Drata Security & Compliance Automation Platform (D)

I use Drata to manage the frameworks that my company intends to remain compliant with or that it intends to adopt. It's a tool that is used mostly to monitor requirements, controls and evidences.

I usually use predefined frameworks on Drata, but also sometimes customized frameworks. The predefined ones come with a set of requirements, suggested controls, and suggested evidences to attach to the controls. This is basically how you manage it. There is also some level of customization that is favorable for companies that have information security management systems that are different than what Drata has as a default.

The most significant improvement is the reduction in manual work and the impression that there is a broad control over governance, risk and controls, which is my area of expertise. It really reduces friction in having to monitor things manually, in having to keep logs and registries in all sorts of different tools. Everything is centralized.

I am prompted to open Drata whenever there is an action that is needed from my side. I can also allocate specific tasks to specific people within the organization, which is quite helpful. In terms of connectivity with other applications, it is quite efficient to be able to retrieve information from other applications or receive notifications in other applications. All of that works quite smoothly.

Drata was adopted before my joining the company. I can only say what I have heard, which is that it significantly reduced time in managing certain tasks.

What I use mostly on a day-to-day basis is the monitoring feature that allows me to monitor how my controls are performing and if there is any action needed from my part. The notifications work quite smoothly, and I can just open Drata when I am prompted to and fix whatever needs fixing or attach evidence wherever needed.

The notifications absolutely help me respond faster. I can also schedule them for a certain moment of the day that I would like to allocate time for it on a daily or almost daily basis. The reduction in manual tracking is quite helpful so that I do not have to constantly think about checking Drata manually. I can just wait for a notification to come in.

My most relevant comment about the current usage of Drata is that there is not enough level of customization in certain modules, such as the risk management module, which is something I am not using because I cannot customize it to meet my needs. Another thing is that I do not use certain modules such as the vendor management module because it is also not fitting my needs the way I would like it to.

I think Drata could have an additional layer of agentic ownership in the sense that there could be more AI embedded into the product, not as a decision maker, but as a mechanism to provide suggestions, to summarize things in a way that is more robust than the actual summarization that exists these days. That would be my main concern to point out, along with what I have mentioned before, which is the customization of, specifically, the risk management module. It is unfortunate that I cannot use it, but I would really like to use it within Drata.

For me, it is the customization and the AI enablement that is missing in Drata when comparing it to other in-house built solutions or competitors such as Vanta.

The outputs are reliable and accurate. They are just slightly green in terms of what I think they could do more for me. I do not use those outputs. I think there should be a call to action in the outputs most times, and maybe a better explanation of what needs doing and what are the reasons why something needs to be done, perhaps for someone who is using the tool for a shorter period of time.

I have been using Drata for eight months.

I mean Drata, the compliance management tool.

I have no concerns about Drata's AI capabilities. It is not something that generated concern on my part when it first appeared in Drata.

We did not.

Make sure your connectors are all properly set up. That will really make your onboarding process much more efficient and easier.

Public Cloud

Amazon Web Services (AWS)

My main use case for Drata is ISO 27001 implementation.

I use Drata for ISO 27001 implementation by utilizing the templated policies that it provides within the portal, and I also used the controls page to guide me through the implementation of the different ISO 27001 controls.

Drata has impacted my organization positively by allowing me to have an audit, and it made it so much easier and faster to conduct an audit.

It saved me time during the audit process, so instead of it taking about two weeks in a manual process, it took a few hours for stage one and a few hours for stage two, and everything went by a lot faster with less questioning from the auditor. I was able to upload any missing evidence through Drata and gave them access through Drata itself, so there were no additional access that I needed to give to the auditors.

The best features Drata offers would be the controls list that is directly connected with the different services that we provide, so I am able to connect AWS and Microsoft, and Drata can easily track compliance for me.

The connectivity with AWS and Microsoft helps me in my day-to-day work as it makes things faster and makes my job a lot easier, so I do not have to keep track in an Excel file on my end. I can log on to the Drata portal, and everything would already be populated for me.

Regarding Drata's AI capabilities and governance and security, I do not know enough about it, but I know that they already have ISO 42001 certification, therefore I would think that they are already buttoned up with their AI governance. As far as the AI capabilities, I think that they have an AI product available to their customers and over time it will evolve and sharpen.

Regarding Drata's AI capabilities, I think its accuracy and reliability of output are fairly accurate, although I do obviously check any output it provides, and I find it fairly easy to use and accurate.

I would say perhaps the customer service experience, meaning the availability from the CSM teams or CSM assigned person, as it would be nice to have more human contact throughout the membership process.

I have been using Drata for about three years.

Drata seems stable.

The customer support is very reliable.

I would rate the customer support on a scale of one to ten as a nine.

We did not have a previous solution before using Drata.

I do not have any specific metrics, but I would say that time was saved.

My experience with pricing, setup cost, and licensing was very smooth. From what I remember, the salesperson was not very pushy, and they were able to find a reasonable price for us since we had a tight budget.

Before choosing Drata, we evaluated Vanta as an option.

On a scale of one to ten, I would rate Drata a nine.

I choose a nine because nothing is perfect.

We use AWS and Microsoft Azure as our cloud providers.

My advice to others looking into using Drata is that if they have the budget, Drata is absolutely well worth it. My overall product rating for Drata is nine.

Hybrid Cloud

Amazon Web Services (AWS)

What do you like best about the product?

In general the Drata GUI is very good. I particularly like Support's help for helping me accomplish actions that are not obvious to me how to do in Drata.

