Can Drata or Vanta Capture Screenshots for SOC 2 Evidence?

No, Drata and Vanta cannot capture screenshots for SOC 2 evidence. Both automate API-based collection (cloud configs, logs, user lists) but cannot capture web UI screenshots, document workflows, or confirm the attestations only a person can answer. That leaves roughly 20% of SOC 2 evidence manual, about 40 to 60 hours per audit for screenshots alone, plus the periodic chasing no dashboard does. This article explains what stays manual, why a dashboard can't reach it, and how Vera, an agent who runs continuous compliance, does that work instead.

What Drata and Vanta Automate (about 80%)

Both Drata and Vanta are strong at infrastructure evidence through read-only API integrations.

Evidence type	Automation method	Examples
Infrastructure configs	API polling	AWS security groups, GCP IAM, Azure network rules
Access logs	Log aggregation	Okta login events, Google Workspace access records
Employee data	HRIS integration	BambooHR and Workday employee lists and roles
Code repository	Git integration	GitHub branch protection, commit logs, PR approvals
Security scanning	Tool integration	Snyk vulnerabilities, Wiz cloud findings
Endpoint management	MDM integration	Jamf device compliance, Intune encryption status

These platforms cut infrastructure-evidence time sharply, handling controls like CC6.6 (encryption in transit and at rest), CC6.7 (transmission integrity), CC7.3 (security configurations), and CC9.1 (risk-assessment documentation). This is real coverage, and it is where a dashboard earns its keep.

What Drata and Vanta Cannot Automate (the other 20%)

1. Application evidence

What's needed: visual proof of how your application enforces controls, such as a login page showing the MFA requirement, an access-denied screen for an unauthorized user, role-based permission settings in an admin panel, or a data-encryption indicator in the UI.

Why a dashboard can't: no API can capture what a user sees in a browser. The dashboard flags the control and waits.

Control	Required evidence	Drata/Vanta capability
CC6.1, Logical Access	Capture of a denied access attempt	Flagged manual
CC6.2, Access Removal	Capture of a disabled user account	Flagged manual
CC7.2, Change Management	Capture of the approval workflow in the UI	Flagged manual
A1.2, Data Privacy	Capture of consent forms and privacy controls	Flagged manual

2. Workflow documentation

What's needed: step-by-step proof of how a process runs, such as incident response, an access-request approval, or a deployment from pull request to production.

Why a dashboard can't: cross-system workflows involve human decision points an API cannot observe. Historically this meant 10 to 20 captures per workflow, a written description of each step, and a narrative to connect them, about 45 to 60 minutes per workflow.

3. Application testing results

What's needed: evidence that a control works as designed during a test, such as a non-admin user being blocked from sensitive data, or session-timeout enforcement firing.

Why a dashboard can't: testing requires performing actions in your UI and capturing the result. A negative test, where you prove access is denied, only exists as a visual artifact.

Test type	What auditors need	Manual work without an agent
Access-control test	Attempted access, denial message, audit-log entry	30 to 45 min per test
Data-encryption test	Plaintext input, encrypted storage, decryption on retrieval	45 to 60 min per test
Backup-restoration test	Backup selection, restore process, validation of restored data	60 to 90 min per test

4. Attestations only a person can answer

What's needed: confirmation that a review actually happened and the right people signed off, that an exception was approved and why, or that a vendor was reviewed before onboarding.

Why a dashboard can't: there is no configuration to poll. The dashboard flags the control as due, and a human has to chase the answer. This is the part of the gap a camera can't fix either.

The Double-Documentation Problem With Vendor Consoles

Even where a dashboard has the data, auditors often want the picture too. Vanta might collect, over API, that "AWS security group sg-abc123 blocks SSH from the internet." The auditor then asks for a capture showing that same rule inside the AWS console. Both are wanted for a reason: the API data proves the configuration exists in code, and the console capture proves it is visible to the operators who run the system, and together they show the two match.

