Last known valuation 01
$2B USD (2022 Series C) [CO008, CV002] Diligence report
Drata
Agentic Trust Management Platform
Drata remains a category leader in compliance automation and trust management, but opaque current financials and a stale $2B valuation keep the right posture at research-more.
Coverage and disclosure
This refreshed report relies on public company materials, customer stories, reviews, and analyst-style estimates. Private financial metrics, retention, and latest financing terms remain underdisclosed, so the valuation view is intentionally conservative.
Cover facts
Company profile
Drata is a late-stage private compliance and trust-management company founded by Adam Markowitz, Troy Markowitz, and Daniel Marashlian. It began as a SOC 2 automation platform, then broadened into SafeBase-led trust centers, risk workflows, and AI-assisted questionnaire handling. Public materials now frame the company as the trust layer between great companies, and third-party estimates put it near $100M revenue / $98M ARR with 8,500+ customers and roughly 732 employees, but the current financing structure and operating margins remain opaque.
- Website
- drata.com
- Founders
- Adam Markowitz, Troy Markowitz, Daniel Marashlian
- Headquarters
- San Diego, CA (legal); San Francisco, CA (primary operations)
- Product
- Drata sells annual SaaS subscriptions for continuous compliance, trust centers, risk management, and AI-assisted security-review workflows.
- Customers
- High-growth SaaS, fintech, and enterprise trust programs
- Business model
- Annual SaaS subscription with framework-based and module-based expansion
- Stage
- Late-stage private (Series C+)
- Funding status
- Raised roughly $328M across disclosed rounds; the latest private financing terms are not public.
Executive summary
Top strengths
- Category leadership with 8,500+ customers and broad integration / partner coverage
- Trust-management expansion beyond the original SOC 2 compliance wedge
- Strong customer-proof and partner-proof ecosystem
- Large enough scale to support a meaningful private franchise
- Durable switching costs once workflows and trust centers are implemented
Top risks
- Financial opacity: no public gross margin, NRR, burn, or runway
- Pricing opacity and competitive pressure from Vanta and other challengers
- Integration and support friction can undermine the trust promise
- Latest private financing terms remain undisclosed
- Valuation reference is stale and may not reflect current market terms
Open gaps
- Current burn rate and runway
- Current gross margin and NRR
- Latest financing amount and preference terms
- Top-customer concentration
- Exact realized pricing by module
- 2026 customer count versus prior 2025 estimates
Contents
01Company Overview
1.1 Identity and Scale
Drata presents itself as the trust layer between great companies and now markets an agentic trust management platform rather than a single-purpose SOC 2 tool. The company says it serves 8,500+ global customers, has 1,300+ alliance partners, and offers 250+ integrations. Public materials also show a shift toward trust centers, AI-assisted questionnaires, and broader GRC workflows, which supports a larger platform story than the original compliance-automation wedge. That broader story matters because it makes Drata look more like a multi-product trust platform than a one-feature compliance utility.[CO001, CO003, CO004, CO005, CO011]
| metric | value/status | date | confidence | gap |
|---|---|---|---|---|
| Founded | 2020 | 2020-11 | high | |
| Last public valuation | $2B | 2022-11 | high | Stale since Series C |
| Customers | 8,500+ | 2026-09 | high | |
| Employees | 732 | 2025-11 | medium | Third-party estimate |
| Total funding | ~$328M | 2026-09 | medium | Latest round terms undisclosed |
Company-level snapshot assembled from official and third-party sources; customer and headcount figures are the latest public estimates rather than audited disclosures.
[CO001, CO004, CO008, CO009, CO010]Chronological view of Drata's founding, financing, customer-scale, and product repositioning milestones.
1.2 Leadership and Financing
The founding team remains central to the company narrative: Adam Markowitz, Troy Markowitz, and Daniel Marashlian are still the names most consistently attached to the company, and Adam Markowitz is the CEO. The financing arc is also clear. Drata completed a Series A, then a Series B that pushed it into unicorn territory, and then a Series C that doubled valuation to $2B. What is not public is the precise structure of the more recent 2025 financing activity. The governance question is therefore not who built the company, but how much economic control the latest private round may have shifted.[CO002, CO006, CO007, CO008, CO009, CO012]
| person | role | background | fit / coverage | key-person dependence |
|---|---|---|---|---|
| Adam Markowitz | CEO & Co-Founder | NASA aerospace engineer; prior Portfolium founder | Founder-CEO continuity and technical credibility | high |
| Troy Markowitz | Co-Founder | Portfolium co-founder | Product and go-to-market continuity | medium |
| Daniel Marashlian | Co-Founder | Portfolium co-founder | Founding product and platform coverage | medium |
Leadership data is a public-signal summary; it does not replace an internal governance review or board roster.
[CO001, CO002]| stakeholder | role | control or economic importance | diligence ask |
|---|---|---|---|
| ICONIQ Growth | lead investor | Repeated top-tier sponsor and signaling backer | What are the current governance rights and follow-on intentions? |
| GGV Capital | lead investor | Series B/C backer with category credibility | Did its support continue into the latest round? |
| Salesforce Ventures | strategic investor | Ecosystem and distribution signal | What partnership rights or commercial ties exist? |
| SVCI / industry angels | strategic individuals | High-visibility network effects | Are any investors also customers or channel partners? |
| Late-stage private market | capital context | Current valuation reference is stale | What were the 2025 round terms and preferences? |
Investor mapping is representative rather than exhaustive; it is intended to surface diligence questions around control, signaling, and preference structure.
