Proving trust is one of the primary challenges facing cybersecurity today. Just look at the rash of data leaks coming from third parties in the news every week. There’s a significant gap between policy intent and execution, especially as companies navigate multi-tenant cloud infrastructures, distributed teams, and complex compliance requirements. Traditional GRC approaches using spreadsheets and siloed tools create massive overhead. This all becomes harder at scale, forcing organizations into painful trade-offs between thorough compliance and operational efficiency.
In this episode, Matt Hillary, CISO at Drata, explains how their AI-native trust management platform addresses these challenges by automating evidence collection from integrated systems and reducing manual effort by over 90%. Joining him are Mike Lockhart, CISO at EagleView, and Johna Till Johnson, CEO at Nemertes. The conversation explores how Drata’s platform bridges the policy-execution gap through hundreds of out-of-the-box integrations, AI-assisted questionnaire responses that handle 90% of vendor due diligence automatically, and real-time control monitoring that enables GRC teams to operate more like security operations centers, responding quickly to control failures rather than simply passing audits.
Got feedback? Join the conversation on LinkedIn.
Huge thanks to our sponsor, Drata
Full Transcript
[Voiceover] Connecting security solutions with security leaders, Security You Should Know starts now.
[Rich Stroffolino] Welcome to Security You Should Know. Today, we’re talking with Drata and what they’re doing in the GRC space. Now, the problem that they’re addressing, it’s a big one. It’s basically, how do you prove trust? And third-party risk is on everybody’s list here, we cover that all the time on Cybersecurity Headlines, so something we definitely need some answers to. And helping us get answers with some questions today are Mike Lockhart, CISO over at EagleView, and Johna Till Johnson, CEO and founder at Nemertese. So, Mike, I’m going to start with you. Why is proving trust still a problem for organizations?
[Mike Lockhart] There’s a large delta between intent and execution. Policy is your intent. You’re expressing how you desire an organization to operate across the spectrum. It’s not just about the technology component. Execution though is the piece where it becomes really difficult. How you take your intent and prove that in execution. In a small environment, a standard linear ITSM environment, for example, that’s relatively easy to put together. But the moment you step into multi-tenant public cloud infrastructures, large geographic distributions, large engineering teams, you create a lot more cognitive complexity that adds significant overhead to really prove that your execution meets intent.
[Rich Stroffolino] Jon, I’m going to throw the question to you. Why is proving trust still a problem?
[Johna Till Johnson] Well, I would say it’s less about proving trust per se because trust doesn’t need to be proved. It is, but it may be inappropriately applied. I think the underpinnings of proving trust have to do with proving identity and proving access and rights. So, is this entity who they claim to be, whether the entity is a person or a piece of software? Are they allowed to do what they are doing or looking to do? And that’s a really big question because sometimes you don’t actually know they answer to that. It’s a situation that may not have come up, so you may not know whether they should be doing what they’re doing, and the answer can be very nuanced.
[Rich Stroffolino] All right. Well, today we’re going to be talking with Matt Hillary, the CISO at Drata. Now, to start out, Matt, we need to answer three essential questions. So, how do I explain the value of your solution to my CEO? What does your solution do and what does it not do? And what is the pricing model? Can you help us out, give us these preliminaries?
[Matt Hillary] Of course, thank you so much, Rich. Mike, Donna, so grateful to be here with you today as well. In the past, governance, risk, and compliance, or GRC for short, has been highly manual, using spreadsheets or other siloed tools internally, but GRC isn’t just about checking boxes anymore. It’s really heartening to see the industry strive for what GRC’s intended to do, which is building and maintaining trust between organizations. It’s truly the currency of trust between organizations. Our customers and our partners, they expect ongoing real-time assurance that our business is secure and operating reliably and with integrity. So, doing so ultimately increases revenue, reduces costs, and reduces organizational risk.
