TCSA vs Scrut. A platform with people, a services firm, or both.
Scrut suits teams with an in-house compliance owner. It is a yearly platform subscription with integrations, monitoring and implementation help, and an independent firm performs the audit for a separate fee. Tranquility Cybersecurity (TCSA) suits teams that would rather hand the work to specialists: a services firm whose fixed SOC 2 fee includes the independent CPA attestation. Many use both.
Scrut facts checked on Scrut’s own pages, its AWS Marketplace listing, Capterra and CREST, October 2026. See all 20 sources
The difference in four lines.
- Scrut is a platform that also sells people. Its AI agents, which it calls Scrut Teammates, “draft policies, collect evidence, detect gaps, and prepare audit packages”, and “Your team reviews and approves.” Implementation managers and dedicated InfoSec managers help along the way.[1]
- TCSA is a services firm, with no software to license. Since 2017 our consultants and auditors have worked through 1,000+ audits, including 300+ SOC 2 engagements, writing the policies, preparing the evidence and coordinating with the auditor alongside our clients.
- Neither one issues your SOC 2 report. Scrut says “the audit itself is performed by an independent CPA or authorized firm” and sells audit coordination as an add-on.[3] With TCSA we source and pay the independent CPA firm, and its fee sits inside ours.
- Many companies use both. A platform keeps evidence and monitoring running between audits, and a services firm does the judgement work around it. We can work inside a Scrut workspace you already run.
Sources: Scrut homepage, Scrut SOC 2 FAQ. Checked October 2026.
Scrut and TCSA, row by row.
Every Scrut cell comes from Scrut’s own pages, its AWS Marketplace listing, Capterra or CREST, with the source numbered beside it. The TCSA column is our own published scope and pricing, which you can check on our pricing page.
| Question | Scrut | Tranquility Cybersecurity (TCSA) |
|---|---|---|
| The work | ||
| What it is | In its own words, “a risk and compliance automation platform”, with AI agents it calls Scrut Teammates. Scrut says it has 2,500+ customers.[1][2] | A compliance and security services firm, at work since 2017, with 1,000+ audits and 300+ SOC 2 engagements across India, the US, the UK, Australia and the UAE. |
| Who does the work | Your team and the platform, with help from Scrut’s people. The Teammates draft policies, collect evidence and prepare audit packages, and “Your team reviews and approves.” Scrut also names implementation managers and dedicated InfoSec managers who help draft policies and prepare for audits.[1] | Our consultants and auditors, alongside your team. We write your policies, prepare the evidence your auditor tests and coordinate with the auditor through the audit. Your team approves the documents, grants access and makes the engineering changes. |
| What is included | The platform fee covers control monitoring, evidence collection, policy templates, the employee portal and multi-framework support.[3] The AWS listing puts implementation, onboarding and continuous support with Monthly Business Reviews inside the contract.[4] VAPT and audit coordination are optional add-ons.[3] | Scoping and gap assessment, control design, policies written for your environment, evidence preparation, remediation guidance and coordination with the auditor. For SOC 2 the independent CPA attestation is included. |
| The audit and testing | ||
| The auditor | A third party. Scrut says “the audit itself is performed by an independent CPA or authorized firm” and that it “can connect you with vetted, licensed audit firms”.[3] Its partner directory names no firms.[7] Its terms say audit issues are resolved directly between the customer and the auditor.[5] | Included for SOC 2. We source and pay an independent, US-licensed CPA firm enrolled in AICPA peer review. Its name and licence appear on your report, and we name it before you sign with us, together with its licence number, the state board that issued it, and its current AICPA peer review enrolment. For ISO 27001 an accredited certification body issues the certificate. |
| Penetration testing | An optional add-on. Scrut offers “in-house services like VAPT”,[6] and the CREST Marketplace lists Scrut Automation Inc. with CREST accreditations in Penetration Testing and Vulnerability Assessment.[8] | A core service. Our VAPT work has found 10,000+ vulnerabilities to date. We deliver CERT-In audits, end to end, with our CERT-In empanelled partners. |
| vCISO and vDPO | No vCISO or vDPO service was listed on the scrut.io pages we checked. The nearest offers are dedicated InfoSec managers and in-house SOC 2 experts.[1][6] | Offered as ongoing services, for companies that need a security or data protection lead without making a full-time hire. |