[CO001, CO007, CO008, CO009]1.3 Milestones and Open Questions
Drata's visible milestones show a fast transition from launch to category leadership: founder-led launch, rapid fundraising, a scaling customer base, and a product expansion into SafeBase and AI-assisted workflows. The unanswered diligence issue is not whether the company has scaled; it clearly has. The open question is how much of that growth now converts into durable economics, because the company still does not publicly disclose ARR, margin, retention, or the latest financing terms in a way that would support precise underwriting. That matters because the last visible valuation is already old enough to be a reference point rather than a live market mark, and because the customer and partner story is stronger than the operating-data story. The practical diligence ask is therefore simple: confirm whether the 2025 financing changed ownership or economics in a way that the public record cannot show. A refreshed data room would narrow that uncertainty more than any additional public marketing claim.[CO004, CO009, CO010, CO011]
02Market Analysis
2.1 Market Boundary and Substitutes
Drata belongs in the compliance-automation slice of the broader GRC stack, but the practical buying boundary is wider than a software category label. Buyers compare it against manual spreadsheets, auditor-managed process, and adjacent compliance vendors that package trust centers, vendor-risk workflows, and questionnaire automation into the same budget conversation. The sources do not support a single neat spend number, so the right framing is a constrained market definition with adjacent edges rather than a false-precision TAM claim. In practice, the boundary keeps moving outward as customers ask one platform to cover more of the trust workflow.[CM001, CM002, CM010, CM011]
| segment/category | included spend | excluded spend | buyer/payer | relevance |
|---|---|---|---|---|
| Compliance automation | SOC 2 / ISO 27001 / evidence collection / policy management | Generic SIEM, endpoint, IAM, and audit labor | Security/GRC leaders; finance approves | Core spend bucket |
| Vendor-risk / trust management | External trust centers, VRM, AI-assisted evidence | General CRM, ticketing, and generic CMS tools | Security + sales enablement | Adjacent expansion bucket |
| Manual compliance work | Spreadsheet tracking, consultant labor, auditor prep | Software licenses themselves | Operations and security teams | Status-quo substitute |
| Point solutions | Audit evidence collectors / policy managers / QBR tools | Broad GRC suite upgrades that replace the use case | Individual budget holders | Adjacent or partial substitute |
This is a boundary table, not a market-size estimate; it defines what is in and out of scope for Drata's buying motion.
[CM001, CM002, CM010]Constrained view of Drata's market: a core compliance automation wedge that expands into trust management, vendor risk, and broader GRC workflows.
Layer widths indicate hierarchy, not quantitative proportions.
[CM001, CM005, CM006, CM011]2.2 Sizing and Segmentation
The evidence base points to a fast-growing but still opaque market. Sacra's 2025 ARR estimate and Drata's own growth claims imply meaningful scale, while third-party comparison pages show that buyers evaluate tools by company size, framework coverage, and implementation burden. The best-supported segmentation is not by industry alone but by compliance urgency: high-growth SaaS, regulated fintech, and security-conscious scale-ups buy first, then larger enterprises adopt when trust and vendor-risk processes become revenue-critical. That pattern suggests the category is expanding because more teams are treating trust operations as an infrastructure layer rather than an occasional project. The upside is broader budget access; the downside is that each new workflow adds implementation expectations and more implementation lift.[CM003, CM004, CM005, CM012]
| publisher | year | geography | value | CAGR | methodology | confidence | limitation |
|---|---|---|---|---|---|---|---|
| Sacra | 2025 | Global | Drata-specific ARR estimate | n/a | Bottom-up public-source estimate | medium | Private-company estimate |
| Built In | 2026 | Global | Mature-growth framing | n/a | Editorial analysis | medium | Not a formal market size |
| YipitData | 2026 | Global | Competitive category leader vs challenger | n/a | Analyst comparison | medium | Buyer behavior not a TAM model |
| Tech Insider | 2026 | Global | Platform-war framing | n/a | Competitor comparison | medium | Pricing and adoption are qualitative |
Because the chapter does not have a single authoritative market report, this table keeps multiple lenses separate rather than forcing them into one false TAM figure.
[CM003, CM007, CM009]2.3 Drivers and Constraints
Regulatory complexity is the strongest structural driver: SOC 2 and ISO 27001 are baseline expectations, and DORA, GDPR, and AI-governance requirements keep widening the workload. The main constraints are just as clear: price opacity, migration friction, and the need to prove real-time control coverage rather than point-in-time checklists. In practice, that means market growth is less about awareness and more about reducing the buyer's fear of paying for a tool they cannot quickly operationalize. Buyers increasingly want a platform that can absorb adjacent work without forcing a separate trust-program rebuild.[CM006, CM007, CM008, CM009, CM011]
| segment | buyer | user | payer | workflow | budget owner | adoption trigger |
|---|---|---|---|---|---|---|
| High-growth SaaS | CISO / security lead | GRC analysts and founders | Security / IT budget | SOC 2 readiness and evidence collection | Security leader | Enterprise deal requires compliance proof |
| Fintech / regulated software | Security, risk, or compliance lead | Cross-functional team | Security + compliance budget | Framework expansion and continuous monitoring | Security / finance | Regulatory or customer diligence pressure |
| Enterprise trust programs | GRC / trust org | Sales enablement and trust-center teams | Security + sales support budget | External trust center and questionnaire handling | Trust / sales ops | Large customer due diligence becomes a bottleneck |
| Partner / auditor ecosystem | Audit firms / advisors | External reviewers | Partner / services budget | Review workflow and advisory assistance | Channel or services owner | Need to scale client compliance delivery |
Buyer mapping is indicative rather than exhaustive; it is meant to show who feels the pain first and who actually signs the check.
[CM004, CM005, CM010, CM011]03Competitors
3.1 Direct Peer Landscape
The direct set is not a single clean peer group. Vanta is the obvious larger incumbent, while Secureframe, Scrut, and newer AI-first vendors show that the category is still fragmenting. In the buyer's mind, the comparison also includes older GRC and trust-center workflows because many teams evaluate tools by how much manual work they remove rather than by how closely they match a feature checklist. That means the real competition is partly about workflow fit and partly about whether the vendor can make the buying motion feel simple. The simpler the setup, the easier it is for a challenger to steal attention even without a dramatically better feature set.[CP001, CP002, CP003, CP007]
| competitor | category | scale/funding | target segment | differentiation | limitation |
|---|---|---|---|---|---|
| Vanta | incumbent | 16,000+ customers and larger revenue base | Startups through enterprise | Broader enterprise breadth and strong brand | Higher perceived complexity |
| Secureframe | direct peer | Mid-market scale | Compliance-led SaaS and fintech | Strong automation and audit support | Less scale than Vanta |
| Scrut | direct peer | Smaller private company | India / global mid-market | Transparent packaging in some comparisons | Less category mindshare |
| Delve | AI-first challenger | Newer and smaller | Engineering-heavy startups | Agentic AI-led workflow | Early product maturity |
| Manual process | substitute | Zero software revenue | Very small or resource-constrained teams | No software lock-in | High labor cost and error risk |
Scale and funding figures are public estimates and comparison-page claims, not audited company financials.
