Earning and maintaining customer trust has become increasingly complex as organizations struggle with manual, repetitive security review processes that frustrate customers and slow revenue cycles. Despite decades of talking about customer trust in security, companies still rely on outdated approaches like sending spreadsheets back and forth for questionnaires. The challenge isn’t just about having strong security programs. It’s how do you enable sales teams to move deals forward without constantly pulling security experts into routine questions.

In this episode, Al Yang, CEO and Co-founder at SafeBase by Drata, explains how their trust center platform addresses these challenges by creating transparent, always up-to-date security portals that streamline NDAs, access requests, and security questionnaires through AI automation. Joining him are Dan Holden, CISO at Commerce, and Terry O’Daniel, former CISO at Amplitude.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, SafeBase by Drata

Full Transcript

[Voiceover] Connecting security solutions with security leaders, Security You Should Know starts now. 

[Rich Stroffolino] Welcome to Security You Should Know. Today, we’re going to be talking about Safebase by Drata and what they are doing in security and compliance. Now, the problem that they’re addressing is how do you earn and keep customer trust, a big problem in the industry.

Helping us kind of figure out why this is still a problem is Dan Holden, CISO over at Commerce, and Terry O’Daniel, former CISO at Amplitude. Dan, let me start with you. Why are we still struggling with earning and keeping customer trust? 

[Dan Holden] I think it all comes down to forgivability depending on the scenario around a given breach. Some breaches are more forgivable than others, and the job of the CISO and the company is really to put yourself in a level of due diligence and a level of best forgivability that you can in any breach scenario.

[Rich Stroffolino] All right, I like it. Terry, same question for you. Why is earning and keeping trust, customer trust specifically, still a problem? 

[Terry O’Daniel] Well, we’ve been talking about customer trust in security for more than a decade. Every vendor puts it on a slide. Every CEO puts it in a board deck. So, why are we still talking about it? I think we have had challenges in actually solving it.

I remember a decade ago when we were mailing spreadsheets back and forth, and there’ve been some advances, but I think the core rubric we use to assess customer trust stays roughly the same. 

[Rich Stroffolino] All right. Well, today we’re going to be talking with Al Yang, the CEO and co-founder at Safebase. To start out, Al, I need you to answer three essential questions here. How do I explain the value of what Safebase is doing to my CEO?

What does your solution do and what does it not do? And give us an idea of the pricing model. Can you help us out here? 

[Al Yang] Absolutely. The problem is that earning and keeping customer trust takes too much manual work. Whether it’s closing a new deal, renewing an existing one, or passing an audit, companies just spend too many hours on repetitive security reviews and tasks.

Compliance and security teams get pulled into answering the same questions over and over, frustrates customers, slows revenue, and even puts renewals at risk, and that’s why we built Safebase, a trust center that makes the process transparent and scalable.

Customers and prospects get this secure, always up-to-date view of their security and compliance posture. We streamline NDAs and access requests and now we use AI to instantly answer security questionnaires. We don’t replace your people. We help them focus on higher-value work.

Our pricing is subscription-based and scales with your company size and needs. 

[Rich Stroffolino] Fantastic. All right. Well, I think we’ve gotten a good idea of the problem and kind of the broad idea of what Safebase is trying to do here. I’m sure we got a lot of questions though. Terry, I’m going to start with you. What other questions do you have for Al about Safebase?

[Terry O’Daniel] When we talk about security and trust, the real question for me is how do we justify it in terms of business value? That’s where I want to dig in a little further. Al, we’ve seen a lot of, I’ve seen a lot of big enterprises launch the Safebase trust portal publicly, and I didn’t realize at first, I had to scroll down a little bit and realize that these were being hosted by Safebase.

At first, I thought there was something [Laughter] magical that each enterprise had built themselves. Clearly, something clicked for these large enterprises that made them want to use the product. What told you that they were the right fit? How did you understand what your ideal customer was?

And how did you help them define what success looks like once they went live? 

[Al Yang] Yeah, so we help security teams offer a single source of truth around their security and trust posture, right? In real-time demonstration of control status, active alerts, but going all the way back to when the company was founded, a lot of companies had different use cases.

