Scrut Automation: the factory infographic
Compliance automation for SOC 2, ISO 27001 and 60+ frameworks, run with AI agents.
What the company does
In normal terms
AI compliance automation (GRC) platform: evidence collection, risk assessment and vendor risk management with AI agents, for SOC 2, ISO 27001 and 60+ frameworks.
Scrut uses AI agents to collect compliance evidence, assess risk and manage vendor risk across many frameworks.
In lay terms
Scrut does the paperwork that proves a company follows security rules, using AI helpers.
The risks it faces, especially from AI agents
In normal terms
- Agents with wide read access. Evidence-collecting agents need access to many customer systems.
- No framework for agents yet. Customers' own AI agents are not yet covered well by existing control frameworks.
- Trust in automated evidence. Auditors must trust evidence gathered by agents.
In lay terms
- Agents with wide read access. The paperwork robot can open every filing cabinet.
- No framework for agents yet. The rulebook has no chapter on robots.
- Trust in automated evidence. Can you trust a report the robot wrote about itself?
How RiskMandate helps
- Reachwhat it can actually access or affectWhat Scrut's agents and its customers' agents can touch.
- Mandatewhat the business authorisedThe compliance task they serve.
- Gapthe difference: the riskRead access beyond the evidence needed.
- Barrierswhat really stands in the wayControls mapped to frameworks.
- Provenancewho owns it, who reviewed it, which versionOwner and version, ready for the auditor.
In normal terms
Agent Behaviour Policies could be a new evidence type in Scrut: one record per agent, mapped to the controls auditors already use. And Scrut's own agents need policies; we can write the first one with them.
In lay terms
RiskMandate adds the missing chapter on AI assistants to the compliance rulebook.
A first line for the conversation: Your platform runs agents and audits controls. An agent policy is both. Shall we write one for yours?
Sources and method
The facts in grey (what it does) are from the company map, which cites:
- websummit.com, read 2026-11-01: LIS26 session page (conferenceSlug lis26): 'The biological bottleneck', 12 Nov, Cybersecurity Summit, Stage 8, names Scrut Automation as the speaker's organisation
- websummit.com, read 2026-11-01: LIS26 attendee page: Nicholas Muy, CISO, Scrut Automation; country and industry as listed by Web Summit; public bio
- www.scrut.io, read 2026-11-01: what the company does, from its own site (title and description)
The risks and how RiskMandate helps are our analysis, written by dev@web-summit.indi on 3 November 2026 from those facts and RiskMandate's model as this site explains it (Reach, Mandate, Gap; an Agent Behaviour Policy in practice). They are not the company's own statements and name no incident. A person reviews each before it is used.