Now, to your question, what do we do? What do we don’t do? Drata’s an AI-native trust management platform that unifies governance, risk, and compliance, and assurance into a singular capable platform. Drata pulls evidence from integrated systems, maps it to frameworks, and it makes it easy to prove trust, whether it be to auditors, to customers, or to our own leadership internally. We don’t replace auditors or approve your policies or burn down your risks for you. There’s still a lot of work that our GRC team members do, but it really accelerates and jump-starts the GRC effort and journey for all of our teams. We work with independent firms to help customers stay audit-ready and provide the platform to do so in a seamless manner. Now, Drata, as far as the pricing model goes, we offer flexible tiers, so the pricing scales with your business based on team size, integrations, frameworks, and any advanced GRC features you might need, like AI or vendor risk management. Customers report saving a ton of hours per year, hundreds, and especially with security reviews, over 90% or so accelerating deals over time and reducing the traditional tool and consulting costs.
[Rich Stroffolino] Fantastic. All right, we have set the table. We’ve gotten maybe just a little taste, a little appetizer about what Drata is doing, but I’m sure, Johna and Mike, you still have a lot of questions. So, Johna, I’m going to start with you. What other questions do you have for Drata?
[Johna Till Johnson] I think one of the first questions is what is, in an enterprise, how do you know that they are a good fit for your solution? What are the flags that say they have an itch for which we are the scratch? Or maybe they’re not even considering it. You’re talking to somebody in an elevator, and they happen to mention.
[Matt Hillary] It’s a solid question to start with there, Johna, especially because we do service large enterprise organizations as well as small startups that are just like, “Hey, we just want to get started. We’re a brand-new AI startup. We want to get a SOC 2 report out there. We want to help build trust with our customers to a large enterprise.” So, to your question, how do we know if we’re a good fit for enterprise organizations? Many of them still struggle with either building in-house solutions that have a large amount of costs, that may be operated with their own security engineering teams that are building those tools. Those are organizations that are like, “Man, there’s got to be a platform out there that’s doing this already, that already integrates with our off-the-shelf tools.” Those are organizations that, they may be a number of different places in their journey, but being a fully-fledged platform, whether it be core compliance that they’re struggling with, or whether they be struggling with, hey, I want to get my risk register out of my ticketing management’s tool, or I want to get my risk register out of my spreadsheets. I want to have it living, I want to have it tied to control monitoring tests that are out there. So, that may be another element. It really depends where they’re at on their journey, what their needs are, and how we can meet them where they’re at.
[Johna Till Johnson] So, but I mean, where I was going with that question was really like, if they happen to be dealing with their risk register in an Excel spreadsheet or Google Sheets, then probably they need to talk to you. And so, what are some of the other concrete examples?
[Matt Hillary] So, many organizations are striving to go after a number of different frameworks like SOC 2 or ISO. Many of them already have these, but they’ve been, let’s say to date, been doing that out of spreadsheets, doing that out of ticketing systems. And they’re like, “There’s got to be…” With these programmatic interfaces that exist today via APIs to pull and consistently monitor over time, that is another concrete example. Many organizations celebrate, “Hey, I got my SOC 2 Type 2 report. It’s clean, it looks great.” That’s a great start of a celebration of an ongoing commitment of integrity, of continuing to do what you’re saying you’re doing. And when they’re struggling to do these traditional methods, which are check-ins with control owners once a month or checking with risk owners once a month, they find that that’s highly burdensome and requires a lot of human effort. That’s another concrete example of where it’s like, hey, we do that behind the scenes with our integrations to help support those conversations so that you have your control owners back without having to even ask them how well they’re operating with those various controls.
[Rich Stroffolino] All right, Mike, I got to get you in here. What questions do you have for Drata?
[Mike Lockhart] Yeah, I’m interested in how Drata helps close the gap between policy and execution. And there’s a lot of vendors out there that claim automation, they will be able to go automatically collect all this for you, but they’re out of the box. They’re prefixed control assessments. How do you provide a customer that the specialization or that focus on policies that they have, that they’ve created, and their ability to use automation or use a platform in order to assure operational effectiveness with those policies?