[CP001, CP002, CP003, CP006, CP007]Drata sits in the high-growth challenger quadrant while Vanta owns the larger incumbent position and newer vendors cluster on price or AI-first simplicity.
| Item | X (1–7) | Y (2–8) | Context |
|---|---|---|---|
| 1. Vanta | 7 | 8 | Larger incumbent with broader enterprise breadth and stronger brand recognition |
| 2. Drata | 6 | 7 | High-growth challenger with strong trust-management positioning |
| 3. Secureframe | 5 | 6 | Strong compliance focus but less category scale |
| 4. Scrut | 4 | 5 | Smaller peer with price and packaging pressure |
| 5. Delve | 3 | 7 | Newer AI-first challenger with smaller scale |
| 6. Manual process | 1 | 2 | Spreadsheet and consultant-led substitute |
3.2 Capability and Pricing
The main competitive axis is not just framework coverage but the combination of integrations, trust-center exposure, pricing transparency, and implementation support. Vanta's public positioning emphasizes breadth and enterprise readiness; Drata's own materials emphasize trust management and SafeBase. Comparison pages repeatedly note that price is still negotiated rather than published, so procurement often becomes a live sales process rather than a simple self-serve decision. In that environment, buyers are effectively paying for reduced operational friction as much as for a feature set. That makes procurement feel closer to an operating decision than a pure software comparison.[CP004, CP005, CP006, CP008]
| buying criterion | Drata | Vanta | Secureframe | Scrut |
|---|---|---|---|---|
| Trust center | SafeBase-led trust center and AI questionnaire assistance | Built-in trust center on higher tiers | Available, but less externally emphasized | Available with transparent packaging |
| Integrations | 250+ integrations | Broad integration base | Broad but smaller public surface | Solid but less documented |
| Pricing transparency | Custom-quoted | Custom-quoted | Custom-quoted | More transparent in comparisons |
| AI workflow | AI-assisted trust and questionnaire workflows | Agentic AI with deeper workflow automation | Basic or emerging AI features | AI-led positioning |
| Enterprise readiness | Growing upmarket | Strongest among the set | Good mid-market readiness | Smaller enterprise proof set |
This matrix reflects public messaging and comparison pages; unsupported cells are intentionally summarized as "smaller" or "less documented" rather than guessed.
[CP004, CP005, CP006, CP007, CP008]3.3 Switching and Moat
The moat question is mostly about switching cost and ecosystem depth, not pure feature novelty. Once a company has populated evidence workflows, auditor touchpoints, trust-center pages, and partner integrations, it has real friction to change vendors. That helps Drata, but it also means competitors can win by making the first implementation easier or the public trust surface cheaper. The result is a category with meaningful lock-in but still active commoditization pressure. In practice, the moat is strongest when the customer treats Drata as operating infrastructure rather than a one-time compliance purchase. If Drata keeps reducing manual steps inside that operating layer, the moat strengthens even when rival feature lists look similar. If it does not, price and simplicity pressure will keep the category fluid.[CP009, CP010, CP011, CP012]
| vendor | price/unit/contract model | included capabilities | discount or unknowns | implication |
|---|---|---|---|---|
| Drata | Custom quote by company size and framework scope | Automation, trust center, risk workflows | Exact discounts and renewal terms not public | Sales-led buying motion |
| Vanta | Custom quote with tiering | Broader enterprise breadth and auditor workflow | Exact deal price not public | Competitive benchmark rather than clear winner |
| Scrut | Some public comparison pages cite transparent tiers | Compliance and trust basics | Exact enterprise discounts still unclear | Lower perceived procurement friction |
| Manual process | Labor-only | Spreadsheets and consultant time | Hidden labor cost | Looks cheap until audit or sales pressure hits |
Pricing data is intentionally high-level because most vendors in this category quote by deal and change packaging often.
[CP005, CP008, CP009]04Financials
4.1 Revenue Model
Drata's revenue model is straightforward at a high level: annual SaaS subscriptions sold by company size and framework scope, with add-on value from Trust Center and risk-related modules. Public third-party estimates suggest that pricing rises as customers add frameworks, integrations, and trust-center functionality. The result is a classic subscription business, but one where actual realized price, discounting, and renewal uplift are still not public. That leaves the commercial story believable, but not yet precise enough to model revenue quality from first principles. Put differently, the company looks monetized enough to scale, but not transparent enough to price with confidence.[CI001, CI002, CI003, CI004]
| stream | mechanism | unit | current value/status | quality | diligence ask |
|---|---|---|---|---|---|
| Annual subscriptions | Core software access by company size and framework scope | annual contract | Primary revenue stream | High | What is the realized ASP by segment? |
| Trust Center / SafeBase | Add-on external trust workflow and customer assurance layer | module add-on | Higher-value expansion module | Medium | How much of bookings comes from this module? |
| Risk management / VRM | Expanded workflow for risk and vendor management | module add-on | Growing but not quantified | Medium | Is this bundled or separately priced? |
| Services / implementation | Onboarding and support may be bundled in some deals | project / services | Not publicly disclosed | Low | How material is services revenue? |
Revenue mix is inferred from public positioning and comparison pages; the table does not imply GAAP segment reporting.
[CI001, CI002, CI004, CI009]| price/unit/contract | list vs realized pricing | discounts/unknowns | source |
|---|---|---|---|
| Custom quote by company size | No public list price | Exact discounting not public | Drata and comparison pages |
| Framework-based pricing | No public list price | Price scales with scope | Sacra / comparison pages |
| Trust Center add-on | Often bundled at higher tiers | Incremental pricing not public | Comparisons and customer stories |
| AI / questionnaire workflow | Packaging still changing | Renewal uplift unknown | Official product marketing |
This table is intentionally coarse because the vendors in this category do not publish durable list pricing.
[CI001, CI002, CI004, CI009]Drata monetizes annual subscriptions that expand via frameworks and add-on modules, but the exact realized price and margin bridge remain hidden.
| Node / Connection | Node / from | To | Context |
|---|---|---|---|
| Node 1 | Leads / pipeline [leads] | Enterprise-trust need or compliance deadline creates demand | |
| Node 2 | Base subscription [base] | Annual SaaS contract keyed to company size and framework scope | |
| Node 3 | Add-on modules [addons] | Trust Center, SafeBase, risk, and questionnaire workflows | |
| Node 4 | Implementation / support [services] | Onboarding and customer-success effort may be bundled | |
| Node 5 | Recognized revenue [revenue] | Revenue growth is visible, but margin and burn are not public | |
| Node 6 | Missing operating data [unknowns] | Gross margin, NRR, burn, and exact pricing remain undisclosed |
4.2 Economics and Efficiency
The available evidence points to healthy top-line scale, but it does not provide enough detail to calculate a real customer-acquisition or margin model. GetLatka and Sacra together imply a 2025 revenue base close to or above $100M, while the absence of gross-margin, NRR, and burn disclosures prevents a full unit-economics view. In other words, the business may be large, but the investment case still lacks the operating data needed to judge efficiency precisely. That makes this a scale story with incomplete operating proof rather than a fully underwritten financial profile.[CI005, CI006, CI007, CI011]
| metric | value/null | confidence | why it matters | diligence ask |
|---|---|---|---|---|
| ARR | ≈$98M (2025 estimate) | medium | Sets the scale of the revenue base | Confirm actual 2026 run-rate |
| Revenue | $100M (2025 estimate) | medium | Indicates monetization scale | Request revenue bridge |
| Gross margin | low | Needed for valuation and operating leverage | Request margin schedule | |
| NRR | low | Needed for retention and expansion quality | Request cohort retention | |
| Burn / runway | low | Needed for financing dependency assessment | Request cash-flow summary |
Null cells mean the reviewed public corpus did not support a reliable number.