| Money and time | ||
| Pricing model | A custom quote for an annual subscription. The scrut.io/pricing address returns a 404,[9] Capterra shows the starting price as “Not provided by vendor”,[10] and Scrut describes its pricing as “tailored to your compliance needs”, with “no limits or hidden charges based on users or usage”.[2] | A fee per engagement, fixed before work starts, with no subscription. Indicative bands by framework are on our pricing page. |
| Published prices | One list price, on AWS Marketplace: USD 15,000 for a 12-month subscription for organisations of up to 20 employees. Orders there are non-cancellable and non-refundable.[4] Scrut’s own cost estimates list the audit fee as a separate line.[3] | SOC 2 Type 1 USD 2,500–5,000 (₹2–3 Lakh) and Type 2 USD 3,000–10,000 (₹3–5 Lakh), CPA attestation included. ISO 27001 year one USD 3,000–6,000 (₹2–4 Lakh, £2,400–4,800), including the certification body’s fee, which the body charges directly. |
| Time to a report | Scrut says implementation “typically takes two to four weeks”,[11] a Type I report “usually takes 4 to 8 weeks” and the full Type II process “can take up to 6 months or more”.[3] | 6–8 weeks to audit-ready for SOC 2, then the Type 1 report. A Type 2 report commonly follows a 3–12 month observation window, on any route. With us, Type 2 takes 14–16 weeks end to end, including the 12-week minimum observation window. |
| Fit | ||
| Frameworks | “70+ Frameworks supported”, in Scrut’s homepage figure, plus custom frameworks.[1][12] The list includes India’s DPDPA, RBI CSF and SEBI CSCRF, Dubai’s ISR V2, Saudi SAMA frameworks, the UK’s Cyber Essentials and Australia’s Essential Eight.[12] | 20+ frameworks, including SOC 2, SOC 1, ISO 27001, ISO 42001, HIPAA, GDPR and India’s DPDP Act, delivered as services rather than tracked in software. |
| Who you contract with | Customers in India contract with Riversys Technologies Private Limited under Indian law. Customers elsewhere contract with Scrut Automation Inc., a Delaware corporation, under Delaware law.[5] | Tranquility Cybersecurity, based in India, with clients in India, the US, the UK, Australia and the UAE. There is no software to host. We work in your systems, or inside the platform you already run. |
| Best for | Teams with an internal owner for compliance, several frameworks to run from one control set, a cloud stack Scrut integrates with and a steady flow of security questionnaires. | Teams that want experienced people to do the work, one fee that includes the SOC 2 attestation, VAPT from the firm that prepares the audit, or vCISO and vDPO support alongside it. |
Sources: Scrut homepage, Scrut general FAQ, Scrut SOC 2 FAQ, Scrut on AWS Marketplace (Sold by: Scrut Automation), Scrut terms of use, Scrut SOC 2 solution page, Scrut partner directory, CREST Marketplace: Scrut Automation Inc., Scrut /pricing address, Scrut on Capterra India (UK and Australia identical), Scrut guide: what is SOC 2 automation software (updated Aug 14, 2026), Scrut frameworks page. Checked October 2026.
What Scrut does well.
These strengths come straight from Scrut’s own pages and listings, and they are real reasons to buy it. Where a figure is Scrut’s, we say so.
One control set, many frameworks
Scrut lists 70+ frameworks on a cross-mapped control set, with custom frameworks for anything missing, and tells teams that already hold SOC 2 they can “Reuse up to 80% of your existing controls” on the way to ISO 27001.[1][12]
Frameworks for India and the Gulf
Next to SOC 2, ISO 27001 and HIPAA, the list covers DPDPA, RBI CSF, RBI PA/PG, RBI DPSC and SEBI CSCRF, Dubai’s ISR V2, the Saudi SAMA frameworks, Cyber Essentials and Australia’s Essential Eight and ISM.[12]
Integrations and automated tests
Scrut says it connects to 150+ tools and runs “hundreds of prebuilt automated tests” across your stack, so gaps can surface between audits rather than in the audit itself.[1][14]
People inside the contract
The AWS listing includes implementation, onboarding, continuous support and Monthly Business Reviews in the contract,[4] and Scrut offers in-house SOC 2 experts, dedicated Slack channels and live consultations.[6]
Sources: Scrut homepage, Scrut on AWS Marketplace (Sold by: Scrut Automation), Scrut SOC 2 solution page, CREST Marketplace: Scrut Automation Inc., Scrut on Capterra India (UK and Australia identical), Scrut frameworks page, Scrut compliance automation page, Scrut Audit Center page, Scrut Trust Center page. Checked October 2026.
What a Scrut subscription leaves to others.
Scrut’s own guides and terms set this out plainly. It matters when you compare quotes and when you plan whose hours the work will take.
