
  3. Vanta evidence collection

Automate Vanta evidence collection for apps without an integration

Stepwork signs in to the apps your Vanta integrations can't read, captures the evidence on a schedule, and files it in Vanta through its screens or its API.

Book a DemoSee the procedures
  • Internal tool
  • On-prem system
  • Vendor portal
Use case
Compliance evidence from apps outside your integrationsInfoSec & Compliance
Best for
GRC Engineer, Compliance Manager, Security Lead
Applications used
  • Vanta
  • Internal tool
  • On-prem app
  • Vendor portal
  • Slack
Business outcome
Evidence that stays current between audits

The problem

Continuous monitoring stops where the integrations stop

  • Sign in to every app your integrations can't read
  • Screenshot each setting an auditor will ask to see
  • Export users and paste them into the CSV template
  • Upload, rename, and attach each file to its request
  • Chase owners whose evidence tasks went overdue
  • Find out the week before the audit it's months old

Systems

Evidence from the places integrations don't read

Vanta connects to hundreds of tools through their APIs. Evidence that lives anywhere else still takes a person: an internal tool, a desktop or on-prem system, a vendor portal, or a settings page an integration doesn't pull. Stepwork reads those screens with a login your team grants.

  • Compliance platforms: Vanta, Drata, Secureframe, AuditBoard
  • Internal tools and portals: Internal tool, On-prem app, Vendor portal
  • Desktop and on-prem business systems: Sage 100, Microsoft Dynamics GP, Epicor, QuickBooks Desktop
  • Settings screens auditors ask to see: Okta, Microsoft Entra ID, Google Workspace, Microsoft 365, AWS, GitHub
  • Where the results go: Slack, Microsoft Teams, Jira
  • Drata
  • Secureframe
  • AuditBoard
  • Internal tool
  • On-prem app
  • Vendor portal
  • Drata
  • Secureframe
  • AuditBoard
  • Internal tool
  • On-prem app
  • Vendor portal
  • Drata
  • Secureframe
  • AuditBoard
  • Internal tool
  • On-prem app
  • Vendor portal
  • Drata
  • Secureframe
  • AuditBoard
  • Internal tool
  • On-prem app
  • Vendor portal
  • Drata
  • Secureframe
  • AuditBoard
  • Internal tool
  • On-prem app
  • Vendor portal
  • Drata
  • Secureframe
  • AuditBoard
  • Internal tool
  • On-prem app
  • Vendor portal
  • Sage 100
  • Microsoft Dynamics GP
  • Epicor
  • QuickBooks Desktop
  • Microsoft Entra ID
  • Sage 100
  • Microsoft Dynamics GP
  • Epicor
  • QuickBooks Desktop
  • Microsoft Entra ID
  • Sage 100
  • Microsoft Dynamics GP
  • Epicor
  • QuickBooks Desktop
  • Microsoft Entra ID
  • Sage 100
  • Microsoft Dynamics GP
  • Epicor
  • QuickBooks Desktop
  • Microsoft Entra ID
  • Sage 100
  • Microsoft Dynamics GP
  • Epicor
  • QuickBooks Desktop
  • Microsoft Entra ID
  • Sage 100
  • Microsoft Dynamics GP
  • Epicor
  • QuickBooks Desktop
  • Microsoft Entra ID
  • Microsoft Teams
  • Microsoft Teams
  • Microsoft Teams
  • Microsoft Teams
  • Microsoft Teams
  • Microsoft Teams

Example procedures

Three evidence procedures, card by card

One captures settings from every app on your list, one fills overdue evidence requests, and one pushes portal findings into Vanta through its API. Swap in Drata or Secureframe above the first two and the steps stay the same.

Weekly settings evidence from every app on the control list into Vanta

Every Monday Stepwork works through your evidence list, signs in to each app, captures the setting a control depends on, and uploads the screenshot to that control in Vanta. A setting that drifted goes to its owner instead.
  • Excel
  • Internal tool
  • On-prem app
  • Vanta
  • Slack
Swap in your systemsThe steps stay the same. Only the screens change.
Compliance platform
Team chat
Weekly settings evidence from every app on the control list into Vanta
Extraction
Excel

Read the apps on the evidence list

Scheduled · Mondays at 6:00

Extracted variables

  • app_name
  • control_id
  • expected_value
Extraction

Capture the setting and a screenshot

Input variables

  • app_name

Extracted variables

  • setting_value
  • screenshot
Rule logic

Does the setting meet the control?

