Drata Security & Compliance Automation Platform

My main use case for Drata is ISO 27001 implementation.

I use Drata for ISO 27001 implementation by utilizing the templated policies that it provides within the portal, and I also used the controls page to guide me through the implementation of the different ISO 27001 controls.

Drata has impacted my organization positively by allowing me to have an audit, and it made it so much easier and faster to conduct an audit.

It saved me time during the audit process, so instead of it taking about two weeks in a manual process, it took a few hours for stage one and a few hours for stage two, and everything went by a lot faster with less questioning from the auditor. I was able to upload any missing evidence through Drata and gave them access through Drata itself, so there were no additional access that I needed to give to the auditors.

The best features Drata offers would be the controls list that is directly connected with the different services that we provide, so I am able to connect AWS and Microsoft, and Drata can easily track compliance for me.

The connectivity with AWS and Microsoft helps me in my day-to-day work as it makes things faster and makes my job a lot easier, so I do not have to keep track in an Excel file on my end. I can log on to the Drata portal, and everything would already be populated for me.

Regarding Drata's AI capabilities and governance and security, I do not know enough about it, but I know that they already have ISO 42001 certification, therefore I would think that they are already buttoned up with their AI governance. As far as the AI capabilities, I think that they have an AI product available to their customers and over time it will evolve and sharpen.

Regarding Drata's AI capabilities, I think its accuracy and reliability of output are fairly accurate, although I do obviously check any output it provides, and I find it fairly easy to use and accurate.

I would say perhaps the customer service experience, meaning the availability from the CSM teams or CSM assigned person, as it would be nice to have more human contact throughout the membership process.

I have been using Drata for about three years.

Drata seems stable.

The customer support is very reliable.

I would rate the customer support on a scale of one to ten as a nine.

We did not have a previous solution before using Drata.

I do not have any specific metrics, but I would say that time was saved.

My experience with pricing, setup cost, and licensing was very smooth. From what I remember, the salesperson was not very pushy, and they were able to find a reasonable price for us since we had a tight budget.

Before choosing Drata, we evaluated Vanta as an option.

On a scale of one to ten, I would rate Drata a nine.

I choose a nine because nothing is perfect.

We use AWS and Microsoft Azure as our cloud providers.

My advice to others looking into using Drata is that if they have the budget, Drata is absolutely well worth it. My overall product rating for Drata is nine.

Hybrid Cloud

Amazon Web Services (AWS)

What do you like best about the product?

In general the Drata GUI is very good. I particularly like Support's help for helping me accomplish actions that are not obvious to me how to do in Drata.

What do you dislike about the product?

Drata has a very nice policy workflow GUI, however the huge drawback for me is that if someone has not had to acknowledge a policy, then that person can not view the "published" policy in Drata. I have reported this as a suggested product improvement.

What problems is the product solving and how is that benefiting you?

I am the I.T. Compliance Manager. I've been collecting compliance artifacts via JIRA, ServiceNow, email and Teams Chat. With Drata, I have just one conduit!

What do you like best about the product?

A good dashboard that provides a clear percentage-based overview of the compliance status for all frameworks available in the account.

What do you dislike about the product?

Nothing for now. Everything is working well enough.

What problems is the product solving and how is that benefiting you?

Drata helps streamline third-party audits with minimal manual intervention from the RChilli team. Additionally, it helps RChilli efficiently manage and maintain the compliance frameworks applicable to our organization.

What do you like best about the product?

I really like how Drata has everything clearly designated on a single dashboard, making it easy to see what needs to be done. I can drill down into individual items without any hassle. The prioritization features, particularly the per-user filtering with priorities for evidence renewal, help focus me on the tasks I need to do immediately, which is crucial when handling the large amount of information for SOC 2 audits. It simplifies my workflow by letting me concentrate on what I need to provide right away.

What do you dislike about the product?

It's not always clear what some of the evidence being asked for actually is and what is required, so a lot of assumptions have to be made. Also, there was some initial learning curve during setup, though I wasn't directly involved.