- The audit. An independent CPA or authorized firm performs it, and audit coordination is an optional add-on.[3] Scrut’s general FAQ says “audit charges may influence the final quote”,[2] and its cost guide says automation “does not eliminate the auditor fee”.[13]
- The judgement calls. Scrut’s automation guide says “Human judgment is still required for risk decisions, management assertions, and auditor conversations”, and that SOC 2 automation “does not guarantee compliance or issue a SOC 2 report”.[11]
- The ISO certification body. Scrut’s ISO 27001 FAQ lists “External ISO 27001 certified auditor charges” as a cost of their own.[17]
- The relationship with the auditor. Scrut’s terms say it is not a party to the management representation letter you sign with the auditor, and that audit issues are resolved directly between you and the auditor.[5] That separation is normal for an independent audit, and it holds on our route too. Your management signs the representation letter, and the opinion belongs to the CPA firm.
What our fee leaves out.
- Software. We don’t sell continuous control monitoring, a hosted trust center or questionnaire automation. If you want those, you want a platform, and Scrut is one of the options.
- The report and the certificate. We don’t issue SOC 2 reports or ISO certificates. An independent CPA firm and an accredited certification body do, on every route. The difference is who arranges the audit, who pays for it and whose hours the preparation takes.
Our guide to what SOC 2 automation actually automates draws the line between the software’s work and your team’s in detail.
Sources: Scrut general FAQ, Scrut SOC 2 FAQ, Scrut terms of use, Scrut guide: what is SOC 2 automation software (updated Aug 14, 2026), Scrut guide: cost of a SOC 2 audit (updated Aug 5, 2026), Scrut ISO 27001 FAQ. Checked October 2026.
What the money buys on each route.
Scrut’s figures are its one public list price and its own estimates of the market. Ours are indicative bands, fixed before work starts. Read the rows, not just the totals.
| Line item | With Scrut | With TCSA |
|---|---|---|
| Software | USD 15,000 a year for up to 20 employees, the AWS Marketplace list price.[4] Scrut’s cost guide puts a GRC platform at $10,000 to $30,000 a year, “with a possible one-time onboarding fee”.[13] | None. If you already run a platform, we work inside it. |
| Readiness work | Your team with the platform, plus the implementation support in the contract.[4] Scrut’s SOC 2 FAQ puts internal effort at $5,000–$30,000, “based on how much is manual”.[3] | Included in our fee. Your team still gives time to approvals, access and fixes. |
| SOC 2 audit | Separate from the platform fee. Scrut’s SOC 2 FAQ estimates audit fees at $15,000–$60,000 depending on Type I or II.[3] Its cost guide puts India auditor fees at about ₹5–15 Lakh for Type 1 and ₹15–30 Lakh for Type 2, labelled market approximations.[13] | Included. Type 1 USD 2,500–5,000 (₹2–3 Lakh), Type 2 USD 3,000–10,000 (₹3–5 Lakh), all-in. |
| The yearly total | In Scrut’s words, SOC 2 compliance “typically costs between $30,000 and $80,000 per year”, counting platform, audit and internal effort together.[3] | The SOC 2 fee above covers our work and the attestation. Your team’s own hours sit outside it, as they do on any route. |
| Years two and three | The AWS contract runs for 12 months,[4] and Scrut’s estimate above is a yearly figure.[3] | The SOC 2 re-audit is ₹2–3 Lakh (USD 3,500–4,000) a year, attestation included. |
These are different cost structures, so a straight dollar comparison would mislead. Scrut’s subscription buys continuous monitoring, a trust center, questionnaire tools and multi-framework tracking, none of which our fee includes, and our fee buys people’s time and an attestation that the subscription does not. Why platforms are priced the way they are is in why compliance platforms charge a platform fee, the three-year arithmetic is in SOC 2 total cost of ownership, and our bands by framework are on the pricing page.
Sources: Scrut SOC 2 FAQ, Scrut on AWS Marketplace (Sold by: Scrut Automation), Scrut guide: cost of a SOC 2 audit (updated Aug 5, 2026). Checked October 2026.
When each one fits.
When to choose Scrut
- Someone at your company owns compliance and will work in the tool between audits.
- You run several frameworks at once and want one control set mapped across them.
- Most of your evidence lives in cloud and SaaS tools that Scrut integrates with.
- Security questionnaires arrive every week, and your sales team would use a trust center.
- You want India, Gulf, UK or Australian frameworks tracked in the same place as SOC 2 and ISO 27001.
When to choose TCSA
- No one owns compliance yet, and you would rather have experienced people do the work than learn it on the job.
- You want one fee, fixed before work starts, with the SOC 2 attestation inside it and no subscription.
- You have one framework to clear now and no dated plans yet for a second.
- You want VAPT from the firm that prepares your audit, or a vCISO or vDPO alongside it.
