SOC 3-Compliant Security Vendors
Security vendors are evaluated against SOC 3 when they handle the workflows this framework governs. Currently, 8 vendors in our Security category hold SOC 3 certification. Each listing below links to the vendor's full compliance profile.
Security vendors that hold SOC 3 certification
Okta
21/32Identity and access management platform providing secure authentication, authorization, and single sign-on for enterprises.
Zscaler
14/32Cloud-native zero trust security platform (ZIA/ZPA) for secure internet and application access.
Wiz
13/32Cloud-native application protection platform (CNAPP) for cloud security.
KnowBe4
8/32Security awareness training and simulated phishing platform.
Bitwarden
7/32Open-source password manager and secrets management platform.
LastPass
3/32Password management and identity vaulting platform.
VMware Carbon Black
3/32Endpoint detection and response (EDR) and antivirus platform, owned by Broadcom.
Available via Broadcom Trust Center
Keeper Security
2/32Password manager and privileged access management platform for enterprises.
Achieved 2025
These security vendors do not currently hold SOC 3 certification:
- 1Password (not documented)
- CrowdStrike (not documented)
- Snyk (not documented)
- Palo Alto Networks (not documented)
- Cisco Duo (not documented)
- Splunk (not documented)
- SentinelOne (not documented)
- Fortinet (not documented)
- Check Point (not documented)
- Rapid7 (not documented)
- Tenable (not documented)
- Qualys (not documented)
- Proofpoint (not documented)
- Mimecast (not documented)
- Auth0 (not documented)
- OneLogin (not documented)
- Ping Identity (not documented)
- JumpCloud (not documented)
- Dashlane (not documented)
- Orca Security (not documented)
- Lacework (not documented)
- Netskope (not documented)
- Darktrace (not documented)
- Varonis (not documented)
- Cybereason (not documented)
- Trend Micro (not documented)
- McAfee (not documented)
- Symantec (not documented)
- Sophos (not documented)
- Bitdefender (not documented)
- ESET (not documented)
- Malwarebytes (not documented)
- Ivanti (not documented)
- Keeper (not documented)
- Tailscale (not documented)
- Checkmarx (not documented)
- Veracode (not documented)
- GitGuardian (not documented)
- Semgrep (not documented)
- Clerk (not documented)
- WorkOS (not documented)
Know a vendor we're missing?