Building a Billion-Dollar Security Company: Lessons from Drata’s Co-Founder and CTO

Daniel Marashlian has a name for the part of compliance nobody enjoys, and he built a company to make it go away.

“That messy middle is kind of boring and gross and mundane. And that’s what we’re trying to automate, is that continuous collection of data.”

Daniel Marashlian, at 5:47

Daniel is the co-founder and chief technology officer of Drata, the compliance automation company he started in June 2020 with Adam Markowitz and Troy Markowitz (LinkedIn, Drata). Drata’s own page now counts more than 8,000 customers, more than 30 frameworks and 15.7 million evidence items processed every day, and it calls the company the trust layer between great companies (Drata). Before Drata he was co-founder and chief technology officer of Portfolium, a LinkedIn for college students that Instructure, the company behind Canvas, bought in 2019. Drata’s author page lists the ventures before that, including RapidEngage, TweetPhoto and Pelotonics, and more than 20 years across product and engineering (Drata). He went to the University of Arizona, grew up in Sedona, and lives in San Diego.

Sasha and I recorded this in November 2024, a little under four years after Drata’s launch, and it aired on March 11, 2025. Where we sit, so you can weigh what follows: YSecurity runs SOC 2 programs for startups, and we set up the compliance platform with our clients, Drata among them, so we see this market from the customer’s side of the screen. Daniel’s numbers are labeled as his, and the public record sits beside them. I opened by telling him the honest version of how Drata looked from where I stood.

“I felt like it just sort of showed up out of nowhere, was a really nice, viable alternative to that other platform.”

Jon McLachlan, at 0:24

“Yeah, it does kind of seem like we came out of nowhere,” he said, and then he told us where it actually came from.

The first engineer is the security engineer

I asked whether he thinks of himself as a security person. His answer is the one most startup founders would give if they were honest, and it’s why so many of them end up running a security program they never planned to own.

“But you always had, as the first engineer, I had to be the security engineer. Not only from the engineering AppSec side, but, you know, IT, you know, networking, firewalls, all that fun, goody stuff, offense, defense.”

Daniel Marashlian, at 0:58

He has lost count of the companies, he said, though Drata is “my eighth from my last count that I did,” and some of the others “we started and shut down in three, six months.” His LinkedIn fills in the shape. He started as a web and database developer at Rio Salado College in Tempe, Arizona, working on the college’s learning management system, then led backend work at Epic Cycle Interactive, including ncaa.com through the 2008 tournament. He co-founded Pelotonics, where his profile says he was the first person to wrap corporate security around Google Docs, then ran engineering at TweetPhoto, renamed Plixi, a photo API his profile puts at 150 million requests a day before Lockerz bought it. RapidEngage and Portfolium came next, both as co-founder and chief technology officer, then Instructure, then Drata (LinkedIn). In a January 2026 post he was still counting, inviting people to a talk about “the 8-crazy companies I’ve started” (LinkedIn).

As each company grew, the security work went to a specialist, “obviously, always pass it down to the experts,” and he calls Drata’s security team “one of my favorite teams at Drata to work with.” So, a career in cyber? “In terms of a career in cyber, the answer is no, right?” His 20 years were in B2B, social networking and education, and this time around he started a cybersecurity company. I asked the obvious question.

“Yeah, why? Well, you got to be a little crazy to get into this security space, right?”

Jon McLachlan, at 2:29

We wrote a whole post about the arrangement he described, the founder or first engineer as the security team until the company can afford a real one, in In-House, On-Demand, or YOLO?. The short version is that it’s the right call early, and the bill comes due on a buyer’s schedule, which is exactly what happened next.

Let me see your SOC 2 report

The company before Drata was Portfolium, and he described it in one line: “Think of LinkedIn for college kids is the easiest way to think about it.” It ran seven years, raised what he remembered as “like 8 million, somewhere around there,” and sold to Instructure, the makers of Canvas. His LinkedIn has him at Portfolium from May 2014 and at Instructure from February 2019, leading Portfolium’s engineering after the acquisition (LinkedIn).

Portfolium started bottom-up, like a social network, and found its revenue top-down, selling to universities. That’s where the security question arrived, every time.

