Why are integration counts not enough?
Vendors publish very different totals. On the pages we read on 15 June 2026, Comp AI stated 580+ integrations, Vanta 400+, Secureframe 300+, Sprinto 300+ on its pricing page, Scrut 150+ in its Evidence Collector description, and Scytale 100+ on its integrations page. Drata described hundreds of tools without a count, and Thoropass published no count.
A higher total is useful, but what matters is whether the ten or twenty systems you rely on are on the list, and how deep each connection goes.
How do you build your integration inventory?
- Cloud infrastructure (for example AWS, Azure or Google Cloud).
- Identity provider and single sign-on.
- Code hosting and CI.
- HR system, for onboarding and offboarding evidence.
- Ticketing and task tracking.
- Endpoint management and device security.
- Communication tools used for alerts and approvals.
For each, note what evidence it provides today and which control it supports.
How do you check coverage?
Search each system by name on the new platform's integrations page and ask the vendor to confirm the depth: which resources it reads, how often, and what it tests. For anything not covered, plan a manual evidence upload or a custom connection.
How do you avoid a monitoring gap?
Connect every integration in the new platform while the old one is still running. Check that each produces its first evidence and test result. Only then disconnect the old platform, and keep a dated record of both steps in your changeover note.
What about access and permissions?
Every integration is a connection from a third party into your systems. Create new credentials or app connections for the new platform with the least access it needs, and revoke the old platform's access on the day you leave. Include both steps in your access review.
Who should own the reconnection work?
The people who own each system, with one person tracking the list. Cloud and identity connections usually need an administrator to approve them, and HR connections often need the HR team. Book their time before changeover week, because a single missing approval can hold up the whole switch.
What should the integration checklist record?
For each system: the owner, the evidence it feeds, the control it supports, the date it was connected to the new platform, the date its first evidence arrived and the date the old connection was revoked. Six dates per system sounds like a lot, but it is the record your auditor will ask for.