Onboarding gets you connected integrations, a loaded policy library, and a mostly green dashboard — a snapshot. Operations is what happens to that snapshot over time: every new hire spawns tasks, OAuth tokens expire, an infrastructure change flips a test, quarterly access reviews come due, policies hit their annual review dates, and the evidence window keeps rolling toward the next audit. Vanta’s job is to notice all of this. Noticing is not fixing — under the shared responsibility model, acting on findings is always the customer’s side of the line.
The failure mode has a recognizable shape. The first audit passes on founder adrenaline. Then the person who ran the push gets reassigned or leaves, red tests get batched “for later”, and by month eighteen the dashboard no longer describes the company — right when a renewal audit or a big customer’s questionnaire arrives. With 1,000+ companies onboarded to Vanta through Agency, we’ve watched exactly where instances decay first: personnel tasks, then integrations, then evidence.
The durable fix is an owner with recurring hours. If that person exists internally, protect their calendar. If not, Managed Vanta assigns named engineers who keep the tenant audit-ready between audits, not just during them.
Vanta provides support and customer success for the software — help using features, not hands operating your controls. Running the instance, fixing findings, and producing evidence sit on the customer side for every GRC platform.
A recurring loop: triage new failing tests, complete personnel and offboarding tasks, refresh manual evidence, run scheduled access and vendor reviews, and re-confirm policies at their review dates. The list is short; the discipline is the hard part — failing Vanta tests covers the triage half.