[Matt Hillary] I really like this question, Mike, because it really hits on the essence of integrity. When you write a policy, you’re effectively agreeing to doing something as an organization across the board. Where that gap exists is where, hey, you can write a policy in a box, you can comply, but you’re like, wait, how is this operating? And with Drata’s platform today, we have these custom control tests. We have a lot of tests that are out of the box that match a lot of industry standards that are written in policy. And so, those are mapped to policy. And when we create these integrations with your systems, many of them are out of the box. Many are custom-created integrations. If you have like an on-premise environment or something that’s not out of the box, especially for large enterprise companies, they can create custom tests, send that JSON payload of what the latest control state might be to map against a policy statement to say, are you compliant? Think about policies, standards, then controls. Those controls can have tests. These tests are then conducted in an automated way where it’s pulling evidence in a real-time basis to then inform us as GRC teams that that statement and policy really is actually showing up in reality with how things are configured or operating in those kind of source systems.
[Mike Lockhart] So, what do you consider your definition of success when a customer brings Drata into an environment, implements it, and then reaches a final state? What does that definition of success look like?
[Matt Hillary] So, on my team, right, I am a practitioner at heart. I actually do manage our IT security compliance team. So, this is something that we measure ourselves. It’s changed over time. Originally it was like, hey, did we pass the audit? Now it’s, hey, how quickly are we responding to control test failures that are identified? Another one is, hey, what is our burndown of risks across the board looking like over time? Do we have a living risk register where we’re showing burndown over time? Do we have owners assigned to our risks? Do we have owners assigned to our controls? Do control owners feel enabled to opine on the state of their controls based off what the actual underlying evidence that’s being provided to them? The measures of success are variable. When I’ve written out metrics in the past to kind of assess where we’re at or where our customers are at, they do vary. Those are some that we’ve used internally to say, hey, how well are we responding to these things that the system is telling us? Almost like a security operations team might be with alerts and responsiveness there. It’s cool to see compliance be similarly operationalized.
[Johna Till Johnson] I have a question to jump into. Your emphasis is really cybersecurity. In fact, that’s why we have CISOs here on the call. But to what extent are you able to assist customers who are trying to manage risk more broadly?
[Matt Hillary] Great question. So, you’re right. When you think of integrated risk management programs, you’ve got the traditional security risk management program. We speak risk really well. The legal team also speaks risk really well. Sometimes the finance team does as well. But when you think about go-to-market teams or customer success teams or marketing teams or strategy teams or business development teams, you’re right, there are risks there. And what I find is the bigger hurdle isn’t so much getting that into our living risk register as representative risks for those team members, but to getting them to think risks in the beginning, to then start quantifying that, bringing that to the table, and watching those across the board. Our risk register allows for those kind of conversations. I don’t want to neglect the aspect of a third-, fourth-, fifth-party risks, or the vendor risk aspect of that whole integrated risk management program. We do support those efforts as part of a very core GRC program element, which is sending out requests for SOC 2 reports, evidentiary items. They also have a trust center that can be powered by us as well, where they can display where they’re at on their journey. I can double-click on the vendor risk manager side a little bit more but just know that it is organizationally getting folks to think like risk. We can absolutely categorize that in our risk register, watch that burn down. Similarly to our cybersecurity legal financial risks, in addition to augmenting with the vendor risk side of things.
[Mike Lockhart] So, here’s a question for you on the topic of risk. Over my career, I’ve found that some of the best reporters of risk in our organization are the people that typically we may not go talk to – a line staff engineer, an event contributor, somebody who’s been around the business for a while. To use a colloquialism, they know where the bodies are buried, right? How does Drata provide an opportunity for a practitioner like myself as a CISO to allow an organization to report at all levels of the organization so that they can bring risk in front of us, they can make us aware, and it doesn’t go through multiple layers of people and eventually get translated into something it’s not really.