- You already run Scrut and want hands to close what it flags.
If the answer is still unclear, the deciding variables are set out in compliance platform vs consultant and do you need SOC 2 software.
Sources: Scrut homepage, Scrut frameworks page, Scrut Trust Center page. Checked October 2026.
Scrut and TCSA, working together.
Scrut expects customers to bring in outside expertise too. Its startup page describes a “Marketplace for Compliance Pros” to find vetted auditors, consultants and pen testers,[18] and its partner directory describes “a network of partners and auditors familiar with the Scrut platform”.[7]
- Scrut does the watching. Integrations pull evidence, automated tests flag drift between audits, and Trust Vault answers buyers.[1][14][16]
- We do the judgement work. Scoping, policies written to how you actually operate, help closing what the tests flag, VAPT and preparing your team for the auditor.
- Pick one route for the audit. Scrut sells audit coordination as an add-on,[3] and our SOC 2 fee already includes an independent CPA firm. Settle at scoping which one you want, so you pay for the audit once.
- No second tool. If you already run Scrut, we work inside your workspace, so your evidence stays in one place and the firm that audits you is still not the one that prepared you.
This comparison is our own, written from Scrut’s public pages and listings. Scrut has not reviewed or endorsed it, and its name is used only to identify its product. If you spot an error, write to info@tcsa.in and we will check it and correct the page.
Sources: Scrut homepage, Scrut SOC 2 FAQ, Scrut partner directory, Scrut compliance automation page, Scrut Trust Center page, Scrut for startups page. Checked October 2026.
TCSA vs Scrut, the questions buyers ask.
Is Scrut a software platform or a consultancy?
Does Scrut’s price include the SOC 2 audit?
How much does Scrut cost?
Can TCSA work with a company that already uses Scrut?
Which route gets a SOC 2 report sooner?
Does Scrut cover India’s DPDP Act and RBI requirements?
Who issues the SOC 2 report and the ISO 27001 certificate on each route?
Sources: Scrut homepage, Scrut general FAQ, Scrut SOC 2 FAQ, Scrut on AWS Marketplace (Sold by: Scrut Automation), Scrut terms of use, Scrut SOC 2 solution page, Scrut /pricing address, Scrut on Capterra India (UK and Australia identical), Scrut guide: what is SOC 2 automation software (updated Aug 14, 2026), Scrut frameworks page. Checked October 2026.
Where every Scrut fact comes from.
We read each page below on 6 October 2026 (IST) in a browser and checked it again in a second, independent pass. Scrut updates its pages and prices, so check the live page before you rely on a figure. G2 and TrustRadius blocked automated reading, so nothing here is taken from them. Figures about TCSA come from our pricing and proof pages.
About Scrut, from its own pages. Scrut was founded by Aayush Ghosh Choudhury (Co-Founder and CEO), Jayesh Gadewar (Co-Founder and CTO) and Kush Kaushik (Co-Founder).[19] In April 2024 it announced a $10 million growth round led by Lightspeed and MassMutual Ventures, taking its total raised to about USD 21 million.[20] It says it serves 2,500+ customers in 65+ countries.[19]
- 01Scrut homepage
Scrut Teammates and “Your team reviews and approves.”, implementation managers and dedicated InfoSec managers, 2,500+ customers, 70+ frameworks, 150+ tools, reuse of up to 80% of controls.
www.scrut.io/ · checked 6 October 2026 - 02Scrut general FAQ
“A risk and compliance automation platform”, pricing “tailored to your compliance needs”, no charges by users or usage, audit charges that “may influence the final quote”, SOC 1 among the frameworks named.
www.scrut.io/faqs/general · checked 6 October 2026 - 03Scrut SOC 2 FAQ
The audit performed by an independent CPA or authorized firm, introductions to licensed audit firms, what the platform fee includes, VAPT and audit coordination as optional add-ons, the $30,000–$80,000 yearly estimate, Type I and Type II timing.
www.scrut.io/faqs/soc-2 · checked 6 October 2026 - 04Scrut on AWS Marketplace (Sold by: Scrut Automation)
USD 15,000 for a 12-month contract, organisations of up to 20 employees, support terms (implementation, onboarding, continuous support, Monthly Business Reviews), non-cancellable and non-refundable orders.
aws.amazon.com/marketplace/pp/prodview-fz4mb7o7dzj4i · checked 6 October 2026 - 05Scrut terms of use
Audit Services from a third-party auditor, the management representation letter, audit issues resolved between customer and auditor, the two contracting entities and governing law, support hours, the 99% availability SLA.
www.scrut.io/terms-of-use · checked 6 October 2026 - 06Scrut SOC 2 solution page
In-house SOC 2 experts, dedicated Slack channels, live consultations, “in-house services like VAPT”, direct access to SOC 2 auditors inside the platform.
www.scrut.io/solutions/soc2 · checked 6 October 2026 - 07Scrut partner directory
“A network of partners and auditors familiar with the Scrut platform”. No partner, auditor or CPA firm named in the rendered page or its markup.
www.scrut.io/partners/partner-directory · checked 6 October 2026 - 08CREST Marketplace: Scrut Automation Inc.