“And the more and more we got to selling to universities, like almost every time the CIO or someone like that would come in and it’d be like, this looks great. Love what you guys are doing. How are you going to protect our student data? And it kept coming back to the extremely long security questionnaires or, let me see your SOC 2 report.”

Daniel Marashlian, at 2:35

His first reaction will sound familiar to anyone who has built on a cloud provider: “And even a decade ago, it was like, well, SOC 2, what? Like, we’re on AWS. Don’t worry about it. Let’s go.” Then it stopped being theoretical: “Like, we’re starting to block deal flow.” And then came the cost, which he measured in engineers.

“you don’t know what you don’t know. Hire a consultant, rip engineers off the roadmap, go through the whole gamut. And for a small startup, I think we had six engineers at that startup, ripping three engineers off to help go get a SOC 2 report is no joke. It’s a big decision.”

Daniel Marashlian, at 2:35

Three of six is half the engineering team for a document, and it’s the number I’d put in front of any founder who thinks SOC 2 is a sales problem. If the request is new to you, What Even Is a SOC 2? covers what the report is and the SOC 2 readiness checklist covers where to start.

The good news is in Drata’s own numbers, from a report Daniel wrote up in August 2026. Roughly 70 percent of Drata customers have SOC 2, which he is careful to say describes Drata’s base and not the whole market, and the data cut against the assumption that small teams are at a disadvantage: smaller teams reached strong readiness and finished more often than large ones. “Starting small does not put your program behind,” the post says. It also draws the line I wish every founder knew on day one, that readiness isn’t a report, because a SOC 2 Type 2 needs an observation period of roughly six to twelve months after the controls are in place (Drata).

Spreadsheets, screenshots, tickets, meetings

The surprise in the Portfolium story is what came after the acquisition. Working with Instructure’s security team, “I was extremely excited about compliance,” he said, because he’d watched his sales team fight through procurement and wanted to know how a big company did it. The answer was the same way he had, just bigger.

“It was like the same way that I was doing it: spreadsheets, screenshots, [Jira] tickets, meetings, but not of like a 40-person company, like a 1,400-person company.”

Daniel Marashlian, at 2:35

“So you could think about those very large entities and they’re just doing it by hand with just humans,” he went on, and that was the moment: “I think we need to automate this for the industry.” I said what I’d felt listening to it, “You felt that pain,” and he had.

Drata tells the same origin story on its own page. Adam Markowitz worked as an aerospace engineer on NASA’s Space Shuttle Program, where systems only move forward when every part is documented and verified, and at Portfolium the three co-founders ran into audit readiness that meant chasing evidence across tools and teams, so in 2020 they launched Drata (Drata). Five years later Daniel put the before picture in almost the same words he used with us.

The messy middle

Sasha asked the question every automation company has to answer first, “When we start talking about automation, where do you begin automating?” Daniel’s answer was specific: “there’s a big emphasis, which is continuous evidence collection for controls, security controls.” Then he drew the line between the work that matters and the work that doesn’t.

“I don’t think anyone’s excited about having meetings, collecting screenshots, and like getting evidence of how I effectively operate a security control in my business. That’s not the fun part. The cool part is setting up structure for your business to run secure, you know, a well-oiled machine.”

Daniel Marashlian, at 5:47

The structure is the program: the controls, the owners, the reasons. The artifact at the end is the report you use “to build trust.” Everything between them is the messy middle, and it’s the part that eats the engineers.

He put a number on it at the end of the episode: “On average, it takes roughly 500 hours to maintain your SOC 2 report. We get that down to about 50 hours, right? Roughly an hour a week.” That’s Drata’s claim for its own product, and Daniel repeated it in an August 2025 post, as 500 hours a year down to under an hour a week (Drata). By August 2026 the advice had shrunk to two short lines: “Integrations over screenshots. Continuous monitoring over point-in-time scrambles.” (Drata).

We’d add one thing from the auditor’s chair. Continuous collection only helps if the test checks what the control actually does. Our post Enabled Isn’t Enforced is about the gap between a setting that’s on and a control that’s enforced, and the calculator further down turns Daniel’s 500 and 50 hours into dollars for your team.