[Matt Hillary] Yeah, Drata is the housing mechanism for all these risks that come to the team. I think the bigger problem is getting folks to know how to best ingest those to your team. Now, we do have the opportunity for people to report those to the team. We do have a role-based access within the platform where they can report and add risks to the risk register for review by the GRC team. It really depends. I’ve worked with large financial institutions where they want to have multiple reviewers of risk before it goes on a register, and I’ve worked with small startups where it’s like, “Hey, I am a DevOps team member. I know where the bodies are buried. I want to just put this somewhere. I want to get this hot potato out of my hands, into your hands in the risk register.” We allow that, either that via integrated mechanisms, via communication channels with the GRC team members internally, or just old school providing to the GRC team that then adds it to the risk register. Again, whatever your organizational processes are, that seems to be the bigger challenge versus the, “Hey, where is that housed?” and get reported and tracked after the fact.
[Johna Till Johnson] So, it’s interesting. One of the things I like about Drata is the lineup of customers who, without naming names, happen to be, I am a customer of them. So, that makes me very happy that they are a customer of you. And I know that you personally were a customer before you joined Drata. So, what, in your personal experience and in their experience, is causing customers to join forces with Drata?
[Matt Hillary] Yeah, a lot of feelings about this. I started and grew up in the GRC space. I started my career at Ernst & Young in the Seattle area, moved over to AWS to help start their AWS compliance team. But then we did things highly manually in the past. And so, it really speaks to my heart. As part of our own founding story, I was at a large learning management software platform. It’s actually where I met the founders of Drata. I was that grumpy, mean CISO that told them, “Hey, you need to go work with this third party. They’ll do a gap assessment to tell you where you’re at against our own SOC 2 controls. Fix those, they’ll come back, they’ll do the audit.” The CTO of that particular organization, who’s now one of our co-founders, effectively was that resource that pulled the 25 or plus screen prints across multiple different – for five weeks straight – was pulling this evidence for these auditors and just felt like, man, there’s so much better uses of my time. There’s got to be a better way to do this. We have now programmatic interfaces to pull this stuff. They then left that organization, started Drata. And so, as a customer, it spoke to my heart because it was like, man, we are long overdue for these capable GRC platforms for our GRC teams, like our security engineering and operations teams have had for a number of years. It’s great to be able to have these in the hands of teams to do more with these capabilities behind the scenes.
[Mike Lockhart] So, here’s a hard one for you. There are a lot of organizations that are emerging in this space, and one of the expectations I have as a CISO is that a platform I choose allows me to do more and do it faster with the people that I already have in my organization. What is the key differentiator for Drata that sets it apart from the other emerging players in this GRC space?
[Matt Hillary] An excellent question. I’ve thought about this myself. In the past, it’s been, hey, I need to throw more people at the problem, or I need to throw more automation, or even now more AI-powered capabilities to then augment our processes. And so, what Drata does differently in this area is out of the box, we have hundreds of integrations with hundreds of tools that you can then pull evidence for most core controls across 25-plus frameworks or so. So, when you think about doing that manually across that many different frameworks, the number of people to be able to do that, the traditional ways is just it’s so painful. So, adding in, and almost on day one, adding in your integrations, starting to see where you really stand with all of your controls across the board with the control tests immediately sees a reduction of burden on your team.
The next big burden for me as a SaaS company has been on the customer due diligence side of things. We have a trust center. And so when you’re thinking, “Hey, like, I’ve got hundreds of questionnaires…” Today, tomorrow’s actually the end of one of our fiscal quarters. And so, my team is answering questionnaires, but we have AIQA, so AI-assisted questionnaire assistance that has taken and answers, I want to say, 90% of the questions out of the box from these platforms. Again, reducing a significant amount of time that I have spent in the past or my team members have spent in the past answering these questions manually. So, that’s another example of reduction. The others on vendors, we’re wanting to buy vendor software a ton. And so, as part of that vetting process, we have some AI capabilities added into the platform that then allow that kind of assessment to go by much, much quicker. Last but not least, with Drata, MCP and other aspects with AI capabilities added into the system, we are now using prompt-based type of conversations like, “Show me where I’m at with my controls. Who’s the controller? Show me controls that don’t have controls.” That kind of stuff to really guide and start forming the essence of agentic AI.