Input variables

  • setting_value
  • expected_value

Paths

  1. If the setting read doesn't match the value the control expectsThen: Send the drift to the owner in Slack
  2. OtherwiseThen: Upload the screenshot to the control in Vanta
Execution
If it drifted
Slack

Send the drift to the owner in Slack

Input variables

  • app_name
  • setting_value

Output

  • drift_note
Execution
If it meets the control
Vanta

Upload the screenshot to the control in Vanta

Input variables

  • screenshot
  • control_id

Output

  • evidence_status
Summary

Sum up the week's evidence

Input variables

  • evidence_status
  • drift_note

Drag to explore · pinch to zoom

Step by step

  1. 1
    The evidence list comes in
    Stepwork reads the list your GRC team keeps in Excel: each app, the control it supports, and the value that control expects. Each row is one pass through the loop.
  2. 2
    Each app gets checked
    Inside the solid frame, Stepwork signs in to the app, opens the settings page an auditor would ask about, reads the value, and saves a timestamped screenshot.
    Repeats: For each app on the list · 18 apps
  3. 3
    The rule checks the control
    If the setting doesn't match what the control expects, the run takes the top path. If it matches, the screenshot goes on to Vanta.
    • If it driftedSend the drift to the owner in Slack
    • If it meets the controlUpload the screenshot to the control in Vanta
    Repeats: For each app on the list · 18 apps
  4. 4
    Drift goes to the owner
    Only when the setting drifted: the app's owner gets a message in Slack with the value read, and nothing failing is filed as evidence.
    Only on this path: If it driftedRepeats: For each app on the list · 18 apps
  5. 5
    The evidence gets filed
    The recorded flow opens the control in Vanta and uploads the screenshot with the date it was taken.
    Only on this path: If it meets the controlRepeats: For each app on the list · 18 apps
  6. 6
    The GRC team gets the picture
    After the last app, the Summary card lists what was filed and which settings need a fix before they count.

Field map

FromTo
Internal toolSecurity settings: MFA requiredVantaControl: MFA enforced
On-prem appPassword policy screenVantaControl: password policy
ExcelEvidence list: expected valueSlackDrift message, when it doesn't match

Fill overdue evidence requests in Vanta from the source app

Every weekday morning Stepwork reads the evidence requests that went overdue in Vanta, collects each file from the app it names, attaches it, and posts what's left for a person.
  • Vanta
  • Vendor portal
  • Slack
Swap in your systemsThe steps stay the same. Only the screens change.
Compliance platform
Team chat

Step by step

  1. 1
    The overdue requests come in
    Stepwork reads every evidence request in Vanta that is past its due date, with the app it needs evidence from and what that evidence is.
  2. 2
    The evidence gets collected
    Inside the dashed frame, Stepwork runs the flow recorded for that app, like a user export from a vendor portal or a settings page from an internal tool, and saves the file.
    Repeats: For each overdue request · 9 requests
  3. 3
    The request gets submitted
    The recorded flow opens the request in Vanta, attaches the file, and marks it submitted, the same way a person would.
    Repeats: For each overdue request · 9 requests
  4. 4
    The leftovers get listed
    After the last request, the Summary card lists what was filed and anything with no recorded flow yet, so a person only handles those.
  5. 5
    The team sees it
    The list goes to the GRC channel in Slack, with a link to each request.