[CI005, CI006, CI007, CI011, CI012]4.3 Capital and Blockers
Drata has raised enough capital to support multi-year scaling, yet the last fully public valuation reference is still $2B from 2022. The company therefore looks well-capitalized but not fully transparent. The main blocker is not cash survival; it is the absence of public information on current ARR, gross margin, burn, and the terms of the latest private financing, all of which matter more for valuation than the historical round history itself. Until those gaps close, any price judgment is necessarily a range rather than a point estimate, and the market signal is more about history than current marks. In other words, the balance sheet looks supportive, but the public diligence package still trails the business itself. That is enough to keep the company interesting, but not enough to make the valuation easy.[CI008, CI009, CI010, CI012]
05Product & Technology
5.1 Product Surface
Drata is no longer just a SOC 2 checklist product. The public surface now includes continuous compliance, Trust Center, risk management, AI-assisted questionnaire work, and partner-driven device or identity integrations. The product story is therefore broader and more enterprise-like, but it still depends on customers wiring the platform into their stack before the automation becomes valuable. That dependency is a feature and a risk at the same time: once embedded, the product can be sticky, but implementation expectations rise with every added module. That also helps explain why the public story keeps emphasizing trust outcomes rather than raw feature counts.[CE001, CE002, CE003, CE004]
| module/asset | user | status/maturity | differentiation | diligence gap |
|---|---|---|---|---|
| Continuous compliance | Security and GRC teams | Mature | Core workflow automation | What is the actual control coverage? |
| Trust Center / SafeBase | Sales, security, and prospects | Mature | Customer-facing trust surface | How much is bundled vs add-on? |
| Risk management / VRM | GRC and vendor-risk teams | Growing | Broader trust-management scope | What share of usage is this? |
| AI questionnaire workflow | Security and sales ops | Emerging | Faster review handling | How accurate is the AI in practice? |
Maturity is a judgment based on public product messaging and customer stories, not a formal product roadmap statement.
[CE001, CE002, CE009, CE010]| user job | current workflow | company solution | measurable benefit | limitation |
|---|---|---|---|---|
| SOC 2 prep | Spreadsheets and manual evidence collection | Continuous compliance automation | Less manual work and faster audits | Still requires customer setup |
| Trust sharing | Emailing PDFs and questionnaires | Trust Center and SafeBase | Faster customer diligence | Depends on customer-maintained content |
| Vendor risk | Email and ticket-based review | VRM workflow | Centralized review handling | Coverage varies by module |
| Device trust | Point-in-time checks | 1Password / device integrations | More continuous evidence | Integration depth varies |
This table emphasizes the work Drata removes, but not every benefit is quantified in public sources.
[CE003, CE005, CE006, CE007]5.2 Architecture and Dependencies
The technology model is best thought of as a workflow layer above customer systems rather than a deep infrastructure platform. That makes integrations, evidence connectors, and alerting the core value path. Official docs and partner pages show the product sitting across security, device trust, vendor-risk, and support workflows, which makes implementation depth a key part of the product moat. It also means reliability is less about internal infrastructure claims and more about whether the surrounding integrations keep working as the customer's stack changes. In other words, the architecture is intentionally thin where the customer already has systems of record and thick where workflow coordination creates value.[CE005, CE006, CE007, CE008]
| layer/process/component | role | dependency | risk |
|---|---|---|---|
| Integrations layer | Connects customer systems and gathers evidence | API and connector maintenance | Breakage when upstream systems change |
| Workflow layer | Routes controls, tasks, and questionnaires | Correct configuration | Low adoption if setup is heavy |
| Trust center layer | Publishes security posture externally | Customer-owned content | Stale or incomplete trust pages |
| AI layer | Summarizes or drafts responses | Model quality and prompt hygiene | Hallucination or summary-only output |
The architecture is inferred from official documentation and partner pages; it is meant to show dependencies, not reverse-engineer internals.
[CE005, CE006, CE007, CE008, CE009]5.3 Trust, Safety, and Roadmap
Trust, safety, and compliance are central rather than peripheral. Drata's messaging repeatedly emphasizes continuous assurance, customer-facing trust surfaces, and AI-assisted questionnaire handling, while customer stories show value only once the platform is wired into actual audit and sales workflows. That means roadmap claims matter, but they are less important than evidence that the current stack works reliably in production. A credible roadmap here is mostly about reducing friction, improving connector depth, and making the trust layer feel operational rather than aspirational. The most meaningful future claims will be the ones that reduce human handoffs rather than just add new labels.[CE009, CE010, CE011, CE012]
Drata's stack layers trust management, workflow automation, and external assurance on top of a broad integration surface.
- Experience layer
- Trust Center, questionnaires, customer-facing proof
- Modules
- Trust Center
- SafeBase
- questionnaires
- Outputs
- external trust pages
- faster diligence
- Workflow layer
- Continuous compliance, controls, tasks, and remediation
- Modules
- controls
- tasks
- remediation
- Outputs
- audit readiness
- control tracking
- Risk layer
- Vendor risk and risk treatment workflows
- Modules
- VRM
- risk management
- Outputs
- risk register
- mitigation tracking
- Integration layer
- Connectors to identity, device, cloud, and business systems
- Modules
- 1Password
- Datadog
- cloud apps
- Outputs
- evidence
- alerts
- posture signals
- AI layer
- Questionnaire assistance and summarization
- Modules
- AI assistant
- drafting
- summarization
- Outputs
- draft responses
- faster review
- Dependency layer
- Customer setup, model quality, and upstream API stability
- Modules
- configuration
- APIs
- model quality
- Outputs
- operational risk
06Customers
6.1 Customer Mix
Drata's customer base is clearly broader than a single vertical. Public materials point to startups, fintechs, and enterprise trust teams, with named logos and partner stories spanning infrastructure, finance, and SaaS. The company also uses customer count and partner count as a central marketing signal, which is a sign that adoption itself is part of the product moat. The breadth matters because it suggests the product is being sold as a trust layer that can travel across segments rather than a one-off tool for a narrow compliance niche. A wide customer mix also makes it harder for any single vertical slowdown to define the whole story. It also hints that the product may be useful in more than one buying motion.[CU001, CU002, CU007, CU009]
| segment | buyer/user/payer | use case | scale | revenue / strategic value | gap |
|---|---|---|---|---|---|
| High-growth SaaS | Security and GRC leaders | SOC 2 readiness and customer diligence | Large and growing | Revenue-enabling | Exact segment share not public |
| Fintech / regulated software | Security + compliance teams | Continuous monitoring and framework expansion | Large and sticky | High ACV potential | Exact concentration not public |
| Enterprise trust programs | Trust / sales ops | Trust Center and questionnaire handling | Upsell / expansion | Strategic value | NRR not public |
| Partner ecosystem | Audit firms / advisors | Assisted compliance delivery | Channel value | Partner-led growth | Partner dependence not public |
Segmentation is inferred from customer stories, partner pages, and marketing materials rather than a disclosed customer list.
