Drata company profile: valuation, funding & revenue

This Drata company profile covers the company's valuation, revenue, funding rounds, investors and history. Drata works in cybersecurity, with a focus on compliance automation and trust management. It was founded in 2020 and is headquartered in San Diego, California, United States. Its latest valuation on record is US$2 billion (December 2022). Every figure links to a public source, and anything the company hasn't disclosed is marked as such.

Revenue

Funding history

Drata timeline

Key dates from the sources on this page, oldest first. Metric snapshots are listed after the funding events.

• 2020 — Drata is founded in San Diego by Adam Markowitz (CEO), Troy Markowitz and Daniel Marashlian.
• Nov 2021 — Series B: US$100M, valuing the company at About US$1B. Investors: ICONIQ Growth (lead).
• Dec 2022 — Series C: US$200M, valuing the company at US$2B. Investors: ICONIQ Growth and GGV Capital (co-leads).
• December 2022 — Total funding: About US$328 million.

Investors

Overview

Drata automates security and compliance work. Companies selling software and services to businesses are often asked by customers to prove they protect data, typically through certifications and audits such as SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS. Preparing for these audits traditionally meant months of collecting screenshots, policies and evidence in spreadsheets. Drata connects to a company's cloud infrastructure, identity systems, HR tools and code repositories, continuously checks whether security controls are working, collects evidence automatically and helps teams fix gaps before auditors arrive. It also helps companies share their security posture with customers through trust centres.

Adam Markowitz, the CEO, Troy Markowitz and Daniel Marashlian founded Drata in San Diego in 2020. Adam Markowitz, a former aerospace engineer at NASA and Boeing who later founded and sold a company, experienced the pain of compliance audits firsthand at his previous startup. Drata grew rapidly as demand for SOC 2 reports exploded among software companies.

Products

• Compliance automation: continuous monitoring and evidence collection for frameworks such as SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR and NIST.
• Risk management: tools to identify, assess and track security risks.
• Vendor risk management: assessing the security of third-party suppliers.
• Trust management: trust centres and automated responses to customer security questionnaires, strengthened by the acquisition of SafeBase.
• AI features: assistants that draft policies, answer questionnaires and map controls across frameworks.
• Auditor network: connections to audit firms that use Drata's platform to review evidence.

Funding

Drata raised a US$100 million Series B in November 2021 led by ICONIQ Growth at a valuation of about US$1 billion. In December 2022 it raised a US$200 million Series C at a US$2 billion valuation, co-led by ICONIQ Growth and GGV Capital (now Notable Capital), doubling its valuation in about a year. Other investors include Alkeon Capital, Salesforce Ventures, Okta Ventures, Cowboy Ventures and Leaders Fund. Total disclosed funding is about US$328 million. We haven't found a newer priced round.

Business model

Drata sells annual subscriptions priced by the frameworks a company needs, the number of employees and the modules used. Customers range from startups getting their first SOC 2 report to larger enterprises managing many frameworks. Revenue isn't publicly disclosed, so we show it as not disclosed.

Competition

Drata's main competitor is Vanta, which pioneered the category and has raised at a higher valuation. Others include Secureframe, Sprinto, Thoropass, Hyperproof, OneTrust and governance, risk and compliance platforms from large vendors such as ServiceNow and AuditBoard. Competition is intense, especially for startups buying their first compliance product, so vendors differentiate through breadth of frameworks, integrations, trust management and enterprise features.

Drata at a glance

Drata is a San Diego compliance automation company founded in 2020 by Adam Markowitz, Troy Markowitz and Daniel Marashlian. It automates evidence collection and monitoring for SOC 2, ISO 27001 and other frameworks, and offers trust centre tools through its SafeBase acquisition. It raised a US$200 million Series C at a US$2 billion valuation in December 2022, co-led by ICONIQ Growth and GGV Capital.

Timeline

• 2020: founded in San Diego.
• 2021: raises Series A and a US$100 million Series B at about US$1 billion.
• December 2022: raises US$200 million at US$2 billion.
• 2023–2024: adds risk, vendor management and AI features; acquires oak9.
• 2025: acquires SafeBase, a trust centre company.

Why SOC 2 became essential

As businesses moved data to cloud software, buyers began requiring vendors to prove their security practices. SOC 2, an audit standard from the American Institute of CPAs, became the most common requirement for software sold in the US, while ISO 27001 plays a similar role internationally. Without a report, startups often can't close deals with larger customers. This turned compliance from an occasional chore into a revenue requirement, creating a large market for automation tools.

Who uses Drata

Drata's customers include early-stage startups preparing for their first audit, scale-ups managing multiple frameworks as they expand into regulated industries and new countries, and established companies replacing manual governance processes. Security, IT, engineering and legal teams all use the platform.

Compliance is not the same as security

Passing an audit shows that certain controls exist and work at a point in time, but it doesn't guarantee a company won't be breached. Continuous monitoring helps close that gap by flagging issues between audits. Buyers evaluating vendors should look beyond certificates to how security is practised day to day, which trust centres and detailed questionnaires aim to reveal.

Risks

• Competition: a crowded market with aggressive pricing.
• Startup dependence: many customers are startups that may shrink or fail.
• Platform bundling: larger security vendors may include compliance features.

Questions for buyers

• Which frameworks and integrations do you need now and in two years?
• How well does the tool support auditors you plan to use?
• How does pricing scale with headcount and frameworks?

Trust centres and security questionnaires

Large customers often send vendors long security questionnaires with hundreds of questions about their controls. Answering them manually takes security teams many hours and can delay deals. Trust centres, public or gated web pages where a company shares its certifications, policies and security information, reduce the number of questionnaires and speed up sales. AI tools can draft answers based on a company's existing documentation. Drata's acquisition of SafeBase brought these capabilities into its platform.

Drata versus Vanta

Drata and Vanta are frequently compared because they offer similar core products and target similar customers. Buyers typically compare the frameworks supported, the depth of integrations with their cloud and HR systems, the quality of auditor partnerships, trust centre features, AI capabilities and price. Both have expanded from startup-focused tools into platforms for larger enterprises, so the choice often depends on specific integrations and support experience.

Latest developments (October 2026)

Drata has not announced a new priced round since its 2022 Series C, which valued it at about US$2 billion. Secondary-market estimates in 2026 were below that figure, reflecting lower valuations for compliance automation companies, though such estimates are based on limited trading. Drata competes with Vanta, which has raised at higher valuations, and has added AI agents for security questionnaires and audits.

What to watch

Watch for new funding or acquisitions, AI-driven automation, enterprise growth and competition with Vanta. Our guide to cybersecurity unicorns compares Drata with peers.

Takeaways

Software companies can reach SOC 2 and other certifications faster with automation. Founders can see how a painful process becomes a product. Investors should note its last priced round dates from 2022.

Sources

Every figure on this page comes from the public sources below. Where sources disagreed, we used the company's own announcement or a primary news report. Private-company data changes; check the date beside each figure.

1. Crunchbase News
2. Cooley
3. SecurityWeek