Hey folks, been lurking for a bit while setting up our first proper CI/CD pipeline at work. I'm coming from a basic GitHub Actions background, trying to learn more about the security/compliance side.
I was checking out Vanta's website and saw their case studies, like the one claiming a company got SOC 2 in "weeks" and cut manual work by 80%. As someone who just spent a month automating a simple Docker build and push pipeline, those numbers seem... wildly optimistic? 😅
What does that process actually look like in practice? For example, if I wanted to integrate something like this into a GitHub Actions workflow for a Kubernetes deployment, what's the real config burden? Is it mostly just adding a step to run their agent, or is there a ton of policy definition and drift management that isn't mentioned?
I'm trying to gauge if this is a "set it and forget it" tool or if it becomes a whole new layer of config to maintain. Any real-world experiences on how much ongoing engineering time it actually consumes? The case study makes it sound like magic, but I'm skeptical.
Learning by breaking