Drata Security & Compliance Automation Platform

What do you like best about the product?

If you spend 6 years in the console you might be able to pass an audit. I joke, but you really have to set everything up perfectly the first time and never touch it to pass an audit.

What do you dislike about the product?

Everything. If you leave it open in a tab you can get soft locked on auth. Throughout all of this they relied on me for testing, acting like when I could accidentally do this that closing the browser and re-opening a connection was a good fix like they don't have auth problems. I started with Drata in May, met my rep, and promptly got a new one. He didn't listen to me literally at all, and I had to escalate on time, investigation status, and more. He was replaced with another group that have kinda lasted, but I learned this morning have been replaced. Now all my answers are by committee - that's right, your Compliance posture and intimate details are shared across every tech support user in the group. Like, the final report is supposed to require an NDA, do I have an NDA with anyone on this Scout team?! No, I do not. They don't have a setting to show what auditors see, which is astounding, so I'm creating my own random audits and trying to figure out how to invite myself to them on different emails to make sure I'm ready. I tried to add a new user yesterday. I searched for the user to apply the role, but they didn't show up. I found that I had to use the search button next to the search box - the box was only for existing users. Glad that was explained in the intuitive UI. All their documentation is self referential. It all says "this test says if a test has completed". None of it suggests how or where to go to fix a failure. It is like poorly written AI, and it makes me wonder if the platform is too. Integrations exist for the platform, but any time you want to review an integration or how it's set up vs its results you again go to a different part of the UI. There is still so much more, but I've already written a wall of text so I'm going to stop, they are in no way with the value of what we pay.

What problems is the product solving and how is that benefiting you?

Nothing. It's absolutely making everything worse. I'm almost at the point where I'd rather do a manual audit with all the concerns they're bringing in.

What do you like best about the product?

I find it easy to track our Controls and Policies with Drata. The staff can sign into the policy center and sign up, which is great because we can check everything right there. The third-party integrations really simplify life by reducing the need to create evidence since there are logs created through daily checks. The navigation is super easy to follow, which is one of the best parts. Drata is fast and intuitive, making onboarding quick and easy. The Help Center, especially the bot, is very helpful. Also, the initial setup was very easy.

What do you dislike about the product?

I find that getting a human side for Technical Support is a little slow if the automated bot is unable to help out.

What problems is the product solving and how is that benefiting you?

I find Drata makes it easy to track Controls and Policies, simplifies third-party integrations, and reduces evidence creation through daily log checks. It's fast and intuitive, with straightforward navigation and quick, easy onboarding.

What do you like best about the product?

I like the thoughtfully designed UI, the AI chatbot, and the relatively fast human support (special thanks to Terrious for exceptionally quick and accurate support). The integrations with other tools still have room for improvement, but overall, it’s been a better experience than some competitors. I also appreciate Drata Autopilot and how easy it is to quickly test integrations to confirm their capabilities and performance.

What do you dislike about the product?

There are some limitations in how the integrations are designed. With certain tools, the integrations leave you with very little control, and the available capabilities remain fairly high-level. In most cases, though, they make up for that with support.

That said, I think the scope of onboarding and the accelerator program is also too high-level. They help you collect some standard documents and fill in general fields in your Drata setup, but those aren’t the real pain points. They also provide generic policy templates. If you have zero policies in your business, you could try to implement what’s in those templates as your policies. However, if you already have policies in place, there’s little value in the provided templates.

If they took the time to understand your business and your current state, and then helped you align your existing policies with the requirements, that would make for a much better accelerator program experience. Overall, Drata is a great tool if you already know or understand what you need to do to achieve compliance, and it works well for us.

What problems is the product solving and how is that benefiting you?

We’re working to comply with information security standards and obtain ISO 27001 certification, and Drata is giving us a solid framework for that journey. It’s been a great starting point and template for managing the entire process. It helped us save weeks of planning for our compliance project, and it will likely save us hundreds of hours over the long run, since most of the things can be managed through the platform—policies, vendor reviews, and other documents that are created once and then kept up to date, automated integrations with our tools (MDM, Infrastructure, HRIS, Identity, Version Control, etc.), annual trainings, and more.

That said, it's not a magic wand that reduces the time required to prepare for a certificate to 100 hours. It depends heavily on your company's compliance posture, and if you're a beginner, it'll likely take months to write your policies, review your vendors, set up your integrations, and remediate failing configurations by redefining your procedures and updating your policies, etc.

What do you like best about the product?

I feel like it's well organized. Also includes corporate documentation. That is a big help.

What do you dislike about the product?

There is a lot in there. Sometimes it's hard to find things.

What problems is the product solving and how is that benefiting you?

We're using it for SOCII and HIPAA compliance.

What do you like best about the product?

It’s seamless: you install it, set it up, and then forget about it. It only bothers you when you actually have an action item.

What do you dislike about the product?

I haven't experienced anything worth mentioning

What problems is the product solving and how is that benefiting you?

It is helping us enforcing security policies needed for soc2