CREST accreditations in Penetration Testing and Vulnerability Assessment.
marketplace.crest.org/supplier/scrut-automation-inc/ · checked 6 October 2026 - 09Scrut /pricing address
Returned HTTP 404 in a browser render and with curl. Scrut has no public pricing page.
www.scrut.io/pricing · checked 6 October 2026 - 10Scrut on Capterra India (UK and Australia identical)
“Starting Price: Not provided by vendor”, overall rating 4.9 based on 139 reviews.
www.capterra.in/software/1052809/scrut · checked 6 October 2026 - 11Scrut guide: what is SOC 2 automation software (updated Aug 14, 2026)
Implementation in two to four weeks, a Type II observation period of at least three months, what automation does not do, the human judgement that stays with your team.
www.scrut.io/hub/soc-2/what-is-soc-2-automation-software · checked 6 October 2026 - 12Scrut frameworks page
DPDPA, RBI CSF, RBI PA/PG, RBI DPSC, SEBI CSCRF, ISR V2, SAMA frameworks, Saudi PDPL, Cyber Essentials, Essential Eight, Australia ISM and custom frameworks. CERT-In not listed when checked.
www.scrut.io/solutions/all-frameworks · checked 6 October 2026 - 13Scrut guide: cost of a SOC 2 audit (updated Aug 5, 2026)
A GRC platform at $10,000–$30,000 a year with a possible one-time onboarding fee, India auditor fee estimates labelled market approximations, automation that “does not eliminate the auditor fee”.
www.scrut.io/hub/soc-2/cost-of-soc-2-audit · checked 6 October 2026 - 14Scrut compliance automation page
“Run hundreds of prebuilt automated tests across your tech stack”.
www.scrut.io/platform/compliance-automation · checked 6 October 2026 - 15Scrut Audit Center page
Invite auditors, control what they see, share evidence and track requests in one place.
www.scrut.io/platform/audit-center · checked 6 October 2026 - 16Scrut Trust Center page
Trust Vault, a document hub with NDAs, expiry dates and approval rules, linked to CRM deals.
www.scrut.io/platform/trust-center · checked 6 October 2026 - 17Scrut ISO 27001 FAQ
“External ISO 27001 certified auditor charges” listed as a cost of their own.
www.scrut.io/faqs/iso-27001 · checked 6 October 2026 - 18Scrut for startups page
A “Marketplace for Compliance Pros” to find vetted auditors, consultants and pen testers.
www.scrut.io/solutions/startup · checked 6 October 2026 - 19Scrut About page
Founders Aayush Ghosh Choudhury, Jayesh Gadewar and Kush Kaushik, 2500+ customers, 65+ countries. No headquarters city or founding year given.
www.scrut.io/company/about-us · checked 6 October 2026 - 20Scrut funding announcement (Apr 3, 2024, updated Feb 11, 2026)
$10 million growth round led by Lightspeed and MassMutual Ventures, about USD 21M raised since inception.
www.scrut.io/post/scrut-automation-has-raised-10-million-in-growth-capital · checked 6 October 2026
Related Reading
TCSA vs Compliance Platforms
Vanta, Drata, Sprinto, Scrut and four more, compared on who does the work, the audit and the price.
Read moreTCSA vs Vanta
Compliance software or a services firm: who does the work, the auditor, pentests and pricing.
Read moreTCSA vs Drata
A trust platform or a services firm: the work, the auditor, penetration testing and list prices.
Read moreTCSA vs Sprinto
A compliance platform your team runs, or a services firm whose SOC 2 fee includes the CPA attestation.
Read moreWho Can Perform a SOC 2 Audit?
Only licensed CPA firms — independence, peer review, and where consultants fit.
Read moreSOC 2 Cost Guide
What SOC 2 audits actually cost, by company size and type.
Read moreRunning Scrut, or still deciding? Ask an auditor.
Tell us what your customers are asking for and what you already run. We will tell you plainly whether you need us, the platform or both, drawing on 1,000+ audits and 300+ SOC 2 engagements.
Last reviewed October 2026. Scrut facts checked against Scrut’s own pages and listings.