Field map

FromTo
VantaEvidence request: app and descriptionVendor portalReport or settings page to capture
Vendor portalExported fileVantaEvidence request: attachmentMarked submitted

Pentest portal findings into Vanta as vulnerabilities

Every morning Stepwork reads new findings from your pentest vendor's portal and pushes them into Vanta as vulnerabilities, where their remediation deadlines are tracked. Critical and high findings also get a ticket for the asset owner.
  • Vendor portal
  • Vanta
  • Jira
Swap in your systemsThe steps stay the same. Only the screens change.
Ticketing

Step by step

  1. 1
    New findings come in
    Stepwork signs in to the pentest vendor's portal and reads each new finding with its severity and the asset it affects. The same works for an on-prem scanner's console.
  2. 2
    The findings land in Vanta
    The API card sends each finding to a Vanta private integration as a vulnerability, so Vanta tracks its deadline next to the findings from your connected scanners.
  3. 3
    The rule checks severity
    Critical and high findings take the top path. Medium and low ones are already in Vanta, so they go straight to the summary.
    • If critical or highOpen a ticket for the asset owner in Jira
    • If medium or lowSum up today's findings
  4. 4
    Critical findings get a ticket
    Only on the top path: Stepwork opens a ticket in Jira for the asset's owner, with the finding and the asset named.
    Only on this path: If critical or high
  5. 5
    The day gets summed up
    Both paths end here. The Summary card lists what was pushed to Vanta and which tickets were opened.

Field map

FromTo
Vendor portalFinding: title, severity, assetVantaVulnerability: name, severity, target
Vendor portalFinding: assetJiraTicket: affected assetCritical and high only

Flows

The evidence flows these procedures are built from

Each flow is one recorded job in one app. Procedures run them on a schedule, and any of them can also run on its own from a request.

  • Vanta
    Vanta

    Upload evidence document

    Uploads a provided document to the specified Vanta evidence request and marks it submitted.
    Execution · Slack request
  • Vanta
    Vanta

    Extract overdue evidence tasks

    Extracts evidence requests and tasks past their due date, with assigned owners.
    Extraction · Scheduled
  • Vanta
    Vanta

    Extract failing tests and controls

    Signs into Vanta, opens the tests view, and extracts every failing test with its control, owner, and time in failing state.
    Extraction · Scheduled
  • Vanta
    Vanta

    Extract SLA-overdue vulnerabilities

    Extracts vulnerabilities synced into Vanta that are past their remediation SLA, grouped by owner.
    Extraction · Scheduled
  • Okta
    Okta

    Capture MFA policy configuration evidence

    Opens authentication policy settings and captures configuration screenshots for the evidence file.
    Extraction · Scheduled
  • Google Workspace
    Google Workspace

    Capture password policy configuration evidence

    Opens security settings and captures password and session policy screenshots for evidence.
    Extraction · Scheduled
  • Microsoft 365
    Microsoft 365

    Capture DLP configuration evidence

    Opens DLP policy settings and captures configuration screenshots for the evidence file.
    Extraction · Scheduled
  • AWS
    AWS

    Capture backup configuration evidence

    Opens backup plan settings and captures configuration screenshots for the evidence file.
    Extraction · Scheduled
  • Slack
    Slack

    Capture retention settings evidence

    Opens workspace retention settings and captures configuration screenshots for evidence.
    Extraction · Scheduled
  • GitHub
    GitHub

    Extract branch protection status

    Extracts default-branch protection settings for every repository.
    Extraction · Scheduled
  • Drata
    Drata

    Upload evidence to control

    Uploads a provided document as external evidence against a specified Drata control.
    Execution · Slack request
  • Secureframe
    Secureframe

    Upload evidence document

    Uploads a document to a specified test or control as evidence.
    Execution · Slack request
  • Vanta
    Vanta

    Push records to a private integration

    Sends user accounts, vulnerabilities, or custom records to a Vanta private integration through its API, so they show as synced instead of uploaded.
    Recorded on your screens
  • Internal tool
    Internal tool

    Capture a settings page

    Signs in to an internal admin page, opens the security settings, and saves the values with a timestamped screenshot.
    Recorded on your screens
See every compliance evidence flow in the Marketplace

More procedures

More compliance procedures

Ready-made procedures in the Marketplace for evidence, readiness, and audits.