What problems is the product solving and how is that benefiting you?

Drata makes submitting evidence for SOC 2 audits easy, letting me update policies and collaborate with the team smoothly. Its dashboard focuses me on immediate tasks, helping manage the overwhelming data involved in audits.

What do you like best about the product?

I like the policy management in Drata. It's easy to understand, and the templates are great. I also appreciate the support and the live chat feature, which is very useful and fast to respond to any questions. The guidance for pursuing a new framework is very useful too. I like the automated tests and the documentation, which was written by a human, so that's always good. Drata makes policy management easy, with everything housed in one place, and from a new user perspective, all they have to do is sign in and acknowledge policies. Implementing new policies or making changes is very easy, and it's automatically version-kept.

What do you dislike about the product?

The new UI updates within the past few months have not been the best. I prefer the old UI because it seems extra complex. They've made it more complicated; if I want to do something, it's now a few clicks away rather than just one click. I feel like they have abstracted a lot of the stuff and made it a bit less intuitive or easy. While it might look cleaner, I don’t care about the UI's aesthetics; I care about its functionality, and it feels like the functionality got worse.

What problems is the product solving and how is that benefiting you?

I use Drata for compliance, especially SOC 2 audits and ISO 27001. It simplifies policy management and provides guidance for new frameworks. The trust portal links security certifications to our site, and the support features, like live chat, document help, and automated tests, enhance usability.

What do you like best about the product?

I particularly appreciate the integration and automation with Drata, which makes it easy to go through compliance reviews. The ability to automate and integrate into connectors makes the review process much clearer. Additionally, the initial setup was very simple and took only a few days.

What do you dislike about the product?

The user interface could be improved. It should be faster and clearer so that I can more easily find where I need which controls. Additionally, system reports should be more accessible to quickly respond to faulty tests or noticeable control tests and understand the next steps.

What problems is the product solving and how is that benefiting you?

Drata automates my IT security management and simplifies continuous documentation through integration. It also enables me to conduct compliance reviews by listing necessary tasks.

What do you like best about the product?

What I like best about Drata is how easy it is to use. The platform is intuitive, straightforward to navigate, and makes managing compliance much simpler. I feel we’re getting good value for what we’re paying. The time saved through automation and having our compliance activities centralized makes the pricing worthwhile. It reduces the manual effort involved in managing compliance and helps us stay organized and audit-ready.

What do you dislike about the product?

Sometimes I find it difficult to navigate between my admin and personal account, as it’s not always clear which account or view I’m currently using. A clearer indication of the active account or role would make the experience easier.

What problems is the product solving and how is that benefiting you?

Drata helps simplify and centralize our compliance work. It reduces the amount of manual effort needed to track controls and evidence and gives us a clearer view of our overall compliance status. This saves time and makes it easier to stay organized and audit-ready.

What do you like best about the product?

requirements gathering and consolidation

What do you dislike about the product?

Integration, Monitoring, Connections, and lack of complete set of tests.

What problems is the product solving and how is that benefiting you?

having a consolidate dashboard that can display all the controls and frameworks.

What do you like best about the product?

I like Drata's integration and find it really helpful. The simple UI is something I appreciate, making the onboarding process much easier to manage. The initial setup was straightforward, and overall, these elements make using the platform a positive experience.

What do you dislike about the product?

I find the SOC2 compliance process, especially uploading documents and viewing them, to be complex with Drata. Additionally, the cost associated with this process is a bit of a concern.

What problems is the product solving and how is that benefiting you?

I use Drata for SOC2 compliance and it makes the process easier to manage, especially with onboarding and training.

What do you like best about the product?

Simple, easy to use, and does not require reading a lot of manuals to know how to use.

What do you dislike about the product?

Frameworks can get expensive over time, missing some frameworks (e.g. DTAC)

What problems is the product solving and how is that benefiting you?

Minimizing paperwork, decreasing fragmentation around policies, ensuring our systems are compliant to our frameworks.