Every platform in our lineup puts a customer number on its homepage. For a team deciding where to move, the number is tempting to use as a proxy for safety. This post sets out what each vendor states, as read on 28 September 2026, and what the figures can and cannot tell you.
What does each vendor state?
| Vendor | Stated figure | Wording | Source |
|---|---|---|---|
| Vanta | 16,000+ | "Trusted by 16,000+ customers"; its startup page says 16k+ businesses | Source: Vanta homepage · read 2026-09-28 |
| Drata | 8,500+ | "Trusted by 8,500+ global customers" | Source: Drata homepage · read 2026-09-28 |
| Secureframe | 6000+ | "6000+ customers" | Source: Secureframe homepage · read 2026-09-28 |
| Sprinto | 4,000+ | "Trusted by 4,000+ companies from Series A to enterprise" | Source: Sprinto homepage · read 2026-09-28 |
| Scrut | 2,500+ | "2,500+ Customers" | Source: Scrut homepage · read 2026-09-28 |
| Scytale | 1000+ | "Trusted by 1000+ companies" | Source: Scytale homepage · read 2026-09-28 |
| Thoropass | more than 1,000 | "trusted by more than 1,000 organizations globally" | Source: Thoropass homepage · read 2026-09-28 |
| Comp AI | 1,000+ | "Trusted by 1,000+ companies" | Source: Comp AI homepage · read 2026-09-28 |
What can a customer count tell you?
A large base suggests a vendor has seen many setups like yours, and that auditors and consultants are likely to know the platform. Vanta's startup page, for example, states 26k audits completed with AICPA peer-reviewed auditors. A large base also tends to mean a larger partner ecosystem, which matters if you want to choose your own vCISO or auditor.
What can it not tell you?
Vendors define customers differently: companies, organizations, businesses. None of the figures says how many customers are on a plan like yours, how many run more than one framework, or how many have switched in or out. A count says nothing about the service model you will get, which matters more in a switch than the size of the base.
Smaller bases are not a warning sign on their own. They can reflect a narrower focus, such as Thoropass's audit-led model. Company news can say more than a count: Comp AI, for example, raised a $34M Series A, reported by TechCrunch on 17 September 2026.
Source: TechCrunch, 17 September 2026, on Comp AI's Series A · read 2026-09-28
Why do we not score customer counts?
Because a larger base is not a better fit for a given team, and because the numbers are not comparable. We show each figure on the review pages with its source and leave it out of the totals. Scytale, a client of the agency that publishes this site, states one of the smaller bases in our lineup; that does not affect its score either way.
What should a switcher ask instead?
- How many customers of our size and framework mix do you support?
- How many customers moved to you from our current platform last year, and what did you import for them?
- Can we speak to one of them?
Where do customer counts appear on this site?
On each review page, pair page and the side-by-side table, with the vendor's own wording and a link to the page where we read it. They do not feed any total, ranking, switch board or planner result.
A reference call with a team that made the same switch tells you more than any homepage number.
How should a count fit into your shortlist?
Use it as context, not as a criterion. If two platforms score close on what you need, a reference call with a customer of your size is a better tiebreaker than the larger homepage number. Write down the stated figure and its wording when you compare, so you are comparing like with like.