[Johna Till Johnson] This is the first time you really brought up AI here, and I’d like a sort of concise summary of where you use AI because your website talks about how you’re AI powered. You kind of rattled through it really quickly just now, but maybe circle back and say, “Here are the three areas where we use AI,” or five areas or whatever it is, and what they do, and what you’re using it to do.
[Matt Hillary] Sure, sure. No, just segue into that. Even last night I was using this as well internally as a human user of this tool as AI-assisted questionnaire answering, right? So, we get hundreds of these questions. We still use questionnaires. Organizations, we still want to meet organizations or customers where they’re at with how they do diligence. And so, as a result, we still cater to these questionnaires. While I’d like to rely on existing report mechanisms that do that, it’s like, “Oh man, we got to.” So, what we do with the AI-assisted questionnaire aspect is a lot of these elements exist somewhere. We have a capable model that takes your specific data that then populates these answers with questions. You can start with humans still in the loop, reviewing those to make sure they’re accurate before they go off to the customer. That’s number one.
Number two is with vendor reviews, right? We review their SOC 2 report. I don’t know if you’ve done this, but I’ve scrolled through hundreds of pages of SOC 2 reports, just looking for the term exception noted or qualified report or management response. Our model can then in that front, go through, consume the report, surface any findings, surface the magic response, surface any qualified nature, really take a 15-to-20-minute exercise down to a number of minutes to really summarize where that vendor’s at on their journey. Alongside that, just on the AI side of things, really, really excited about the MCP side of things where we can really interrogate our API, interrogate our platform to ask the questions that GRC team members would usually ask, go down and do a ton of manual effort to pull the answers, do a bunch of analysis. And now it’s been awesome to use these capable large language models and well-trained other models within our platform to start answering those questions as if I have a AI representation of a vendor risk management person to do this effort for me and kind of report back. So, really forming that future of agents working on our behalf.
[Rich Stroffolino] All right, Matt, a lot of great information here. Fantastic questions. I got to ask though, what’s one thing we didn’t ask about that we need to know?
[Matt Hillary] Oh, man. Our Trust Center aspect is actually one of my favorite parts of the platform. Many organizations are struggling to represent their GRC efforts in a numeric dollar amount. With our Trust Center, we allow a customer-centric way of pulling documents, doing their own review, reporting back any questions, and then kind of doing their review in a self-service manner. Today, we can tie that with your CRM to say, “Hey, this last quarter, due to the number of requests from active customers as well as new customers, the GRC team had X million dollars of AR impact on the organizations achieving our goal.” And so, to be able to measure that really augments and shows the value that GRC really brings to quantifying what the value of trust is to that organization. And so, that’s one that I’m really excited about and largely because starting out with a Trust Center in your journey, it’s a great introspective exercise to demonstrate to the world where you’re at. We’re all on a journey. We meet you where you’re at. I’m on that journey as well. No one’s really there. It’s kind of fun, to be honest, but it’s neat to be able to see how we, through either Trust Center or GRC platform, is able to really just jumpstart your experience and your journey towards building and maintaining trust with customers.
[Rich Stroffolino] Fantastic. Well, that’s about it for this episode of Security You Should Know. To learn more, head on over to drata.com. And if you have any feedback or questions for our team or for Matt, send them over to us, feedback@cisooseries.com. We will get you some answers. A huge thank you to Michael Lockhart and Johna Till Johnson for helping us learn more about Drata. And of course, a big thank you to Matt Hillary, CSO at Drata, for your time and being game to answer all of these questions. And thank you for listening to Security You Should Know.
[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on CISOseries.com or just email us at info@CISOseries.com. Thank you for listening to Security You Should Know, connecting security solutions with security leaders.