Vanta Says 3 Laptops Are Failing. What It Actually Wants

You're working toward SOC 2, Vanta is connected, and the dashboard says three computers are failing. The engineers say their laptops are fine. Somebody has to sort it out before the auditor looks, and on a small team that somebody is usually you.

The good news: Vanta's device checks are narrow and fixable. Here's what it's looking for and how to make each laptop pass.

The quick answer

Vanta's device checks come down to four things on each computer:

1. Disk encryption is on (FileVault on a Mac, BitLocker or Device Encryption on Windows).
2. A password manager Vanta recognizes is installed.
3. Antivirus Vanta recognizes is installed and running.
4. The screen locks and asks for a password after a period of inactivity.

Fix whichever one is failing, then give it time: Vanta's help pages say changes can take up to 24 hours to show.

Vanta's interface and help articles change often. Everything below is from Vanta's help center as of October 2026. Where your settings screen differs, Vanta's article wins.

First, find out which check is failing

Open Computers in Vanta and click the failing device. Each check shows pass or fail. Also look at the Last Check column. Vanta's troubleshooting guide flags a device that hasn't checked in for more than 24 hours. If a laptop that's been switched on hasn't reported for that long, the problem is the agent, not the settings (see below).

Disk encryption

Mac

Go to Apple menu > System Settings > Privacy & Security > FileVault and turn it on. You need an admin account. Store the recovery key somewhere the company controls, not just on the laptop. Apple's FileVault guide has the details.

Windows

Search for Device encryption or Manage BitLocker in Settings. Windows Pro uses BitLocker; many Windows Home laptops have Device Encryption instead. One catch Microsoft calls out: Device Encryption only starts protecting the drive once the recovery key is backed up, which happens when the laptop is joined to your work (Entra) account or a domain, or someone signs in with a Microsoft account that's an admin on it. A laptop set up with only local accounts can show as encrypted but isn't actually protected. Save the recovery key to the company's Microsoft 365 or Entra account.

Password manager

Vanta looks for a password manager on its list, as an app or a browser extension. 1Password and Bitwarden are on it. Two common failures:

• Installed from the Microsoft Store. Vanta says it won't detect Store installs on Windows. Uninstall it and install from the vendor's website.
• Using only the browser's or the Mac's built-in password saving. Vanta's list doesn't include the password saving built into Chrome, Edge or Safari, and it says macOS Keychain doesn't count. Use one company password manager everyone installs.

Antivirus

On a Mac, Vanta detects Apple's built-in XProtect on macOS 12.3 and later, so most up-to-date Macs pass without extra software. On older macOS, it also wants System Integrity Protection on and automatic security updates turned on.

On Windows, Vanta detects antivirus that shows up in Windows Security, including Microsoft Defender. If it's failing:

• Go to Windows Security > Virus & threat protection > Manage settings and make sure Real-time protection is on.
• If another antivirus product is installed, Defender switches itself off. Check Virus & threat protection > Manage providers to see which product is actually active, and remove trial antivirus that came with the laptop and has expired.

Screen lock

Vanta wants the computer to lock and ask for a password after a period of inactivity. Its documented limit for the agent is 60 minutes or less on a Mac and on Windows, but your own SOC 2 policy may say less. Set it to whatever your policy says, and 15 minutes is a sensible default.

• Mac: System Settings > Lock Screen. Set when the screen saver starts or the display turns off, and set Require password after screen saver begins or display is turned off to immediately or a short delay. Vanta counts the two together.
• Windows: Vanta's check looks at the screen saver settings: pick a screen saver other than None, set Wait to between 5 and 60 minutes, and tick On resume, display logon screen.

When the laptop is fixed but still failing

• Give it a day. Changes can take up to 24 hours to appear.
• The agent isn't reporting. If Last Check is more than a day old, follow Vanta's troubleshooting article for the agent on that operating system, or reinstall it. Agents also stop working on operating systems too old for Vanta to support.
• It's an old laptop. For a computer that's been retired, uninstall the agent first. Vanta's removal guide says to use the Remove computer button only if uninstalling doesn't clear it, and warns that an admin-removed device is permanently disabled.
• It's someone's personal machine that shouldn't be in scope. Decide whether it belongs in your SOC 2 scope at all; if not, stop using it for work rather than trying to make it pass.

Agent or MDM?

Vanta can monitor devices through its own agent or through a device management (MDM) tool such as Intune, Jamf or Kandji. For companies with fewer than 75 devices, Vanta recommends its standalone agent. An MDM is still worth it if you need to push settings rather than ask people to change them, and it can make the checks stricter: some MDM integrations expect a shorter screen-lock time than the agent does.

Keep it passing

• Add the Vanta agent, password manager and encryption to your new-hire laptop checklist, so new machines pass on day one.
• Add "uninstall the agent and remove the device" to your offboarding checklist.
• Glance at the Computers page once a month, not the week before the audit.

SOC 2 isn't a certificate. It's a report from an independent CPA firm on how well your controls work, so devices that drift out of compliance between checks show up in the report.

When to get help

• More than a couple of laptops fail and nobody owns fixing them.
• You want settings pushed automatically instead of chasing people.
• Your auditor is asking for evidence for machines Vanta can't monitor.

We resell and support Vanta for small SaaS teams, and our IT support keeps the laptops, accounts and offboarding in shape for the audit. If your team already has IT help, co-managed security adds managed endpoint detection and response, login monitoring and security training alongside them, with records you can hand an auditor. If you'd like a hand, get in touch.

Related reading

• Lost Phone or Angry Ex-Employee? Protecting Company Data on Personal Phones
• The Microsoft 365 Security Settings Small Businesses Never Turn On
• Old Data Breach? How to Check if Hackers Are Using Your Leaked Passwords (Credential Stuffing)