Compliance has a peculiar way of turning smart engineers into screenshot collectors. A customer asks for a SOC 2 report. An auditor asks for proof that access reviews happened. Someone opens a spreadsheet, someone else hunts through an identity provider, and a third person tries to remember whether an offboarding ticket from February is still in Jira. Drata was built to make that scavenger hunt boring, repeatable and visible.
The San Francisco software company connects to the systems where security work already happens - AWS, Azure, Google Cloud, Okta, GitHub, HR tools and many more. It reads the signals, maps them to controls, collects evidence and flags when reality drifts away from policy. The result is not a certification. An independent auditor still has to examine the program. Drata's job is to stop audit readiness from becoming an annual act of archaeology.
That distinction helped three repeat founders turn a narrow wedge into a broad enterprise platform. Adam Markowitz, Daniel Marashlian and Troy Markowitz had already built Portfolium, an education-technology company acquired by Instructure in 2019. At Portfolium, they experienced the mismatch first-hand: the software business moved continuously, while proof of security was assembled manually and periodically. In 2020 they started Drata. Adam became chief executive, Daniel chief technology officer and Troy chief operating officer.
A rocket engineer meets the evidence folder
Markowitz's earlier career adds a useful detail to Drata's origin. At NASA, components had to be documented, verified and trusted before the larger system could move. In cloud software, the stakes and hardware are different, but the coordination problem rhymes. Drata treats trust as a system with live inputs, not a binder prepared for inspection day.
The first product focused on SOC 2, the familiar gate for B2B software companies selling into larger organizations. The pitch landed quickly. Drata said it reached 100 customers in less than 100 days after launch. It raised a $25 million Series A in June 2021 and a $100 million Series B that November, reaching a $1 billion valuation ten months after emerging from stealth. A $200 million Series C followed in December 2022 at a $2 billion valuation.
Those numbers describe an unusually fast SaaS climb, but they also explain why the product had to grow up. A startup pursuing its first framework needs templates and a clean path through SOC 2. A multinational security team needs custom controls, multiple business units, several frameworks, risk registers, policy ownership and auditable workflows. Drata now sells both ends of that spectrum, though its current language points firmly toward the enterprise.
Its customer list reflects the spread. Early-stage software teams use the platform to satisfy the first security-conscious buyer without hiring a full compliance department. Growth companies add frameworks as they enter healthcare, finance or new regions. Enterprise names such as Notion, Tenable, Alteryx, Brex, GitLab, UiPath and Okta appear in Drata's material, where the problem is less “How do we get a badge?” and more “How do we govern several programs without duplicating the same work?” Security and GRC teams are the daily operators. IT, engineering, HR and legal own pieces of the evidence. Auditors inspect it, while sales and procurement consume the resulting proof.
Drata calls its mission “Deliver Continuous Trust.” The phrase is marketing, but the underlying claim is testable: a security posture should describe what is true now, not what was true when someone exported a report last quarter. The company's own principles lean into the same engineering frame - choose integrity, own the outcome, invite perspective and automate for purpose. It began remote-first and now has offices in San Francisco, New York, San Diego, London and Sydney. Employees call themselves Dratanauts, a bit of startup whimsy earned honestly from the founder who once tested rocket engines.
What the machine actually does
The core loop is straightforward. Connect the technology stack. Translate a framework's requirements into controls. Assign people to the work automation cannot do. Let tests run against infrastructure and business systems. When a test fails or evidence goes stale, route the problem to an owner. Give the auditor a permissioned view instead of a zip file full of mystery screenshots.
In 2026, Drata said its infrastructure test library contained more than 1,000 checks across AWS, Azure and Google Cloud. Its Audit Hub organizes requests and evidence. Enterprise GRC adds risk, policies, internal audits and custom workflows. Cross-mapping lets one control support several frameworks, which is where the economics improve: work completed for SOC 2 can also contribute to ISO 27001, HIPAA or a custom program instead of being recreated under a different heading.
Consider a simple access rule: every production administrator must use multi-factor authentication. A connector can check the relevant identity system, attach the result to a control and retain the evidence. That control may answer several framework requirements. If an administrator falls out of policy, the platform surfaces the failure before an auditor discovers it. This is where “continuous” becomes more than decoration. Drata is replacing a point-in-time sample with a recurring signal and a record of what the team did next.
The customer evidence is more illuminating than any feature list. ChurnZero reported that its SOC 2 preparation fell from a year to a few weeks, the audit itself from a month to seven days, and annual audit cost from $35,000 to $10,000. Connective said its audit shrank from four or five months to five weeks. Measurabl said it automated 80 percent of its compliance workload after a previous provider's evidence collection and support disappointed.