[CU001, CU002, CU003, CU006]Drata's customer path moves from compliance urgency to trust-center expansion and then to partner-enabled and AI-assisted workflows.
[CU001, CU003, CU004, CU005, CU006, CU008]6.2 Proof and Expansion
The strongest public proof comes from named customer stories and partner POVs. Brex, Clari, and the ecosystems case study all point to the same pattern: Drata is used when a team wants faster security reviews, better trust surfaces, and more predictable compliance work. That is good evidence of real usage, but it still does not tell us how sticky the contracts are after implementation. The stories do show the product moving beyond compliance checklists into commercial and operational workflows. It also means the strongest proof points are qualitative rather than cohort-based. That is helpful for narrative support, but not enough to quantify stickiness.[CU003, CU004, CU005, CU006]
| customer | segment | deployment/use case | production vs pilot | outcome | limitation |
|---|---|---|---|---|---|
| Brex | fintech | Trust Center and continuous GRC | production | Faster security reviews and stronger customer trust | Case study is company-authored |
| Clari | SaaS | Forecasting and revenue operations support | production | Better forecast discipline and account visibility | Pre-merger story |
| Ecosystems case study | SaaS | Value-selling and win-rate acceleration | production | Higher win rates and business value selling | Partner-authored |
| 1Password partnership | identity / security | Device trust and continuous compliance | production | Simpler device evidence and access assurance | Partner POV rather than a neutral review |
These are named proof points, not a complete customer list.
[CU003, CU004, CU005, CU006]6.3 Concentration and Gaps
The key unanswered questions are retention and concentration. Drata does not publicly disclose NRR, GRR, churn, or top-customer concentration, so the customer story is still incomplete. The business looks like it can expand inside accounts, but the evidence base remains better at showing breadth than durability. That gap matters because the renewal quality behind the customer list is what determines whether broad adoption turns into long-lived revenue. Until that math appears, concentration remains a material blind spot rather than a solved question. Public logos are useful, but they are only the start of the diligence story.[CU008, CU010, CU011, CU012]
| metric | value | date | source | confidence | implication | missing denominator |
|---|---|---|---|---|---|---|
| Customers | 8,500+ | 2026-09 | Drata marketing | high | Adoption is broad enough to support category leadership | Net new / paying vs trial unknown |
| Customers | 7,000+ | 2025 | Sacra | medium | Earlier growth base was already large | Exact count differs by source |
| International share | 25-30% | 2025 | Sacra | medium | Demand is not US-only | Exact country mix not public |
| Employee support / success | Not public | No source | low | Retention quality cannot be quantified | NRR / GRR missing |
This trajectory table intentionally mixes hard and soft evidence so the reader can see which adoption numbers are current and which are estimates.
[CU001, CU002, CU008, CU012]07Risks
7.1 Legal and Operational Risk
Drata does not appear to face a single headline legal or regulatory crisis in the reviewed corpus, but the operational risk profile is still meaningful. The product relies on many customer integrations, external systems, and workflow setup, so any breakage can interrupt the promise of continuous assurance. Review pages and help articles also show that customers notice navigation friction, reporting issues, and support responsiveness, which matters because trust software has to work cleanly to remain believable. The risk is cumulative: small issues in setup, support, or data freshness can erode the trust story even without a major outage. Small frictions here matter because trust software is judged by the absence of surprises.[CR001, CR002, CR003, CR004]
| rule/license/case | jurisdiction | status | likelihood | severity | mitigation | residual exposure | diligence path |
|---|---|---|---|---|---|---|---|
| Privacy / data handling | Multi-jurisdiction | General vendor obligations | medium | medium | Standard controls and customer contracts | Residual contractual and privacy risk | Review DPA and security docs |
| Framework claims | Global | Marketing claims are broad | medium | medium | Keep claims aligned to docs and stories | Potential customer misalignment | Check product-claim substantiation |
| AI governance | Global | Emerging | medium | medium | Use human review and workflow controls | Model output risk | Request AI governance controls |
No material legal case or enforcement action was found in the reviewed corpus; this table focuses on forward-looking risk modes rather than current litigation.
[CR001, CR004, CR009]| failure mode | likelihood | severity | mitigation maturity | residual exposure | unresolved gap |
|---|---|---|---|---|---|
| Integration breakage | high | high | medium | Continuous evidence interruption | Connector maintenance cadence not public |
| Support friction | medium | medium | medium | Adoption drag and trust erosion | SLA quality not public |
| Reporting / navigation friction | medium | medium | medium | User confusion during audits | Workflow UX still imperfect |
| AI summary error | medium | medium | low | Wrong or incomplete compliance guidance | AI governance not fully public |
Severity ordering reflects the author judgement from public reviews and support articles rather than a disclosed incident log.