And not just small companies. Medium-sized companies and enterprises, of course, there’s complexity in terms of what they need and why they need a trust center. Focusing on the enterprise, which is where your question is, the unique use case is often around efficiency, so too many people spending time answering questions, and proactively building trust.

Instead of reacting to the customer needs, which has been how this industry has been, you have third-party risk vendors sending security questionnaires, it’s reactive before renewals, it’s static in terms of the answer. We decided to help the enterprises who are most often reviewed.

So, we’re talking about the big companies that have so many customers and are growing really fast. And figuring out their pain point, which isn’t, “Hey, I don’t have a good security program,” but how do I effectively communicate my security posture to my customers?

And different types of customers? 

Because when you’re a large enterprise, you not only have big customers, you have small customers, you treat them differently. You treat them differently in terms of the access and information they get. And you also want to build for the go-to-market team.

So, this is kind of the nuance that we unlocked early days. Helping GRC teams and security teams is one thing, enabling them by putting what you’ve done into the hands of the go-to-market team. So, we quickly integrated to the CRM of choice. So, a lot of enterprises are on Salesforce, of course.

So, our robust Salesforce integration allows your sales and customer success teams to leverage this trust center early on in communicating with the customers. 

[Terry O’Daniel] Can I ask a follow-up? Can you give me a concrete example? One of those early companies, how did they measure success? What were the actual metrics they used to say, before Safebase, after Safebase, here’s how we know we succeeded? 

[Al Yang] Absolutely. So, when it comes to large enterprises, you got to think about leaders, managers, and individual contributors. And to justify everything they’re doing, you have to have data. So, very early days, one of the first things we built is how do we demonstrate with data that security and compliance teams are not a trust center, but in fact, enabling the business.

So, by connecting to Salesforce and other ways that the teams are using the trust center, we’re able to provide real-time data on a quarterly, daily, how often is your trust center being accessed? Who’s looking at it? Which documents are they looking at?

Which questions are they answering? And how is that affecting the revenue tied to how security teams have influenced it? 

[Rich Stroffolino] All right. Well, Dan, I want to get you in here. What other questions do you have about Safebase? 

[Dan Holden] There’s a lot of cliches in security and I dislike most of them, but the one that often comes up is security is always chasing the idea of enabling the business, and I think that’s exactly what this kind of solution tends to highlight. And the ROI, I think, for CISOs and security orgs is a bit easier on this front.

But I want to go into the weeds a little bit with you, Al. Can you give us some further info about what these various workflows look like? How are customers, the security team, support, sales, how are they interacting with the solution in order to enable the business?

What does that day-to-day look like? 

[Al Yang] When you think about what enabling means, it’s very quickly, how am I impacting the top line positively of a company, right? You got top line, you got bottom line. And when it comes to the top line, you either increase more or you make it faster.

So, making the sales cycle shorter. When you think about the end-to-end problem of getting a security review or questionnaire from a customer or a prospect, it starts with, “I have a question,” and ends with, “My question’s answered.” Along that process, before Safebase came along, it was salesperson talking to the customers trying to sign the deal, and very often, the salesperson might want to get the deal done and then deal with the security review because security review takes up time.

Salespeople want to get assigned. That creates a ton of problem because now you can’t implement the thing, right? So, we’re all familiar with how that works. 

So, what we do instead is put the trust center and the information in the hands of the salespeople. One thing salespeople don’t like to do is bother their own internal subject matter experts, so their CISOs or their security teams or security enablement team, to help them answer questions or go through security review.

Because again, slows down deal and creates risk. So, by giving the salespeople the trust center early days and now enable with AI and integrate it to where they work from Slack to Salesforce, HubSpot, Microsoft Teams, they’re able to have almost a co-pilot throughout the process and collecting all that data.

[Dan Holden] As I often say, it’s security’s job not to introduce walls into the sales process. 

[Al Yang] That’s right. 

[Terry O’Daniel] Well, I have a question then in that regard, if that’s okay. We talked about business impact a little bit, and I would say there have been a few early competitors to the market that have built not exactly a trust portal. I think Safebase stands out in the fact that you really had a laser-like focus on the trust portal.