The same pattern shows up across vendor tools: a Stripe dashboard showing the PCI badge, an Auth0 screen showing MFA enforcement, a Cloudflare view of the WAF rules, a Datadog view of the monitoring configuration. A monitoring dashboard pulls the data and stops; the console capture is left to you, per vendor, every audit. Vera captures those console views on a schedule through the browser agent and files each alongside the API evidence, so the "prove it in the console" request is already answered before the auditor asks. This alone is commonly 8 to 10 hours of manual work per audit that a dashboard cannot remove on its own.

The Manual Gap in Numbers

A typical SOC 2 Type II evidence breakdown

Evidence category	Controls affected	Drata/Vanta automation	Manual work
Infrastructure	30 to 40% of controls	About 95% automated	~2 hours
HR and policies	25 to 30% of controls	About 90% automated	~4 hours
Application testing	20 to 25% of controls	Not automated	~40 hours
Workflow and attestations	15 to 20% of controls	Barely automated	~20 hours
Total	100%	About 80% automated	60 to 66 hours

Across four quarterly cycles, that is roughly 240 to 264 hours a year of manual evidence work a dashboard leaves on your plate.

What Each Platform Handles

Drata's coverage

Drata automates cloud resource configurations, GitHub and GitLab repository settings, Okta and Google Workspace user management, policy-acknowledgment tracking, vulnerability-scan aggregation, and penetration-test result collection.

It leaves as manual the application UI captures, custom workflow documentation, the manual control tests (CC6.1, CC6.2), process-level evidence like incident-response execution, and the attestations behind periodic reviews. Its answer is an "Additional Evidence" upload feature: you create the captures and PDFs, upload them to a control, and write descriptions, roughly 50 to 60 hours per audit cycle.

Vanta's coverage

Vanta automates cloud infrastructure monitoring, continuous compliance scanning, employee onboarding and offboarding tracking, security-training completion, access-review tracking, and vendor-risk tracking.

It leaves as manual the application-behavior verification, UI-level access-control captures, custom application-testing documentation, workflow proof, and the confirmations a person has to give. Its answer is a "Manual Evidence" section: you upload files, link them to controls, and add context, again about 50 to 60 hours per cycle.

Real Example: CC6.1 Logical Access

What a dashboard automates

For "restrict access to sensitive data based on role," Drata or Vanta collects the Okta user list with assigned roles, the AWS IAM policies for each role, database access logs, and GitHub repository permissions. Infrastructure-level access is verified automatically.

What stays manual

Complete CC6.1 evidence also needs an application-level test (log in as a non-admin, attempt the admin panel, capture the "Access Denied" result, and confirm the audit-log entry), UI captures of the role-configuration and permission screens, and written test documentation (steps, expected versus actual, tester identity, timestamp, pass or fail). Without an agent, that is about 60 minutes per quarter, for one control.

Why a Dashboard Can't Capture This

No browser access. These platforms operate through backend APIs. They cannot render a browser session, interact with a web UI, or simulate a user action in your front end.

No visual context. APIs return data structures, not rendered HTML. A dashboard cannot capture a modal, an alert, or a user-interaction flow.

Security boundaries. A monitoring dashboard holds read-only API access. It does not enter your production application UI, act inside a third-party vendor console, or run tests in customer-facing systems.

Application diversity. Every company's admin panel and internal tooling is different. There is no standard API for application UI elements, so there is no generic way to poll them.

These are structural, not a missing feature that ships next quarter. The dashboard's model is to monitor and flag; capturing application evidence and chasing attestations is a different job.

How Vera Closes the Gap

Vera runs the compliance program as an agent instead of a dashboard you feed. She scans your infrastructure read-only, scopes your control matrix, drafts policies grounded in what she finds, and works the controls on a schedule. For the 20% a dashboard flags, she does the collection.