[CR002, CR003, CR004, CR009]7.2 Market and Dependency Risk
The most important non-operational risk is competitive pressure. Vanta remains the larger incumbent, and comparison pages consistently frame Drata as the challenger. That creates pressure on pricing, feature breadth, and buyer perception. At the same time, Drata's own product depends on cloud, identity, and device-trust systems that it does not control, so external vendor outages or API changes can become internal product problems. In practice, the market risk and the dependency risk reinforce each other because both can force Drata to spend more just to keep the experience simple. The more the platform scales, the more any dependency mistake becomes a product problem rather than a background detail.[CR005, CR006, CR007, CR008]
| dependency | counterparty | role | concentration | failure scenario | severity | mitigation | residual exposure |
|---|---|---|---|---|---|---|---|
| Cloud / monitoring APIs | AWS / Datadog / other stack owners | Evidence and alerting inputs | high | Upstream changes break connectors | high | Maintain connectors and fallbacks | Residual integration risk |
| Identity / device systems | 1Password and similar tools | Device-trust signals | medium | Device evidence becomes stale | medium | Deepen partner integrations | Moderate workflow dependence |
| Competitor pricing pressure | Vanta / Scrut / Secureframe | Market benchmark | high | Buyer chooses cheaper or simpler alternative | high | Differentiate on trust center and automation depth | Ongoing churn pressure |
Dependency rows are ordered by practical severity, not by counterparty prestige.
[CR005, CR006, CR007, CR008]7.3 Mitigations and Thesis Breaks
The mitigants are straightforward but not trivial: deepen integrations, keep the trust center current, improve support response, and prove that the AI layer does not just summarize issues but actually reduces work. The thesis breaks if the product becomes too expensive to implement, too opaque to price, or too easy for competitors to undercut with a simpler buyer experience. In that sense, the risk profile is less about existential failure and more about gradual erosion of category leadership. A stronger answer would pair product reliability with clearer pricing discipline and visible customer outcomes. In short, the company has to keep making the hard thing feel simpler than the alternatives.[CR009, CR010, CR011, CR012]
Drata's riskiest areas cluster around integration dependence, pricing opacity, and competitive pressure rather than any single legal case.
[CR001, CR002, CR005, CR006, CR007, CR009, CR010, CR011]08Valuation
8.1 Thesis and Antithesis
The bullish case is clear: Drata has scaled to a large customer base, broadened the product into trust management, and appears to have material revenue. The bearish case is equally clear: the company does not publicly disclose the operating metrics needed to judge efficiency, and the last fully public valuation reference is now stale. That means the valuation question is less about whether the company matters and more about whether the current price is still justified without a current data room. In other words, the business looks durable enough to merit attention, but not transparent enough to justify a sharp conviction without more disclosure. The gap between scale and disclosure is the whole investment problem here.[CV001, CV002, CV003, CV008]
| recommendation | confidence | risk rating | valuation stance | decision implication |
|---|---|---|---|---|
| research-more | medium | medium | unknown | Hold until a data room clarifies unit economics |
| buy | low | high | fair | Would require better public margin and retention proof |
| avoid | low | critical | expensive | Would fit only if price rose without new proof |
This summary is deliberately conservative because the public corpus does not support a precise discounted-cash-flow style answer.
[CV001, CV008, CV009, CV012]| argument | what would change the view |
|---|---|
| Trust-management expansion broadens the TAM | If AI and trust-center modules are weak in production |
| Large customer scale supports category leadership | If customer count is mostly logo inflation or free-tier noise |
| Revenue appears large enough for a meaningful private franchise | If actual ARR or margin is much lower than estimates |
| The valuation is stale but not obviously broken | If the latest financing terms are punitive or highly dilutive |
The table keeps the thesis tied to evidence rather than to a static valuation multiple.
[CV001, CV002, CV003, CV004]8.2 Comparables and Context
The best comparable frame is not a clean public SaaS peer but a mix of private market estimates, competitor scale, and valuation history. Sources in the corpus point to Drata as a high-growth challenger that has raised roughly $328M, reached $100M revenue in 2025, and then stopped updating the public market on margins and current valuation. That combination makes the last visible price look more like a reference point than a live market signal. Public comparables are therefore useful for context, but they do not collapse the uncertainty around the current private mark. The extra public signals mostly refine the range; they do not eliminate it.[CV004, CV005, CV006, CV007]
| scenario | assumptions | valuation / return logic | key risks | probability signal |
|---|---|---|---|---|
| Bull | Trust-management expansion lands; growth stays strong | A premium private valuation remains plausible | Competition and disclosure risk | Medium |
| Base | Large but opaque private SaaS business | Hold / follow rather than add | Metrics remain underdisclosed | High |
| Bear | Pricing and implementation pressure slow growth | Downward re-rating or flat private marks | Category commoditization | Medium |
Scenario ranges are qualitative because the public corpus does not support an exact current multiple.
[CV001, CV004, CV005, CV006, CV008, CV011]8.3 Scenarios and Decision
A reasonable base case is that Drata remains a valuable private platform with upside from trust-management expansion and international growth. A bear case is that pricing and implementation pressure compress growth and the company never fully closes the gap between usage scale and disclosed economics. On the evidence available here, that makes the correct stance research-more: the business is interesting enough to follow, but not transparent enough to underwrite cleanly. The valuation posture is therefore a disciplined wait, not a negative verdict. That is the right call until the next financing or a fuller data room changes the picture.[CV009, CV010, CV011, CV012]
Drata's scale and product expansion support a positive long-term view, but lack of current financial disclosure keeps the decision below a true buy.
| Node / Connection | Node / from | To | Context |
|---|---|---|---|
| Node 1 | Scale signal [scale] | Large customer count and broad partner footprint | |
| Node 2 | Product expansion [product] | Trust management, SafeBase, and AI-assisted workflows | |
| Node 3 | Revenue signal [revenue] | Third-party estimates around $100M revenue / $98M ARR | |
| Node 4 | Valuation anchor [valuation] | $2B public valuation reference from 2022 | |
| Node 5 | Opacity penalty [opacity] | No public gross margin, NRR, or burn data | |
| Node 6 | Decision [decision] | Research-more until a data room narrows the range |
Disclaimer
This report is an automated public-source diligence summary and is not financial advice.
