Drata
Drata provides a platform that automates security compliance, risk management and trust assurance for companies.
- Categories
- GRC and compliance automation, Third-party risk and security ratings, Compliance audits (SOC 2, ISO 27001), AI and LLM security
- Based in
- San Francisco, United States
- Founded
- 2020
- Ownership
- Private
- Certifications
- SOC 2 Type 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 42001, SOC 3, CISA, Secure-by-Design Pledge, VPAT, AWS Qualified Software, AWS Security Software Competency Partner, FedRAMP Certified - Class B
About Drata
Drata provides an agentic trust management platform that helps organisations automate compliance, manage risk, and prove security posture. It sells to startups, growth companies, and enterprises, with over 8,500 global customers. The platform centralises governance, risk, and compliance in one system, automating evidence collection, control monitoring, and mapping across frameworks such as SOC 2, ISO 27001, HIPAA, and PCI DSS. It also offers a Trust Center for sharing security posture with customers and AI tools for questionnaire responses and third-party risk assessments. Drata's approach uses autonomous AI agents to reduce manual work in compliance and risk management. It provides continuous monitoring, guided remediation, and audit readiness. The platform integrates with hundreds of tools and supports multiple frameworks, allowing organisations to scale their compliance programmes. Drata also helps govern AI agents, discover shadow AI, and enforce policies before actions execute.
Products
- Compliance AutomationAutomates evidence collection and control monitoring across frameworks to prepare for audits.
- Trust CenterProvides a secure portal for customers to review security posture and request documents.
- AI Questionnaire AssistanceUses AI to draft accurate responses to security questionnaires based on approved content.
- Third-Party Risk ManagementSimplifies vendor onboarding with standardised assessments and automated follow-ups.
- AI Agent GovernanceDiscovers AI agents, enforces policies before actions execute, and produces auditor-grade proof of decisions.
- Enterprise GRCUnifies governance, risk, and compliance across frameworks and business units.
Ownership and deals
- Drata acquired SafeBase for $250mReport on Drata buying SafeBase (opens in a new tab)
- Drata acquired Oak9Report on Drata buying Oak9 (opens in a new tab)
- Drata acquired Harmonize.ioReport on Drata buying Harmonize.io (opens in a new tab)
- Raised $200m in a Series C roundInvestors ICONIQ Growth and GGV CapitalReport on the Drata funding round of December 2022 (opens in a new tab)
Acquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. Funding rounds from 2022 onwards come from Return on Security's weekly Security, Funded newsletter. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.