What do you dislike about the product?

Drata has a very nice policy workflow GUI, however the huge drawback for me is that if someone has not had to acknowledge a policy, then that person can not view the "published" policy in Drata. I have reported this as a suggested product improvement.

What problems is the product solving and how is that benefiting you?

I am the I.T. Compliance Manager. I've been collecting compliance artifacts via JIRA, ServiceNow, email and Teams Chat. With Drata, I have just one conduit!

What do you like best about the product?

A good dashboard that provides a clear percentage-based overview of the compliance status for all frameworks available in the account.

What do you dislike about the product?

Nothing for now. Everything is working well enough.

What problems is the product solving and how is that benefiting you?

Drata helps streamline third-party audits with minimal manual intervention from the RChilli team. Additionally, it helps RChilli efficiently manage and maintain the compliance frameworks applicable to our organization.

What do you like best about the product?

I really like how Drata has everything clearly designated on a single dashboard, making it easy to see what needs to be done. I can drill down into individual items without any hassle. The prioritization features, particularly the per-user filtering with priorities for evidence renewal, help focus me on the tasks I need to do immediately, which is crucial when handling the large amount of information for SOC 2 audits. It simplifies my workflow by letting me concentrate on what I need to provide right away.

What do you dislike about the product?

It's not always clear what some of the evidence being asked for actually is and what is required, so a lot of assumptions have to be made. Also, there was some initial learning curve during setup, though I wasn't directly involved.

What problems is the product solving and how is that benefiting you?

Drata makes submitting evidence for SOC 2 audits easy, letting me update policies and collaborate with the team smoothly. Its dashboard focuses me on immediate tasks, helping manage the overwhelming data involved in audits.

What do you like best about the product?

Pros: Excellent compliance automation platform with a clean interface and strong integrations. It has helped simplify audit preparation and ongoing compliance management.

Cons: Customer support has deteriorated significantly. We were initially promised human support, but most interactions are now handled by AI agents that provide repetitive and often unhelpful responses. Instead of solving problems quickly, support frequently wastes time and creates frustration.

Overall: Great platform, but the support experience has become its biggest weakness.

What do you dislike about the product?

The biggest issue with Drata is, without question, its customer support. When we purchased the platform, we were promised access to knowledgeable human support representatives who could provide timely and meaningful assistance. That commitment appears to have disappeared.

Today, nearly every support interaction is handled by AI agents that repeatedly provide generic, canned responses that rarely address the actual issue. Instead of helping customers resolve problems, the support process often forces us to spend additional time explaining the same issue over and over again while receiving the same unhelpful answers.

Frankly, Drata's support has become a nightmare. What was once a differentiator has turned into the platform's biggest weakness. The product itself is good, but when customers need help, the lack of effective human support creates frustration, delays, and a poor overall experience.

If Drata wants to maintain customer trust, it needs to bring back accessible, knowledgeable human support instead of relying almost entirely on AI-driven responses.

What problems is the product solving and how is that benefiting you?

streamlining the compliance process

What do you like best about the product?

I like the policy management in Drata. It's easy to understand, and the templates are great. I also appreciate the support and the live chat feature, which is very useful and fast to respond to any questions. The guidance for pursuing a new framework is very useful too. I like the automated tests and the documentation, which was written by a human, so that's always good. Drata makes policy management easy, with everything housed in one place, and from a new user perspective, all they have to do is sign in and acknowledge policies. Implementing new policies or making changes is very easy, and it's automatically version-kept.

What do you dislike about the product?

The new UI updates within the past few months have not been the best. I prefer the old UI because it seems extra complex. They've made it more complicated; if I want to do something, it's now a few clicks away rather than just one click. I feel like they have abstracted a lot of the stuff and made it a bit less intuitive or easy. While it might look cleaner, I don’t care about the UI's aesthetics; I care about its functionality, and it feels like the functionality got worse.

What problems is the product solving and how is that benefiting you?

I use Drata for compliance, especially SOC 2 audits and ISO 27001. It simplifies policy management and provides guidance for new frameworks. The trust portal links security certifications to our site, and the support features, like live chat, document help, and automated tests, enhance usability.

What do you like best about the product?

I particularly appreciate the integration and automation with Drata, which makes it easy to go through compliance reviews. The ability to automate and integrate into connectors makes the review process much clearer. Additionally, the initial setup was very simple and took only a few days.

What do you dislike about the product?

The user interface could be improved. It should be faster and clearer so that I can more easily find where I need which controls. Additionally, system reports should be more accessible to quickly respond to faulty tests or noticeable control tests and understand the next steps.

What problems is the product solving and how is that benefiting you?

Drata automates my IT security management and simplifies continuous documentation through integration. It also enables me to conduct compliance reviews by listing necessary tasks.

What do you like best about the product?

What I like best about Drata is how easy it is to use. The platform is intuitive, straightforward to navigate, and makes managing compliance much simpler. I feel we’re getting good value for what we’re paying. The time saved through automation and having our compliance activities centralized makes the pricing worthwhile. It reduces the manual effort involved in managing compliance and helps us stay organized and audit-ready.

What do you dislike about the product?

Sometimes I find it difficult to navigate between my admin and personal account, as it’s not always clear which account or view I’m currently using. A clearer indication of the active account or role would make the experience easier.

What problems is the product solving and how is that benefiting you?

Drata helps simplify and centralize our compliance work. It reduces the amount of manual effort needed to track controls and evidence and gives us a clearer view of our overall compliance status. This saves time and makes it easier to stay organized and audit-ready.