Skip to main content

​
Overview

Vanta automates security compliance for SOC 2, ISO 27001, HIPAA, and other frameworks. The Pwnbook Vanta integration imports your compliance posture — controls, automated tests, evidence requests, and vendor assessments — so security teams can track compliance alongside operational security work in a single view.

​
Prerequisites

  • A Vanta account with access to Settings → API
  • Admin or Owner access in Pwnbook

​
Credentials required

Vanta uses OAuth client credentials (machine-to-machine) for API access — there is no personal token.

​
Setup

1

Create a Vanta API client

  1. In Vanta, go to Settings → Integrations → API.
  2. Click Create API client.
  3. Give it a name like “Pwnbook” and set the required scopes:
    • vanta.api.general.tests:read — automated test results
    • vanta.api.general.controls:read — control status
    • vanta.api.vendor:read — vendor management data
    • vanta.api.general.evidence:read — evidence requests
  4. Copy the Client ID and Client Secret.
2

Configure in Pwnbook

  1. Go to Organization Settings → Marketplace → Vanta.
  2. Enter your Client ID and Client Secret.
  3. Click Save & Test — Pwnbook exchanges credentials for a token and verifies access.

​
What gets synced

​
Controls

Pwnbook imports your Vanta control library including:

​
Automated tests

Each automated security check Vanta runs appears as a test result in Pwnbook:

​
Evidence requests

Open evidence collection requests from your Vanta audits appear in Pwnbook:

​
Vendor management

The vendor list from your Vanta workspace is imported with full metadata: Security owners and business owners are Vanta workspace users — they are set via a user picker and correspond to real team members in Vanta.

​
Viewing in Pwnbook

Once connected, Vanta data is available from the Workbench and the sidebar:
  • The Vanta workbench card shows control pass rate, failing test count, and open evidence requests at a glance.
  • The full Vanta view shows tabbed sections: Controls, Tests, Evidence, and Vendors.
  • Filters let you narrow by framework, status, and assigned owner.
  • Failing tests and controls link back to the corresponding item in Vanta for remediation.

​
Disconnecting

  1. Go to Organization Settings → Marketplace → Vanta.
  2. Click Disconnect.
  3. Confirm.
Previously synced compliance data remains in Pwnbook until manually deleted.