Scytale Reviews

My usual use case for Scytale is for ISO 27001 compliance.

The inbuilt framework was reasonable on 27001, and the policy support was reasonable. Scytale's customizable policy framework seems acceptable.

Scytale unilaterally suspended access because in their opinion, I don't know why they did that. I'm assuming they think that we're competitive, which we're not. They sold us the system and sent a contract to us in full knowledge of what we do as a business. Compliance is a very broad word; we provide compliance into nonprofits, housing associations, markets that these guys do not serve. Somebody inside Scytale likely thought, "Oh my God, these guys must be competitive, so let's just cut them off." I'm assuming that's what happened, but there was no explanation, nothing.

Scytale did not help me streamline my compliance processes. It didn't really identify gaps. There was no gap analysis in there that we could see. I didn't really get that far to use the effectiveness of Scytale's real-time insights in identifying potential compliance issues. All my experiences with Scytale have been negative. We haven't used the automated evidence collection of Scytale. Scytale has not helped me allocate resources more efficiently for compliance; it's been the opposite experience. We have put six months of effort into looking at the controls on 27001, talking about auditors, getting audit-ready, and so forth. But we've invested significant time, which has now been a complete waste of time.

Scytale is not only unreliable, considering they can suspend access without any notice or formal reason, but this lack of stability results in serious concerns about their dependability as a partner. If they can do that without explanation, my fear is that even if they switch it on again, who's to know in three months' time that the same thing couldn't happen again?

I have been working with Scytale for about six months.

Scytale is not reliable at all; not stable. You would be unwise to put a mission-critical function like ISO 27001 on Scytale. From one to ten, I would rate the stability and reliability of Scytale as a one.

We have communicated with the technical support and customer service of Scytale. My experience with them is that the response time is very slow from Scytale. You get a ticket, and maybe a couple of days later, people might get back to you. When we asked Scytale for an explanation as to why they did what they did, there was no response—either direct LinkedIn messages out to their CEO and senior management team or in-app messages to their customer support service—just no response. I thought they'd gone out of business; that was my assumption when we couldn't access the system. Based on my experience with the technical support, I would definitely rate them a one.

We did not use a different solution for these use cases before Scytale.

Initially, I participated in the setup and deployment of Scytale, but then it was passed on to a staff member.

The processes I participated in during the setup of Scytale were straightforward; it was acceptable and fine.

We did evaluate other options and vendors before choosing Scytale; we looked at Vanta and Drata. We decided to go with Scytale over Drata or Vanta because we thought the interface was a bit nicer, and we thought that maybe they were a smaller company that we would get better support from as opposed to Vanta.

We're going to sue Scytale, and we're going to sue Amazon as well because they're technically the people we're paying.

My feedback on Scytale is that it's terrible.

Currently, it's actually useless to us. When we were using it, it was good.

We used elements of integration into our core subsystems.

We were working with it and building it up; we had spent probably about a man-month in that six months, which has now been a wasted effort.

We've had a month of a man-month of effort, and now we have to go back to square one, go to Vanta or go to Drata or one of the other competitors, and that's what we're going to do next.

Scytale unilaterally suspended access because we have a subscription through Amazon marketplace, paying monthly, and we're not direct competitors with Scytale. We provide compliance services into specific vertical markets like credit unions and financial institutions. We don't do security compliance, which is their bread and butter or their primary market.

We went back because we were using Scytale for ISO 27001 certification and had put about six months' work into it. There was no formal reason, no notice, nothing. We just tried to log in one day and couldn't, and then reached out; a junior customer service representative said, "Oh, no, it's with our legal department," and provided no explanation.

I rate this review overall as a one out of ten.

Scytale's main use case for our organization is to automate our security compliance and prepare everyone in our organization for certifications and audits, mainly for ISO 27001, GDPR, and HIPAA. Our primary focus is on ISO 27001 and GDPR compliance. We also use the platform to collect evidence and monitor compliance controls.

A specific example of how we use Scytale for ISO 27001 or GDPR compliance involves our response to phishing emails. When we received spam emails that were typically phishing emails, we sent out a questionnaire and training to help people identify certain cybersecurity hacking strategies that most attackers use. This educated our employees on how to be aware of these threats.

Scytale has positively impacted my organization by giving us the ability to really educate our employees and make them aware, providing them more situational awareness when it comes to cybersecurity.

I have noticed specific outcomes since using it. More employees and colleagues are noticing suspicious emails that have been sent to them and being more alert. When they are not sure about an email, they check with our security team. If an email looks suspicious, they do not take any action on it but filter it out first. This approach has avoided a lot of issues.

Scytale's best features include automated evidence collection, continuous control monitoring, and the compliance dashboard, which are helpful when we need to automate our evidence collection. Scytale also gives us the ability to map overlapping requirements. I also value Scytale's Trust Center for communicating security information to our employees and our customers.

I find myself using automated evidence collection and the compliance dashboards most often. These features give us an overview of seeing who exactly has taken the trainings and who is pending so that we can keep reminding people to take those trainings and complete them.

Scytale can be improved by making the interface a bit more consistent in most areas of the platform, as sometimes it can be confusing, and some information can be inaccessible or cut off. Additionally, there are some occasional bugs that could be improved.

Scytale would be more helpful if it was more flexible for organizations with specialized internal processes.

I have been using Scytale for the past two years.

I would rate Scytale a nine out of ten.

I chose nine out of ten because there are a couple of bugs and some challenges as I mentioned.

Regarding Scytale's AI capabilities, I think its governance and security are pretty robust when it comes to its data protection rules. From what Scytale states so far, it is good and they are GDPR compliant.

An improvement needed for Scytale that I have not mentioned yet is that for anyone looking to use it, they need to start identifying the exact certification or compliance framework they want to do and the deadline for achieving it. They should then ask Scytale if they can demonstrate the complete process using their intended framework.

The advice I would give to others looking into using Scytale is that they should start by identifying the exact certification or compliance framework their organization is looking for and the deadline that they are supposed to achieve it in. They should then ask Scytale to demonstrate that complete process using their intended framework.