“The thing that led me towards Drata the most was actually their UX.”Michael Kipp, Senior Director of Information Security at ChurnZero
That last case answers the useful question, “What failed first?” It was not the framework. It was the operating experience around evidence and support. The switch to Drata did not make controls disappear; it gave the customer one place to see them, reuse them and keep them alive. What changed minds was less a grand theory of governance than the daily feel of the work.
The acquisition that moved trust closer to revenue
By 2025, compliance automation was crowded. Vanta and Secureframe competed directly, while Sprinto, Scrut Automation and Thoropass pursued overlapping customers. Larger organizations could also look to AuditBoard, OneTrust or ServiceNow. Feature grids converged around integrations, frameworks, controls and evidence. Drata needed a second act that was adjacent, credible and harder to reduce to a checklist.
Its differentiation is therefore cumulative rather than magical. Vanta is a familiar first call for fast-growing technology companies. Secureframe emphasizes guided readiness. Traditional GRC suites arrive with broader enterprise histories. Drata's case is that deep evidence automation, configurable controls, auditor collaboration, third-party assessment and buyer-facing assurance can share one data model. That matters most to organizations large enough to suffer from handoffs between separate tools. For a ten-person startup chasing one report, the breadth can be more platform than problem.
It found one in SafeBase. Drata announced the acquisition in February 2025; TechCrunch reported a price of $250 million. SafeBase had built trust centers where vendors publish security material and control access to sensitive documents, plus AI assistance for the questionnaires enterprise buyers send before purchasing software. Drata helped produce the proof. SafeBase helped present and reuse it at the moment a buyer asked, “Can we trust this vendor?”
The combined platform now stretches from internal controls to external assurance: compliance automation, enterprise GRC, third-party risk management, Trust Center and AI Questionnaire Assistance. Drata said Trust Center had influenced more than $20 billion in customer revenue and its questionnaire product had processed two million questions by February 2026. Those are company-reported platform metrics, not revenue booked by Drata, but they reveal the positioning. Compliance is no longer presented only as loss prevention. It is infrastructure for getting deals through procurement.
What it costs, and what you are really buying
Drata does not publish a simple public price card. It sells quote-based subscriptions whose cost varies with company size, frameworks, products and complexity. Public buyer reports range widely, so a neat universal number would mislead. The independent audit is a separate expense. ChurnZero's figures are valuable because they measure an actual result: audit cost fell by $25,000 a year after implementation. They do not establish Drata's subscription price for another company.
This is classic business-to-business SaaS: recurring contracts, a direct sales motion, expansion as customers add products or frameworks, and distribution through technology and cloud partners. The funding supplied room to build ahead of revenue. After the seed, Series A and Series B rounds in 2021, Drata's 2022 Series C took disclosed primary funding to roughly $328 million. Private-market data records a further $126.83 million secondary or junior transaction in 2025, with the investors undisclosed. The capital also made the SafeBase purchase possible, turning product adjacency into ownership.
The real purchase is coordination. Software pulls the available evidence, but people still write policies, make risk decisions, fix failures and live with the controls. A startup that expects a green dashboard to confer compliance will be disappointed. So will an organization built on unsupported offline systems, or one with no named owner for access, incidents, vendors and change management. Automation multiplies a working process; it does not invent accountability.
Good conditions
Cloud-heavy stack, recurring audits, several frameworks, clear control owners, frequent buyer reviews and enough scale to reuse the same evidence.
Poor conditions
A one-time checklist, mostly manual systems, no internal owner, or the belief that a platform can replace the auditor and security judgment.
The copyable part is the sequence
A team does not need Drata's funding to borrow the operating idea. Start with the framework customers already ask for. Inventory where each piece of evidence lives. Build one control library and map multiple requirements back to it. Assign an owner and a response time to every failure. Collect evidence as work happens. Then publish an appropriately gated trust page so sales does not repeatedly pull security into the same conversation.
The order matters. If the control is fuzzy, automation creates faster confusion. If evidence is not current, the trust center becomes a glossy archive. If AI drafts questionnaire answers without a maintained knowledge base and human review, speed can outrun accuracy. Drata's own 2026 third-party-risk design keeps the final decision with people: the agent ingests documents, maps evidence and proposes an outcome; the team validates the analysis.
Drata is pushing that logic into a newer problem: governing enterprise AI agents. Its limited-availability product is designed to discover agents, enforce policy before actions and preserve an audit trail. This is a logical extension and an open test. Cloud accounts and employee records are relatively legible sources. Autonomous software acting across other software is less settled. The company that made a business from observing control drift now wants to observe the workers that never log off.
Five years after launch, Drata had opened a San Francisco headquarters, expanded across 80-plus countries and reported 60 percent revenue growth in 2025. The company still competes in a market where rivals can match many checkboxes. Its sharper argument is architectural: compliance evidence, vendor risk and customer assurance belong in one loop. The audit may have opened the door, but the larger business is everything that needs trustworthy proof after it.