Oneleet: the security work bundled in, assessed
Does its offensive security in-house rather than pointing at a partner. A penetration test, code scanning and attack-surface monitoring come with the compliance programme, which is a real difference from Vanta and Drata and is worth paying more for if your buyers ask security questions rather than certificate questions. The irony is that a company selling an end to compliance theatre runs some marketing theatre of its own.
If your customers have started sending security questionnaires that a SOC 2 report does not answer, Oneleet is built for that problem. Founded in 2022, a Y Combinator S22 company, it raised a $33 million Series A led by Dawn Capital in October 2025.
What it is
Seven products rather than one: a compliance platform, penetration testing, a code security scanner, attack-surface discovery, third-party audit coordination, a vCISO service, and an employee portal with device management. The compliance platform on its own is roughly what Vanta and Drata sell. The rest is the argument.
Its stated position, from its funding announcement, is that competitors let companies “run a basic vulnerability scanner, call it a penetration test” and end up “certified on paper. Still completely vulnerable in reality.” That is a strong claim about the category. It is worth asking whether Oneleet meets its own standard.
The assessment
Framework coverage Adequate, and uncounted
The frameworks page shows eight: SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CIS IG1, NIST 800-171 and EU DORA, plus custom frameworks. That covers the common cases, and PCI DSS and DORA are useful additions if you take card payments or sell into EU financial services.
Oneleet never states how many frameworks it supports, and the number you would infer depends on which page you land on. The site footer lists six and adds “+ 10 more”, implying sixteen. The frameworks page shows eight tiles. A readiness widget on the homepage lists twelve, including HITRUST, FedRAMP and ISO 42001, none of which appear on the frameworks page. If a specific framework is why you are shopping, confirm it in the demo rather than counting tiles.
Integrations and evidence automation Narrower, and honest about it
Around twenty-two integrations, covering the mainstream stack: AWS, Azure, Google Cloud, GitHub, GitLab, Okta-equivalents like JumpCloud, Google Workspace, Microsoft 365, Slack and others. The documentation lists a slightly different set from the homepage, and no total appears anywhere. This is materially narrower than Vanta’s 400-plus, and if your stack is unusual you will feel it.
Where you build your own integration, the limits are published and they are tight: API-key authentication only, JSON REST APIs using GET only, and the resulting integration can populate users for access reviews and nothing else. Anything outside that stays manual.
Credit where it is due. Oneleet states in its own documentation what its automation does not cover, writing that “some manual evidence, like signed docs or screenshots, may still be needed, especially for one-off processes or custom workflows.” Vanta and Drata publish automated test counts to four figures and say nothing about the remainder. That sentence is worth more to a buyer than any of them.
Auditor network and audit experience Bundled
Audits are performed by independent AICPA-member firms, as they must be, since no platform can attest to its own customers. Oneleet says a third-party audit is included in all SOC 2 packages, which means the audit fee sits inside its price rather than arriving separately from a CPA firm. That is useful for budgeting, and it is the opposite of the Vanta and Drata model where the audit is a second bill you discover later.
The trade-off is the one that applies to every younger platform: a smaller installed base means fewer audit firms have worked with its evidence formats. Ask which firms it routinely places customers with, and whether you can bring your own.
Pricing and total cost Unpublished
Oneleet publishes no prices. The pricing page is a form: “Please fill out the form and book a demo to get a quote.” On this specific point it is no more transparent than the incumbents it criticises, which is the fourth platform in a row we have assessed to publish nothing.
We are not printing a figure. Third-party estimates exist, but the ones we found trace partly to a direct competitor, and an unverifiable number is worse than none.
What you can reason about is scope. The intake form asks for headcount and framework selection, so expect both to move the price. More usefully, if a pentest and an audit are inside the number, compare it against what you would otherwise pay separately. A standalone penetration test is commonly several thousand pounds or dollars, and a SOC 2 audit fee is thousands more. A higher platform price that absorbs both may still be cheaper than a lower one that does not. One caution: the frameworks page describes the pentest as bundled into the SOC 2 programme, while the pricing form lists it as a separately selectable item. Establish which applies to your quote.
Fit by company stage Security-conscious, any size
Oneleet claims to suit everyone from a five-person startup to a six-thousand-person enterprise, which is the kind of claim that means little. The honest fit is narrower and more useful: companies whose customers ask real security questions. If you sell to financial services, healthcare or enterprise security teams, the bundled pentest and attack-surface monitoring answer questions a certificate does not. If you need a SOC 2 report to unblock a deal and nothing more, you are paying for capability you will not use.
Does it meet its own standard?
Mostly, on the security itself. The penetration testing is documented in more detail than most vendors manage: testers hold OSCP, OSCE and OSWE certifications, packages include twelve months of free retesting, and the methodology follows OWASP standards. The company explicitly refuses to run DDoS tests, on the grounds that they prove nothing during a penetration test, which is the sort of position a firm doing theatre would not take. The code scanner and attack-surface monitoring are documented products rather than bullet points.
The marketing is a different matter, and a buyer should notice.
The homepage headline reads “#1 in compliance”. In the page source, the component carrying it is named “#1 in compliance on YC”, eight times over. The qualifier is real and it is not shown to readers. Being the most popular choice within Y Combinator is a genuine achievement and a much narrower claim than the one on the page.
A “4.9/5” rating sits beside five stars with no attribution to any review platform. A claim of “70% faster audit ready” is offered with no comparison basis. And the site cannot decide how many customers it has: the homepage says thousands in one place and 1,000-plus in another, while the products and pricing pages both say hundreds.
None of this means the product underperforms. It means a company whose pitch is that the industry substitutes appearance for substance should be held to that line itself, and on its own website it is not quite meeting it.
Who it is for
A strong fit if…
- Your customers send security questionnaires a certificate does not answer
- You would otherwise buy a penetration test separately
- You want the audit fee inside one number rather than arriving later
- You have no security lead and the vCISO service would fill a real gap
Look elsewhere if…
- You need a SOC 2 report to close deals and nothing beyond it
- Your stack is unusual, where roughly twenty integrations will not stretch far
- You already have a pentest partner you trust and rate
- You need a specific framework confirmed before buying, given the counts do not agree
Looking at Oneleet directly
Pricing comes from a call, so establish three things on it: whether the penetration test and the third-party audit are inside the quoted number, which audit firms it places customers with, and whether the specific framework you need is fully supported rather than listed.
Visit OneleetAuditGround may earn a commission on some platforms.