  • OktaGoogle WorkspaceMicrosoft 3652 more
    Okta · Google Workspace · Microsoft 365 + 2 more

    Configuration evidence collection sweep

    Ahead of the audit window, captures MFA policy evidence from Okta, password policy from Google Workspace, DLP configuration from Microsoft 365, and backup configuration from AWS, uploading each artifact to its Drata control.
  • VantaAuditBoardSlack
    Vanta · AuditBoard · Slack

    Evidence period close-out

    At each evidence period close, extracts overdue Vanta evidence tasks and open AuditBoard findings, chases owners for the final items, uploads completed artifacts, and reports the period's closure status to the GRC channel.
  • VantaKnowBe4Slack
    Vanta · KnowBe4 · Slack

    New-hire security compliance gate

    Weekly, extracts personnel compliance gaps from Vanta for recent joiners, enrolls anyone missing security training in the onboarding campaign, and reports joiners still non-compliant past 30 days to their managers.
  • DrataSecureframeSlack
    Drata · Secureframe · Slack

    Framework readiness gap tracker

    Weekly during certification prep, extracts control readiness by framework from Drata and failing tests from Secureframe, assigns each open gap an owner and due date, and reports readiness percentage to the program channel.

Why Stepwork

Evidence an auditor can trace back to a run

Stepwork is a deterministic agent platform: it runs the steps you recorded in each app, in the same order, every time. Every capture keeps the screenshot, the values read, the login used, and the time, so the evidence in Vanta traces back to a run record. Credentials stay in your vault, and nothing changes in a source app unless a procedure is built to change it.

Deterministic agentsProceduresCredentials
Book a Demo

Related use cases

More use cases

  • User access review automationStepwork pulls accounts from every app, including ones without SCIM, matches them to HR, carries out reviewer decisions, and files the evidence in Vanta.Learn more
  • Vulnerability management automationStepwork reads each security tool every morning, writes one summary of what changed since yesterday, and opens tickets for vulnerabilities that are exploited or overdue.Learn more
See every use case

FAQ

Common questions

  • No. Vanta stays where your controls, tests, and auditors live. Stepwork collects the evidence Vanta's integrations can't reach and files it there, so Vanta monitors more of your scope.
  • Two ways. Stepwork can upload files to an evidence request through Vanta's own screens, or push records through Vanta's API to a private integration, where they show as synced on a schedule.
  • Any app a person on your team can sign in to: internal tools, desktop and on-prem systems, vendor portals, and settings pages an integration doesn't read. It doesn't need an API, SCIM, or a connector.
  • Each capture carries a timestamped screenshot, the values read, and a run record showing which login ran it and when. As with any evidence, confirm the format with your auditor before the audit window starts.
  • As often as you schedule it: weekly for settings, daily for user lists, or before an evidence request comes due. Each run is recorded on its own, so the history shows the control held between audits.
  • Yes. The upload steps run the same way in Drata and Secureframe. Pick either above the first two procedures on this page and the steps rename to match.

The math

What manual evidence collection costs a GRC team

Example volumes for a team keeping SOC 2 and ISO 27001 evidence current across 20 apps outside its integrations. Swap in yours.

Illustrative estimate, not a quote. These are example volumes and typical hand times, not a customer's results. Your numbers will differ, and we can work them out with you.
The manual taskTimes a weekMinutes eachHours a week
Sign in and screenshot a setting for a control2082.7
Export a user list and fill in the access template5252.1
Upload and label a file on an evidence request2041.3
Chase an owner for an overdue evidence task1061
Hours a week
7.1
Hours a year
354
Of one full-time person
18%
Example volumes, not a customer's numbers. Minutes are the typical time to do each task by hand. Hours a year assume 50 working weeks.

See it run on a process you already repeat

Bring one. We will show you what it looks like as a flow and what each run records.

Book a Demo
Stepwork

Deterministic agents for work that must run the same way every time.

ProcedureContainersDeterministic AgentsMarketplaceUse CasesIndustriesSecurityClaude Co-Work AlternativeStepwork MCPAngelList Case StudyFAQ
Terms and ConditionsPrivacy PolicyData Processing AgreementSubprocessors

2261 Market Street #4481, San Francisco, CA 94114, USA

Loot Discount inc dba Stepwork

© 2026 Stepwork. All rights reserved.