Vanta cofounder/CEO here. Thanks for the feedback. What we should probably do is take the credential, start scanning, and then nag them with a failing test abo

Vanta cofounder/CEO here. Thanks for the feedback. What we should probably do is take the credential, start scanning, and then nag them with a failing test about overly-permissive roles. Our own role is an easy check because we know what to expect, but there's other best practices here we can check for (and in some cases do, though not 100% comprehensively across all clouds.)