Trust the agency, not just the agent: a conversation with Vanta's Khush Kashyap

Automating the Work, or the Workers?Vanta shipped a suite of AI agents it calls "24/7 GRC engineers" — evidence collection, risk analysis, vendor assessments, remediation guidance, all handled by machines. So what's left for the humans?Amer Altaf talks to Khush Kashyap, Senior Director of GRC at Vanta, about what agentic compliance actually means for practitioners — what it costs, what it changes, and whether the profession is being augmented or quietly automated out of existence.Khush runs Vanta's own GRC programme on the platform daily, making her both the builder and the first customer.In this episode:• What "agent" actually means at Vanta — beyond the industry buzzword• Whether this works for a 200-person firm with one security lead• The honest answer on pricing• Day one walkthrough: from spreadsheets to agentic compliance in a week• Who's accountable when the agent gets it wrong on approval number 41• "Don't trust the agents — trust the agency you build"• UK GDPR vs EU GDPR: does the system know the difference?• Data sovereignty, the CLOUD Act, and what UK CISOs are asking• Will compliance teams shrink? The nuanced answer• What skills GRC teams are hiring for nowChapters:00:00 What Vanta actually built — and what "agent" really means07:44 Does this work for a 200-person firm?17:03 Day one — from spreadsheets to agentic compliance22:31 When you're clicking approve on autopilot32:51 UK GDPR, data sovereignty, and the CLOUD Act42:08 Automating the work or automating the workers?53:39 The time machine questionGuest: Khush Kashyap — Senior Director of Governance, Risk and Compliance, VantaHost: Amer Altaf — Managing Editor, The Control Layer and CEO, ArkavaSubscribe to The Control Layer: https://thecontrollayer.arkava.ai Get full access to The Control Layer at thecontrollayer.arkava.ai/subscribe