Isolating and indexing and sharding the data

Sasha’s next question was the one everyone was asking in 2024: “How do you guys take advantage of the AI or Gen AI technology as a whole?” Daniel’s answer started with the part most AI announcements skip, the plumbing.

“We stayed with our AWS partner in using Bedrock and that technology downstream, which is powered by Anthropic, and like isolating and indexing and sharding the data appropriately. So we took a lot of time in the data pipelining and just the hard engineering part.”

Daniel Marashlian, at 6:45

Only once that was done did the product teams get the question “what do you want to do with this?” The first six to nine months went to infrastructure, he said, then about three quarters of adding generative AI to workflows “from an hour to 10 hours” of a person’s time, with a goal: “It’s like, how do we use generative AI to reduce that by 90%?”

The record backs the order he described. Amazon Bedrock, the AWS service that offers foundation models from several AI companies through one API, launched in 2023 (Wikipedia). In March 2024 Drata published its AI philosophy, written by Lior Solomon, its vice president of engineering for data, naming Anthropic’s Claude among the Bedrock models and describing models and datasets segregated by tenant to “eliminate the risk of cross-contamination between different customers’ data” (Drata). In June 2024 Drata showed AI questionnaire automation live to more than 600 GRC, IT and security professionals at its Drataverse conference (Drata), and by July 2025 that tool had processed more than a million questions and answered 85 percent of them (Drata).

In August 2025 Daniel wrote the whole sequence up as four stages. The first was trust, built before a single AI feature launched, starting with “Isolated indexes per customer to eliminate data leakage risk.” The second was compressing hours into minutes with summaries of vendor SOC 2 reports and help with security questionnaires. The third and fourth were the roadmap at the time, a co-pilot that answers inside Slack and then governance that agents check before they act, with people kept in the loop (Drata).

The question to take from this into your own vendor reviews is the one Daniel answered before anyone asked: where does my data go when your AI reads it, and what keeps it apart from every other customer’s? If a vendor can’t answer in writing, the AI data bill of materials is a good place to start the conversation.

Go disrupt ourselves

The part of the AI answer I liked best wasn’t about a feature. It was about staying hungry at 550 people.

“if we don’t continue to innovate, someone else will. And we don’t want that to happen to us. So we even have like a little team inside Drata of like, go disrupt ourselves, right? Using AI and make sure that we’re on the cutting edge of that.”

Daniel Marashlian, at 6:45

Sasha connected it to a conversation we keep having with growing companies, “Yeah, and this is quite a common topic of how do we ensure that we don’t slow down as a company.” Drata’s moves around the tape show the habit. In May 2024 it bought oak9 and launched Compliance as Code, checking compliance while code is written as well as after it ships (Drata). Three months after the recording it agreed to buy SafeBase, the trust center company, which we come back to after the tape.

A hundred five-minute problems

I asked what a typical day looks like for him. Some days are podcasts, “CISO dinners and fun marketing field stuff,” and the technical days have a shape he has a phrase for.

“you know what I always say? 100 five-minute problems every day. A lot of times, that is one of my days. It’s, and that’s fine. It’s not really, it’s not a complaint.”

Daniel Marashlian, at 8:12

The math behind it is the team. Drata had “about 550, about 250-ish, somewhere in there on technology,” his estimate in November 2024, and if he can help each of them “move even, you know, 20 minutes faster, that’s awesome.” So the day is code reviews, architecture reviews and anything blocking someone, and some weeks it’s the opposite altitude. The week before we recorded, he had pulled every technology leader, director and up, into a three-day 2025 planning session.

“I always call it like changing elevation. Like, you need to be able to fly at 30,000 feet, operate and lead the business and think forward.”

Daniel Marashlian, at 8:12

And if there’s an incident, “literally, next moment, be able to drop down to the ground floor with the troops.”

“I love that,” I told him. “I love also that you still get your hands dirty here and there and pay attention to where the rubber hits the road.”

Everyone is super technical

It’s a rule he hires by, not just a habit.

“So everyone from me to directors to managers to ICs, like, everyone is super technical. Obviously, we have our respective roles and pie charts of duties, but, uh, when it comes time, we all can jump into the code.”