But in general, since we’ve been talking about third-party risk and trust for a long time, I’ve been grilled by our boards in the past few years in a way I didn’t expect. Boards are getting smarter. They’re asking discrete questions about how do we protect third-party risk?

They’re understanding the supply chain in a way that they didn’t previously. And we’re getting questions from the C-suite. The CFO will ask about ROI, “You have all these security tools. Justify why you really need this discrete tool for a trust center.” Is it a vanity thing that we put on our websites, or does it actually produce measurable outcomes?

So, you talked about a little bit of those, but I’d love to dive a little deeper. How does Safebase give me metrics that I can put on a slide when I’m talking to the CFO to justify ROI, or when I’m talking to the board to ask some of those increasingly tougher questions about did we practice due care in protecting our supply chain?

[Al Yang] Where Safebase is and when we started is to help the vendors answer security questions. So, we’re talking about, think of you as Amplitude or think of you as Commerce. You have a lot of customers. They’re asking you questions. You have to answer it.

But on the flip side of the same coin [Laughter] is third-party risk to your point. And that’s always where we knew where the holy grail was and where the problem really sat, right? If there wasn’t such manual and labor-intensive work done today in static on the third-party risk side, Safebase wouldn’t have the opportunity to exist.

It’s because third-party risk is done not so well and there’s a lot of room to improve. And part of why we decided to join Drata has a lot to do with that is how do we unlock both sides or create a trust network? 

Focusing on Safebase, the ROI is simple. Shorter sales cycle. You can easily measure that before and after and with deals that went through a trust center using security questionnaire AI capabilities we have and deals that didn’t because we track everything.

And that quickly shows you the ROI. It shows you the renewal. It shows you how you’re able to transparently and proactively share any notifications when there is a breach or some sort of incident in industry, and we provide that trust center update for our customers.

And enterprises want to be custom to their own brand. They have very unique brand guidelines. So, we make sure their trust center is theirs, not ours. 

[Dan Holden] Can we keep down that path? I would posit that the aspect of security over, let’s say, a post-COVID world that has really improved the most, or the thing that has improved it the most hasn’t been the classics of compliance and liability or avoid breach, which has been our last 20 to 30 years.

I think over the last five, six years, it’s been more about that third-party supply chain, right? COVID taught everyone that supply chains really matter. Before COVID, people were primarily interested in the two classics – compliance, liability, don’t get sued by the SEC, and don’t get popped, right?

COVID showed everybody, holy crap, everything is connected. We are not individual homesteaders, right? Everything is interconnected, and that was proven to absolutely everybody, from business leaders to everyday citizens. And I would argue that that aspect, right, the questionnaires have done more to improve us across the board as an industry than SEC pressure ever did or any other level of compliance or liability.

I would argue that it’s good old-fashioned high school peer pressure that has made us better. Al, have you seen the same thing given the amount of time the company’s been around, and have you seen that trend, actually, in other words, am I making that up or would you reflect the same sort of sentiment?

[Al Yang] What I would say from building this company and interacting with lots of customers, both from the leadership all the way to folks that are sending those questionnaires and reviewing those questions and the answers, the trend is during COVID, I remember not only everything went online, digital, so now you’re worried about supply chain, but also SolarWinds around that time, which was a massive supply chain risk, and that really kicked everybody into gear.

And what helped Safebase, or why we found such product market fit, is because having a trust website became not just a marketing thing. It became a security and compliance issue, and communicating to your customers directly became a must have. From there, it’s okay, well, questionnaires happens maybe once a year, sometimes once a quarter if you’re a big bank, you want to assess your vendors, but it became something every company saying, “Hey, this is a top five risk as a CISO that I think about, supply chain’s going to crush me if I don’t do it well.” And how do I think about continuously monitoring my vendors instead of sending static questionnaires that might change?

So, having a trust center that’s continuous and live. And I see this from the demand of our customers asking for these features. So, I know the trend is exactly what you’re saying and has kicked even into more gear with AI being part of everyone’s core stack.

[Dan Holden] Yeah, I would argue that a large portion of any company’s annualized loss expectancy is tied to third party, and I think if I’m a board member, that’s probably the question I would be asking. And I think that’s increasingly the question as CISOs we need to be asking.