Evidence index
| ID | Statement | Confidence | Sources |
|---|---|---|---|
| CO001 | Drata was founded in 2020 and is based in San Diego, with San Francisco functioning as a major operating hub. | Medium | SO001, SO006 |
| CO002 | Adam Markowitz, Troy Markowitz, and Daniel Marashlian are the co-founders most consistently named in the public record, and Adam Markowitz is the CEO. | Medium | SO001, SO002 |
| CO003 | Drata describes itself as the trust layer between great companies and as an agentic trust management platform. | Medium | SO001, SO002 |
| CO004 | Drata says it serves 8,500+ global customers in recent public materials. | Medium | SO002 |
| CO005 | Drata says it has 1,300+ alliance partners and 250+ integrations. | Medium | SO001, SO002 |
| CO006 | Drata raised $25M in a Series A round in 2021 to expand the security compliance platform. | Medium | SO003 |
| CO007 | Drata raised $100M in a 2021 Series B that pushed the company to unicorn status. | Medium | SO004 |
| CO008 | Drata raised $200M in a 2022 Series C that doubled valuation to $2B. | Medium | SO005 |
| CO009 | Tracxn and Sacra both place Drata's total funding around $328M, although the latest private round structure is not fully disclosed. | Medium | SO007, SO008 |
| CO010 | GetLatka estimates Drata's 2025 employee count at 732. | Medium | SO006 |
| CO011 | Recent company marketing emphasizes broader trust-management products, including SafeBase and AI-assisted questionnaire workflows, rather than only SOC 2 automation. | High | SO002, SO001 |
| CO012 | Tech Insider's 2026 comparison frames Drata as a challenger under competitive and pricing pressure rather than an unassailable enterprise default. | Medium | SO009 |
| CM001 | The relevant market is best framed as compliance automation plus adjacent trust-management and GRC workflows, not generic cybersecurity software. | Medium | SM002, SM003, SM005 |
| CM002 | Manual spreadsheet-based compliance is still a common substitute, which keeps the practical market boundary broader than just software licenses. | Medium | SM004, SM006 |
| CM003 | Sacra estimates Drata reached about $98M in ARR in early 2025 and about 7,000 customers before later customer-scale claims moved higher. | Medium | SM002 |
| CM004 | Drata's public growth narrative emphasizes 60-country reach, 100% YoY EMEA growth, and roughly one-third international penetration. | Medium | SM005, SM002 |
| CM005 | The most visible buyer trigger is the need to win enterprise deals without building a compliance team from scratch. | Medium | SM003, SM004, SM006 |
| CM006 | Regulatory complexity from SOC 2, ISO 27001, GDPR, DORA, ISO 42001, and AI-governance concerns keeps the market in expansion mode. | High | SM005, SM003 |
| CM007 | YipitData and Tech Insider both portray Vanta as the larger incumbent while Drata remains the challenger with meaningful growth momentum. | Medium | SM003, SM004 |
| CM008 | Some lower-tier comparison sites sell the category as faster and cheaper alternatives, which indicates price sensitivity remains a real adoption constraint. | Medium | SM006, SM008 |
| CM009 | Built In's stability-and-growth framing suggests the market now treats Drata as a mature vendor rather than an experimental startup. | Medium | SM001 |
| CM010 | RFP Wiki and GetAgency both show that buyer evaluation now includes implementation effort, pricing transparency, and framework coverage. | Medium | SM006, SM007 |
| CM011 | The market is still constrained by trust and proof requirements, so buyers demand evidence of uptime, support, and review outcomes before switching. | Medium | SM003, SM004, SM008 |
| CM012 | Drata's public momentum around international expansion and new trust-management products supports a broader TAM than the original SOC 2 workflow. | High | SM005, SM002 |
| CP001 | Vanta is the clearest larger incumbent in the category, with public positioning that emphasizes enterprise breadth and a larger customer base. | High | SP001, SP003 |
| CP002 | Drata's public messaging now centers on trust management, SafeBase, and AI-assisted workflows rather than a narrow SOC 2-only feature set. | High | SP002, SP004 |
| CP003 | Secureframe remains a direct peer, but comparison pages place it below Vanta and near Drata in the buyer's shortlist. | Medium | SP003, SP006 |
| CP004 | Drata's integration footprint and SafeBase trust-center positioning are core competitive differentiators in public materials. | High | SP004, SP009 |
| CP005 | Pricing remains quote-based across the leading vendors, so procurement often compares a negotiated contract rather than a public list price. | Medium | SP005, SP006, SP007 |
| CP006 | Lower-tier comparison pages consistently use transparency and ease of onboarding as their strongest sales angle against Drata. | Medium | SP006, SP007 |
| CP007 | Review pages still surface workflow friction and reporting limitations even when customers rate the product favorably. | Medium | SP008 |
| CP008 | Drata's own homepage continues to emphasize broad trust and compliance automation, which makes it a closer competitor to multi-product GRC vendors than to point tools. | High | SP009, SP002 |
| CP009 | Once a customer has populated evidence workflows, auditor touchpoints, trust-center pages, and partner integrations, switching costs become real. | Medium | SP002, SP004, SP008 |
| CP010 | The same switching cost also creates commoditization pressure because vendors can win by lowering implementation effort rather than by expanding a feature checklist. | Medium | SP003, SP006, SP007 |
| CP011 | The buyer shortlist increasingly mixes compliance automation with trust-center and AI-questionnaire products, not just classical GRC software. | Medium | SP002, SP004, SP009 |
| CP012 | Drata still has room to win upmarket because the largest competitors are not offering a zero-friction answer to enterprise trust workflows either. | Medium | SP001, SP003, SP005 |
| CI001 | Drata sells annual SaaS subscriptions keyed to company size and framework scope, with add-on value from trust-center and risk modules. | Medium | SI001, SI004, SI011 |
| CI002 | Public comparison pages repeatedly say Drata does not publish official plan prices, so buyers still need a sales call to get real numbers. | Medium | SI003, SI007 |
| CI003 | Sacra and comparison pages imply that Trust Center and risk modules sit above or outside the base package and therefore expand contract value. | Medium | SI001, SI003, SI004 |
| CI004 | Drata's growth narrative emphasizes customer expansion, integrations, and AI-assisted workflows as commercial drivers rather than one-off services. | Medium | SI004, SI011, SI012 |
| CI005 | Sacra estimates Drata's ARR at roughly $98M in early 2025. | Medium | SI001 |
| CI006 | GetLatka estimates Drata's 2025 revenue at about $100M. | Medium | SI002 |
| CI007 | Tracxn and Upmarket both indicate that the company has raised roughly $328M and remains in a late-stage private posture. | Medium | SI005, SI006 |
| CI008 | Drata's last fully public valuation reference is still the $2B Series C outcome from 2022. | Medium | SI008, SI009 |
| CI009 | No reviewed public source provides gross margin, NRR, burn, or runway, which blocks an investor-grade operating model. | Low | |
| CI010 | The public evidence is insufficient to confirm a precise current cash runway or burn rate. | Low | |
| CI011 | The company appears large enough to support multiple product modules, but the exact revenue mix across base subscription and add-ons remains undisclosed. | Medium | SI001, SI003, SI004 |