Daniel Marashlian, at 9:59

I asked what he thinks is the most important quality in a leader. “I think just have respect for the people you’re leading and know their craft.” Earn their trust by relating to their pains, their wins and their craft, he said, and “you can build trust with them for them to follow you forever.” His example was his head architect, someone he has worked with for almost 20 years and built four-plus companies with, where the trust runs both ways: the architect trusts Daniel to keep the business paying, and Daniel has his back on what they build, and “there are many more like that at Drata that I’ve worked with time and time again.”

For a security program, this is the quiet advantage of technical leadership. A leader who can read the pull request can tell a real fix from a checkbox, and the engineers know it.

Guide the machine

I asked where Drata goes next. His answer was the enterprise, and the picture he painted will be familiar to anyone who has sat in a public company’s compliance department.

“And how do you disrupt that legacy thinking of GRC and needing to hire a 70-person security compliance team to maintain all these certs because I’m a public company and I have to do SOX and I have to do SOC 2 and I have to do GDPR and all this other fun stuff, and therefore I need to hire humans to do it all?”

Daniel Marashlian, at 11:38

“There still are humans that are involved,” he said, “but instead of having a 70-person team, maybe you have a 20-person team. I don’t know, whatever it may be.” Both numbers are his illustration, and the shape of the idea is the point: “kind of being there to, like, guide the machine versus having the program and the process guide you.” SOX here is the Sarbanes–Oxley Act of 2002, the U.S. law behind public companies’ financial controls (Wikipedia). I told him what I liked about the answer.

“I love that you’re falling in love with the problem instead of like the answer to that question.”

Jon McLachlan, at 12:39

Sasha pushed on the hard part. “As we know, especially in larger organizations, it’s pretty hard to come in with a new process. It needs to be obvious to people who follow the process why they should follow something new.” Daniel agreed and split the room in two. The innovative CISOs and GRC leaders want it, “even if it’s not about reducing staff,” so highly skilled engineers can work on securing the business instead of the messy middle. The practitioners on the floor are a different conversation.

“Like, they think we’re going to displace them, or they think it’s not trustworthy, or they think it’s, you know, just a different way. So I think it’s brand, it’s communication, it’s collaboration and partnership versus just, here’s a tool, go use it.”

Daniel Marashlian, at 13:08

Drata’s next two years were the enterprise bet paying out. By February 2026 it reported 190 percent year-over-year growth in enterprise customers, what it called quadrupled year-over-year growth in new enterprise revenue, and customers that include Fortune 100 companies and a third of the Cloud 100 (LinkedIn). His ASPs, average selling prices, were already rising when we talked, he said, “It’s been great to see our ASPs increase and all that fun, fun stuff.”

Here’s a tool, go use it

To explain why the enterprise needs partnership, he used the opposite case, a tool that never needed a salesperson.

“I think, you know, I’m the biggest fan of GitHub, and I love it as a developer.”

Daniel Marashlian, at 13:08

Drata now has “probably 200-ish-plus people that contribute to code on GitHub,” and he signed up when the company started without ever talking to anyone there. “But you weren’t, like, disrupting how I did code,” he added. The disruption had happened years earlier, from CVS to Subversion to Git, and he was on the side pushing it: “I used Subversion, but it was like, I was the one fighting the team to go to Git very early on.”

His point was that a tool like Git can spread by itself among developers, and a change to how a whole compliance department works can’t. “no matter what disruption of technology, the cloud, you know, the cloud computing wave is probably the best example. Maybe the most modern example is AI,” he said, and in every one of them “I don’t think it’s just like, here’s the technology, use it.” What wins, in his telling, is customer obsession after the sale, implementation, support and customer success, with “customers are the center of the business.” His model was AWS: “I can talk to so many people at AWS for free to help me, like, figure something out.” They don’t charge, he said, “because they know the more you’re successful on AWS, the more you’ll spend on the services.”

Customer experience is critical

Sasha took that one step further, to who owns the customer.

“And I know some organizations shy away from creating a dedicated UI UX team or, I should say, customer success teams, because the idea is that everyone who is building the product should be that team member of the customer experience. You have to understand what the pain point is.”