Not only how do we improve third party, but how can you better grease the skids of the business, so to speak, which leads me to this very simplistic question now. AI’s putting pressure on all SaaS and software. Why buy versus build? 

[Al Yang] Build your own AI, meaning build your own trust center. 

[Dan Holden] Build your, yeah, your own trust center, right, yeah. 

[Al Yang] Yeah, yeah. I mean, it’s the same reason why I think teams aren’t saying, “I have a lot of capital, I’m going to go build my own model layer,” when you can easily access OpenAI or Anthropic or any other, X, where their job is to create the best model.

When I started Safebase, I always went to trust.salesforce.com, salesforce.com/trust. 

[Terry O’Daniel] Yes. [Laughter] 

[Al Yang] Terry might have been part of that. And when you have that many internal resources, you might be able to build your own trust center, not just a website, but integrated with tooling. But not every company has that kind of internal engineering and should they be focused on non-core products?

That’s a question that company needs to answer. But what we do see is, when you have best-in-class solution, you leverage it because we are always updating our AI to make your tooling better. We’re always updating how our trust center is to make our customers better, right?

Better use case. So, that’s my argument for license over build. 

[Dan Holden] Yeah, focus on the problem that you need to be good at. 

[Terry O’Daniel] That’s right. So, I think Dan opened the door for me here. Since you mentioned the magic word AI, I’m going to press a little deeper. Obviously, everyone’s been talking about AI for the past year and a half. But CISOs care about outcomes, not hype.

And we’re a little dismissive anytime someone mentions, “We sprinkled a little AI on top of this.” So, tell me a little bit more about how does Safebase use AI in a way that actually delivers value for customers, actually changes where you started out as building a trust portal, and where does AI help you go next?

[Al Yang] Three top areas where we use AI – using AI to answer security questionnaires. So, with a trust center, we have to have your content, your approved knowledge base, and big companies tend to have answers, so many questionnaires already. So, we already have the most up-to-date answers.

And think of it prompting any model you do today to answer questions. We do it with context, with business context in place, with toning in place, and with provision of what the customer should and shouldn’t see in place. So, answering questions. We have an AI trust center search.

So, imagine people come to your trust center. They can search and answer questions directly on the trust center, and your internal team can use it, almost like one of those internal enterprise search tooling to be able to answer their own questions.

It’s not just for the customers, for their own question. And then the third part, which I’m very excited to reveal at the end of this month at Drataverse is the agentic trust, which is how we help streamline that third-party risk side. How do we implement best practices, optimize and streamline workflow?

Because it is a connected trust network. And this is also why you shouldn’t build your own trust center because you want to be on a network. Just like you don’t want to build your own website when you can go on LinkedIn as part of a network. 

[Rich Stroffolino] All right, well, Al, what’s one thing we didn’t ask about that we need to know? 

[Al Yang] I think a question that could have been asked is how does Safebase help CISOs transition their position within the business from kind of Department of No to Department of Enablement? We talked about enablement, but we didn’t talk about how we help them transition.

So, we offer this analytic dashboard that demonstrates trust center engagement, how many questions have been answered, right, and what accuracy and speed. I think that’s the key part perhaps we could have doubled down more on, which is accuracy. Not all the AIs are created equally, a lot of hallucination.

How do we make sure the accuracy and speed and coverage is high and how many deals have been touched by the security streamline process that we’re able to help move from, move into close one, help CISOs prove to their team’s impact so that the CISOs can really focus on the higher-value work that they need to do to protect the business when their GRC security teams are enabling the business, and they can invest that dollar into parts of the business that they need to do.

[Rich Stroffolino] Well, that’s just about it for this episode of Security You Should Know. To learn more, head to safebase.io. If you have any feedback for the show, send it to us, feedback@CISOseries.com. Thanks to Dan Holden and Terry O’Daniel for helping us learn more about Safebase, some fantastic questions.

And thanks to Al Yang for your time and being game to answer all of these questions in the hot seat. And thank you for listening to Security You Should Know. 
[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on CISOseries.com or just email us at info@CISOseries.com.

Thank you for listening to Security You Should Know, connecting security solutions with security leaders.