The evidence mix, honestly

Her coverage breaks down to about 70% fully API-automated, roughly 9% automated screenshots (a browser extension plus a vision model scoring the capture), about 9% guided capture, and around 5% ingested from your inbox. Zero percent comes from a person uploading files into a dashboard. Screenshots are one of several ways she collects evidence, and the one an API can never reach, not the identity of the product.

How she captures application evidence

You (or Vera, on a schedule) run a control test once. The extension captures timestamped screenshots, a DOM snapshot, and metadata, and a vision model scores the result against the control. PII is redacted at capture. For a CC6.1 test she runs the denial path, captures the 403, and files it; for CC7.2 she captures the approval workflow and links it to the pull request.

How she handles the attestations

For a review or approval, Vera DMs the right person in Slack or Teams, reminds at 24 hours, escalates to you at 48, and files their reply as evidence when it lands. On access reviews she schedules and orchestrates the review and chases the reviewers, while the final judgment stays with your team.

How she signs and files it

Every artifact is hashed, timestamped (RFC 3161), and signed, and traces back through a control test to a policy claim. An auditor can start from a policy sentence, follow it to the test and the signed evidence, and verify the signature with a free CLI. If you keep Drata or Vanta, Vera pushes the pack into the matching control so the dashboard shows it covered.

Drata/Vanta vs. Vera

Capability	Drata/Vanta	Vera
Infrastructure monitoring	Yes	Yes
Application evidence capture	Flagged manual	Captured and scored
Workflow documentation	Manual	Captured and narrated
Attestation chasing	Flagged only	DMs, reminds, escalates in Slack
Policy writing	Templates you fill in	Drafted from your attested reality
Control mapping	Generic	Mapped to your real systems
Evidence signing	No	Signed, traces to a claim and test

Vera replaces both the platform and the consultant. She scans your infrastructure, writes policies grounded in your real systems, collects evidence across the infrastructure and application layers, and chases the human attestations. If you already run Drata or Vanta, she works alongside it and syncs signed packs back. For teams getting SOC 2 for the first time, she is the more complete path.

How Teams Handle the Gap Today

Before an agent does this work, teams fall back on one of three approaches, and each has a real cost.

Manual capture (most common)

Someone builds a checklist from the control matrix, schedules time each quarter, captures each screen with a generic tool, organizes files by control ID, writes descriptions in a document, exports PDFs, and uploads them to the dashboard. It needs no new software, but it runs 40 to 60 hours per audit, is repetitive and error-prone, and breaks concentration ten to fifteen times a quarter.

Outsource to a consultant

A compliance firm captures the evidence with temporary system access, and your team reviews and approves. It frees internal hours, but it adds cost, hands production access to an outside party, and creates a dependency on someone else's schedule. It also does nothing to keep evidence current between visits.

Screen recording plus manual processing

A recorder captures test sessions, and someone watches them back to extract the key frames, annotate them, and format the pack. It preserves context, but it still takes 30 to 45 hours of post-processing per audit, and auditors want captures, not videos.

Hidden costs of the manual path

Beyond the direct hours, the manual path carries a tax that rarely shows up in a budget: context switching that interrupts product work, 20 to 30% of evidence that needs reformatting or clarification, overtime during the audit crunch, and evidence that goes stale the moment a UI change quietly breaks a control. Vera removes that tax by collecting continuously and signing each artifact as it is captured, so nothing has to be reproduced under deadline.

A Week in Vera's Compliance Cadence

Continuous compliance is a schedule, not a scramble before the audit. At 6:30 AM Vera posts a Slack briefing with current readiness and anything she escalated overnight. During the week she captures the RBAC, change-management, and vulnerability-review tests as they come due, DMs the owners to confirm the judgment calls, and files each as a signed pack. By the weekend she runs a full cloud and repo scan and opens remediation tickets for anything that drifted. When the audit window opens, the evidence is already collected, dated inside the period, and mapped to the controls.