| CI012 | The capital structure is likely mature, but the latest private financing terms are still not publicly detailed. | Medium | SI005, SI006, SI008 |
| CE001 | Drata's current product surface includes continuous compliance, Trust Center, risk management, and AI-assisted questionnaire workflows. | High | SE001, SE002, SE007 |
| CE002 | The company now describes itself as an agentic trust management platform rather than only a SOC 2 tool. | High | SE001, SE002 |
| CE003 | Customer workflow only becomes meaningful once Drata is wired into audit, identity, and trust-sharing processes. | Medium | SE003, SE005, SE006 |
| CE004 | The platform's public value proposition is to reduce manual compliance work and accelerate customer diligence. | High | SE001, SE003, SE005 |
| CE005 | Official docs and partner pages show the product relying on integrations with identity, device, cloud, and business systems. | High | SE005, SE006, SE007 |
| CE006 | Datadog and 1Password integrations indicate that the product sits above operational monitoring and device-trust signals rather than replacing them. | Medium | SE005, SE006 |
| CE007 | The risk and policy guidance pages show that configuration and workflow setup are part of the product experience, not a hidden backend detail. | High | SE003, SE004 |
| CE008 | The architecture is best understood as a workflow layer that depends on customer systems, connectors, and model quality. | Medium | SE005, SE006, SE008 |
| CE009 | AI support appears to be strongest for summarization and drafting rather than a fully autonomous compliance brain. | Medium | SE002, SE008, SE009 |
| CE010 | Trust, privacy, and compliance controls remain prominent in the product narrative and customer stories. | High | SE001, SE002, SE003 |
| CE011 | The public corpus does not independently verify every roadmap claim, especially around AI depth and future automation scope. | Low | |
| CE012 | The product is already being used in partner and customer workflows, which makes the platform more than a marketing site. | High | SE003, SE005, SE006 |
| CU001 | Drata's customer base is visibly broad, spanning startups, fintech, and enterprise trust teams. | High | SU001, SU002, SU009 |
| CU002 | The company publicly markets 8,500+ customers today, while earlier third-party estimates placed it closer to 7,000 in 2025. | Medium | SU002, SU007 |
| CU003 | Brex's case study shows Drata being used in production to accelerate trust-center workflows and customer security review turnaround. | Medium | SU003 |
| CU004 | Clari's story shows Drata supporting forecasting and customer-success workflows rather than only back-office compliance. | Medium | SU004 |
| CU005 | The Ecosystems case study indicates Drata has been used to improve value selling and win rates, which implies commercial rather than just technical value. | Medium | SU005 |
| CU006 | The 1Password partner POV shows Drata participating in device-trust and access-assurance workflows. | Medium | SU006, SU007 |
| CU007 | Drata's public materials name recognizable customers and partners, which supports a real adoption story rather than a pilot-only narrative. | High | SU001, SU002, SU009 |
| CU008 | The public corpus still does not disclose NRR, GRR, churn, or top-customer concentration. | Low | |
| CU009 | Drata's customer stories imply land-and-expand behavior, but the expansion rate is not quantified. | Medium | SU003, SU004, SU005, SU006 |
| CU010 | The presence of partner and ecosystem stories suggests channel leverage, but no public source gives a partner-led revenue share. | Medium | SU005, SU006, SU007 |
| CU011 | Drata's customer proof is stronger on adoption than on quantified retention. | Medium | SU003, SU004, SU005, SU006 |
| CU012 | The customer narrative remains broad enough to support upmarket expansion but still underdiscloses concentration risk. | Medium | SU001, SU002, SU003, SU008 |
| CR001 | There is no headline legal or regulatory case in the reviewed corpus, but privacy and data-handling obligations still apply across jurisdictions. | Medium | SR001, SR004, SR005 |
| CR002 | Review pages and help articles surface navigation friction, initial learning curves, and support responsiveness as recurring operational themes. | Medium | SR002, SR003, SR004 |
| CR003 | Drata's workflow depends on integrations and agents, so any upstream connector problem can interrupt the continuous-assurance promise. | High | SR004, SR005 |
| CR004 | AI-assisted summarization creates a residual risk of wrong or incomplete guidance if human review is weak. | Medium | SR006, SR009 |
| CR005 | Vanta remains the larger incumbent and therefore the clearest competitive threat. | High | SR006, SR008 |
| CR006 | Comparison pages make pricing opacity a real buyer objection because most contracts are negotiated rather than public. | Medium | SR006, SR007, SR008 |
| CR007 | The product relies on customer setup, so implementation friction can undermine the value proposition even when the software is good. | Medium | SR002, SR003, SR004, SR009 |
| CR008 | Support quality remains an important risk because public reviews mention helpful support but also note workflow friction. | Medium | SR002, SR003 |
| CR009 | The company can still point to growth, customer proof, and product expansion, so the risk is erosion rather than immediate failure. | Medium | SR009, SR001 |
| CR010 | Drata's public help docs imply a mitigation path centered on documentation, setup guidance, and workflow support. | High | SR001, SR004 |
| CR011 | A simpler competitor experience could win buyers who value lower implementation effort more than deeper trust-management depth. | Medium | SR006, SR007, SR008 |
| CR012 | The public corpus does not reveal a stable SLA quality picture, so support performance remains a diligence item rather than a solved question. | Low | |
| CV001 | Drata still looks like a category leader with a large customer base and a broad trust-management platform. | Medium | SV001, SV009 |
| CV002 | The public valuation anchor remains the $2B Series C reference from 2022. | Medium | SV004, SV005 |
| CV003 | Third-party sources place Drata's revenue or ARR in the rough $98M to $100M range for 2025. | Medium | SV001, SV002 |
| CV004 | Drata has raised roughly $328M in total private capital according to public market databases. | Medium | SV002, SV003 |
| CV005 | The company still does not publicly disclose gross margin, NRR, burn, or runway. | Low | |
| CV006 | Drata's growth case depends on trust-management expansion, not just the legacy SOC 2 workflow. | Medium | SV009, SV001 |
| CV007 | Vanta remains the strongest competitive benchmark, which keeps Drata in the challenger slot. | Medium | SV008 |
| CV008 | Public comparison pages and analyst profiles imply the current valuation is a reference point rather than a live market mark. | Medium | SV004, SV006, SV007, SV010, SV012, SV013 |
| CV009 | The company has enough scale to support a premium private-market narrative, but not enough transparency for a clean buy call. | Medium | SV001, SV003, SV009 |
| CV010 | A bear case exists if pricing and implementation pressure compress growth or prevent efficient enterprise expansion. | Medium | SV008, SV007 |
| CV011 | A base case is that Drata remains a valuable private franchise with continuing growth but limited public proof. | Medium | SV001, SV002, SV003 |
| CV012 | The right diligence posture is to track the company until a data room closes the margin and retention gaps. | Medium | SV005, SV009 |