Skip to main content
{ Reporting and Compliance }

Vanta Failing Test Triage

Sorts each failing Vanta test into a real control gap, a broken integration, or a resource outside the audit boundary, and proposes the fix with the evidence.

What this agent does

This read-only agent triages the tests that need attention in Vanta. For each failing test, it reads the failing resources and the integration that reported them. It checks each resource in the connected system when I grant read access. It decides whether the failure is a real control gap, an integration that stopped working, a resource that no longer exists, or a resource outside the audit boundary. It proposes the fix for each one and names the owner. A person makes every change.

The challenge

Vanta turns a test red for every resource that fails it. One failing test can be one unowned bucket, or every resource behind an integration that lost its role. A staging database with no backups fails the same test as the production one, and the right answer is to scope it out, not fix it. Someone clicks through each test the week before the audit and decides from memory.

The solution

The agent separates the failures by cause before anyone opens Vanta. It groups resources that fail for one reason, such as one broken integration, into one item. It proposes a scope change only with a reason the auditor would accept, and it never marks anything itself. Provides a short list of real gaps with owners, and a separate list of cleanup items.

Workflow

  1. 01

    Read failing tests

    Read the tests that need attention with their category, the controls and frameworks they support, the integration that runs them, and their remediation status and date.

  2. 02

    Read failing resources

    Read the failing resources for each test with their identifiers and last update.

  3. 03

    Check the source

    Where I grant read access, check each resource in the connected system to confirm the failure, confirm the resource still exists, and read its tags.

  4. 04

    Classify and propose

    Classify each failure as a real gap, a broken integration, a gone resource, or a scope change candidate, and propose the fix with the owner.

  5. 05

    Report

    Publish the grouped list with the evidence for each item.

Agent template 

# Vanta Failing Test Triage

## Measurable outcomes

Every test that needs attention in Vanta has a cause, a proposed fix, and an owner. Every scope change proposal has a reason an auditor would accept. Track the triaged, real gap, broken integration, gone resource, and proposed scope change counts on every run. The real gap count falls as owners fix resources.

## Procedure

Each run, read the tests in the needs attention state for the frameworks I set. For each test, read its category, the controls and frameworks it supports, the integration that runs it, its remediation guidance, its remediation status, and its remediate-by date. Read the failing resources with their identifiers and last update. Check the integration. When it is disabled or reports a connection error, classify every failure behind it as a broken integration and name the integration as the fix. When I grant read-only access to the connected system, look up each failing resource. Confirm the condition the test describes, such as a bucket with no versioning or a user with no MFA. A resource that no longer exists is gone. Recheck it on the next run, and report it as a sync problem when it persists. Read the resource's tags and environment. Propose a scope change only when the resource is a non-production resource outside the system boundary I define, or a resource the test does not apply to, and write the reason the auditor would read. For a resource kind Vanta can scope, propose marking the resource out of scope. Otherwise, propose deactivating the test entity with the reason. Never propose it for a production resource the test covers. Everything else is a real gap. Name the owner from the resource's owner tag or the test's owner in Vanta. Group resources that fail for one reason into one item with one fix. Rank real gaps by the test's remediate-by date, nearest first, and flag the tests Vanta marks overdue. Never deactivate a test, mark a resource out of scope, or change an owner in Vanta.

## Requirements

It needs a Vanta API application with the vanta-api.all:read scope to read tests, test entities, controls, frameworks, and integrations, and optional read-only access to the connected cloud, source code, and identity systems, and nothing more. It never changes anything in Vanta or in a connected system. Tickets name the resource and the owner so a person can act. Reports show user names as stable pseudonyms.