What This Costs

A dashboard alone still needs a vCISO or consultant (roughly $2K to $5K a month) to write policies, decide what to fix, and run the program it only monitors. With the audit, a traditional first year lands around $85K. Vera replaces both: Screenata is $499 a month for SOC 2 Type II, with Type I from $299, bringing a typical first year to around $18K. You get 20+ native integrations, 489+ checks, and 27+ agent tools across Slack, email, the CLI and a Claude Code MCP, and GitHub pull-request reviews.

Frequently Asked Questions

Will Drata or Vanta add screenshot capture later?

It is unlikely to become their focus. Their architecture is API-first, application UIs are highly custom, and entering a customer's production UI raises security concerns. The more likely path is that they keep supporting manual uploads and expect you to close the gap another way. Vera closes it by doing the capture and the chasing directly.

Can I use a screen recorder like Loom instead?

Partially. A recorder captures the session, but you still extract the screenshots by hand, map them to controls, write the narrative, and format the pack, roughly 35 hours per audit. Vera captures the control-scored evidence, signs it, maps it to the control, and syncs it, which is where the time goes.

Do auditors accept this evidence?

Yes, when it carries provenance: an unaltered capture, an accurate timestamp, tester identity, the control objective, and a clear pass or fail. Vera's packs carry all of that plus a signature and a claim-to-evidence chain the auditor can re-derive. Auditors care about authenticity and traceability, not whether a human clicked the shutter.

Should I switch from Vanta to Drata, or the reverse?

That won't close this gap. Both share the same 20% limitation on application evidence and attestations. Whichever dashboard you use, you still need something that does the application capture and the chasing. That is what Vera does.

Which controls tend to need application evidence?

CC6.1 (logical access), CC6.2 and CC6.3 (provisioning and deprovisioning), CC7.2 (change management), CC7.4 (backup and recovery), and A1.2 (privacy controls). A rule of thumb: if the control says verify, test, or demonstrate application behavior, it needs a capture, and often an attestation behind it.

What if my application is too sensitive to capture?

Run the test in staging with synthetic data, let Vera redact PII at capture, limit captures to non-sensitive screens, and rely on her signed metadata for the rest. Redaction happens before anything is filed or synced.

How much time does this actually save?

A team on a dashboard alone spends roughly 240 hours a year on manual evidence, at about 80% automated coverage. With Vera capturing the application layer and chasing the attestations, residual manual work drops to review time, on the order of 16 to 24 hours a year, and total coverage rises toward 95%. The bigger change is that the evidence stays current between audits instead of being reconstructed each quarter.

Does the integration touch production data?

Vera connects read-only to your infrastructure and redacts PII from any capture before it is filed or synced. Screenata is SOC 2 Type II compliant and encrypts evidence at rest and in transit. She does not write to your production systems; when a fix is needed she opens a ticket and re-verifies after a human applies it.

Key Takeaways

Drata and Vanta automate about 80% of SOC 2 evidence through APIs, which is real coverage for infrastructure, identity, and policy tracking.
The remaining 20%, roughly 40 to 60 hours per audit, is application evidence, workflow proof, and the attestations only a person can answer.
A dashboard can't reach that layer for structural reasons: no browser, no visual context, read-only boundaries, and endless application diversity.
A dashboard flags the work; Vera does it. She captures the application evidence, chases attestations in Slack, and files signed, traceable packs, alongside your dashboard or in place of it.
Vera replaces both the platform and the consultant, bringing a typical first year to around $18K versus roughly $85K for the traditional stack.

Learn More About SOC 2 Automation

The Bootstrapped Founder's Guide to SOC 2 covers the full cost breakdown and what to expect.
Do You Actually Need a vCISO for SOC 2? explains why most startups no longer need a consultant.
Why ChatGPT SOC 2 Policies Fail Audits shows what auditors actually want in your policies.
How to Automate SOC 2 Evidence Collection is the comprehensive automation guide.