How to Bridge the Drata Automation Gap for SOC 2 Evidence

SOC 2 audits still require screenshots, application evidence, and clear documentation that auditors can review. While platforms like Drata automate infrastructure checks through API integrations, evidence collection for application workflows often remains manual. You likely bought a GRC tool expecting "continuous automation," only to find yourself manually capturing screenshots for custom admin panels, user access reviews, and change management workflows every quarter.

This is the "Drata automation gap." It’s not a failure of the platform—it’s a limitation of API-based technology. APIs can query AWS or Okta instantly, but they cannot see what a human sees in a custom user interface. To fully automate SOC 2 evidence, you need a way to capture the visual layer of your applications without assigning engineers to take screenshots.

What is the Drata Automation Gap?

The "gap" refers to the specific set of SOC 2 controls that require visual evidence from systems where no API integration exists.

Drata, Vanta, and Secureframe work by connecting to structured data sources—cloud providers (AWS, GCP), identity providers (Okta, Google Workspace), and version control systems (GitHub). They pull configuration data to prove a control is met. For example, Drata queries the AWS API to confirm that an S3 bucket is encrypted. That evidence is binary and structured.

However, SOC 2 audits also require evidence for application-layer controls. These include:

• User Access Reviews (CC6.1): Proving you revoked access in a custom internal admin tool.
• Change Management (CC8.1): Showing a specific deployment approval workflow in a ticketing system that doesn't have a clean API.
• Configuration Settings (CC6.6): proving a specific toggle is "on" in a SaaS tool that Drata doesn't integrate with.

Because these systems often lack public APIs—or building a custom integration for them is prohibitively expensive—compliance managers default to manual screenshots. This creates a split workflow: 80% of your evidence is automated by Drata, but the remaining 20% consumes 90% of your actual audit preparation time.

Where Traditional SOC 2 Automation Stops

To understand where the automation stops, you have to look at the difference between infrastructure monitoring and application state verification.

Evidence Type	Automated by Drata?	Why / Why Not?
Cloud Infrastructure	Yes	AWS/Azure/GCP APIs allow continuous polling of configurations (e.g., encryption, firewalls).
Identity Providers	Yes	Okta/Google Workspace APIs allow monitoring of MFA status and user lists.
Device Security	Yes	MDM agents report OS versions and disk encryption status directly.
Custom Admin Panels	No	No standard API exists. Requires visual verification of permissions and user lists.
Legacy / On-Prem Apps	No	Lacks modern API connectivity; evidence exists only in the UI.
Complex Workflows	No	Validating a process (like a specific approval sequence) often requires a visual narrative, not just a data point.
Vendor Portals	No	Unless a direct integration exists, verifying settings in niche SaaS tools requires screenshots.

The gap exists because traditional GRC tools are "readers" of APIs, not "users" of software. They can read a JSON response, but they cannot navigate a UI, click a dropdown, and take a screenshot.

What Evidence Requires Manual Screenshots?

If you rely solely on Drata, you will likely still be manually collecting evidence for these specific control families.

1. Custom User Access Reviews (CC6.1)

Drata automates access reviews for systems it connects to (like GitHub or Salesforce). But most companies have internal tools—"God Mode" admin panels, back-office dashboards, or customer support tools—that control sensitive data.

Auditors require proof that you reviewed access to these tools. Since Drata can't connect to your proprietary internal admin panel, you have to:

1. Log in.
2. Navigate to the user list.
3. Take a screenshot showing the current user list.
4. Timestamp it.
5. Upload it to Drata manually.

2. Change Management for Non-Integrated Flows (CC8.1)

While Drata links Jira tickets to GitHub PRs well, edge cases often break the automation. If you have a hotfix process that bypasses the standard flow, or if you use a deployment tool that isn't supported, the "automated" evidence fails. You then have to manually screenshot the ticket, the approval timestamp, and the deployment log to reconstruct the chain of custody for the auditor.

3. "Not Monitored" Controls

In your Drata dashboard, you likely have controls labeled "Manual" or "Not Monitored." These are often policy acknowledgments or specific configurations in tools like Figma, Miro, or niche HR software. While low risk, they still require evidence. The friction of logging into ten different SaaS tools just to screenshot a "Settings" page adds up to hours of wasted time every quarter.

How Do You Bridge the Gap Without More Engineers?

You have three options to close this evidence gap.

Option 1: Build Custom Integrations

Drata offers an open API. Your engineering team could write scripts to query your internal tools and push JSON evidence into Drata.

• Pros: Fully automated, structured data.
• Cons: Expensive. It requires pulling engineers off product work to build and maintain compliance scripts. APIs break, schemas change, and maintenance becomes a hidden tax on your roadmap.

Option 2: The "Screenshot Engineer"

You assign a junior engineer or IT manager to manually capture these screenshots every week or month.

• Pros: No development cost.
• Cons: High human error. People forget to capture timestamps, crop images too tightly (hiding the URL), or miss the collection window entirely. This leads to "evidence decay" where you fail an audit because you can't prove a control was active during the observation period.

Option 3: AI Agents (Screenata)

This is the modern approach. Instead of building an API integration, you use an AI agent to interact with the UI. The agent logs in, navigates to the required page, captures the screenshot, timestamps it, and formats it as a PDF.

• Pros: Zero engineering effort. It mimics the human auditor's view.
• Cons: Requires setting up a service account for the agent.

Practical Example: Automating CC6.1 for Internal Tools

Let’s look at how this works in practice for a standard internal admin panel.

The Manual Way (Drata Alone): Every quarter, your compliance manager sets a calendar reminder. They nag the engineering lead to log into the super-admin portal. The engineer takes a screenshot of the user list. They Slack it to the compliance manager. The manager converts it to PDF, names it 2026-Q1-Admin-Access-List.pdf, and uploads it to Drata Control CC6.1.

The Automated Way (Drata + AI Agent): You configure Screenata with a read-only account for the admin portal. You define the URL and the frequency (e.g., monthly).

1. Trigger: On the 1st of the month, the agent wakes up.
2. Action: It logs into the portal using secure credentials.
3. Capture: It navigates to /users, filters by "Active," and captures a full-page screenshot.
4. Process: It embeds the metadata (URL, time, date, IP) into the file header.
5. Delivery: It pushes the PDF directly into your evidence folder or evidence collection bucket.

The result is that Drata remains your "source of truth" for holding evidence, but the collection of that evidence is no longer manual.

Why Auditors Prefer Visual Evidence for These Controls

Interestingly, many auditors prefer screenshots over raw JSON dumps for application-level controls.

When you provide a JSON dump from a custom API, the auditor has to trust that your script queried the right database and didn't filter out bad data. They often require a "completeness and accuracy" (IPE) check to validate the script.

A screenshot, however, is self-validating. It shows the interface exactly as a human sees it. It shows the URL bar, the column headers, and the context. For custom tools, visual evidence is often faster to audit because it requires less explanation than a custom JSON schema.

Bridging the Drata automation gap doesn't mean replacing Drata. It means acknowledging that APIs can only reach 80% of your compliance surface area. For the remaining 20%—the custom apps, the UI toggles, the complex workflows—visual automation provides the closure you need to be truly audit-ready.

Learn More About SOC 2 Evidence Automation

For a complete guide to automating SOC 2 evidence collection, see our guide on automating SOC 2 evidence collection, including how to handle the specific controls that APIs miss.