Sasha Sinkevich, at 16:36

It’s the same principle we apply to security programs: the engineers who build the product should understand the buyer’s security review, because they’re the ones who can make the next answer true.

A seven-year-old startup on day one

I asked for his best day at Drata, and he started with launch day, “just because of this immense hard work.” They had launched in the middle of COVID, after incorporating, by his memory, around July 6, 2020. What made the first months unusual was who was in the room.

“So it was like, from day one, it was this, you know, 10 or whatever person team that we had, this, like, seven-year-old startup on day one. It was a, it was a cheat code that we had.”

Daniel Marashlian, at 17:10

Three co-founders who had built Portfolium together, a group of founding engineers, a couple of founding salespeople and a customer success lead, working “just grueling, like literally 16, 18 hours a day of coding.” Drata’s own count of that team, from its second anniversary post, is “With just 15 of us and a handful of amazing beta customers” (Drata).

The lesson I’d pull out for founders is the one Andrew Rubin of Illumio gave us from the other direction on episode 88, where the overnight success took a decade. Drata’s clock looked fast because the waiting had already happened at Portfolium, with the same people, and the problem was one they had lived as customers.

Our own SOC 2 report, the day before launch

The detail in the launch story that I love most is the order of operations.

“We used our own tool to get our own SOC 2 report. And the day I remember when we got it, we got our own SOC 2 report, Type 1, because it was like the first one, on January 14th of 2021. We launched on January 15th, the next day. We wanted to have it and prove to the world that you can use Drata for what we’re selling.”

Daniel Marashlian, at 17:10

Drata’s January 2023 post tells it the same way. The team wanted to “drink our own champagne,” as Adam Markowitz put it, so it delayed the launch to January 2021 until it had a clean SOC 2 report in hand, earned with its own product (Drata). Daniel calls it “a really proud moment,” and it’s also a lesson in which report to get first. A Type 1 shows your controls are designed well at one point in time, which is exactly what a company on its first day can prove. A Type 2 shows they worked over months, and the clock for that starts once the controls exist. We wrote up the difference in SOC 2 Type 1 vs Type 2.

It turned into a habit. In June 2026, launching a product to govern AI agents, Daniel wrote that Drata was “customer 0” again, with thousands of its own agents to watch.

Ten months to a billion

His second best day was a funding round, and he was clear which one.

“the one that really stands out was our B round, the $100 million round we raised at a billion-dollar valuation. And that was 10 months into the business of launching the company.”

Daniel Marashlian, at 17:10

“From everything I’ve found online, I think we were the 10th fastest in the world to ever do that,” he said, and that ranking is his. Drata’s own announcement, on November 8, 2021, said the $100 million Series B, led by ICONIQ Growth with Alkeon Capital and Salesforce Ventures, made it “one of the fastest SaaS companies ever to reach $1 billion valuation.” The same post counted “more than 70 employees,” so the team was a little bigger than the “like 40 or so people” he remembered, and it was still tiny for a unicorn (Drata). The Series A, $25 million led by GGV Capital, had come that June (Drata), and in December 2022 a $200 million Series C co-led by ICONIQ Growth and GGV Capital doubled the valuation “in little over a year” (Drata).

His third day was an award, a Tech 50 list in its inaugural year that put Drata on the Nasdaq floor and its founders’ faces on the Nasdaq tower in Times Square, “a big surreal moment where me and Adam, my CEO, were, our faces on the middle of Times Square.” The tape doesn’t make the list’s name clear, so here it stays his story. Times Square came back, though. In June 2026 Drata’s AI agent governance launch went up on the same kind of screen, and Daniel thanked Nasdaq for it.

Signing the term sheet

Then I asked for the hardest day, and the answer surprised me.

“Sometimes one of the most challenging days was actually signing the term sheet of those big rounds.”

Daniel Marashlian, at 19:53

As a serial entrepreneur, he said, an exit has real value for him, his family and his coworkers’ families, and every big round shrinks the list of companies that could buy you. “So it’s like, okay, we’re going to go take this billion-dollar round. All of those three, four, $500 million acquisitions are out of the door.” He was candid that he likes where it led, “I love where we’re at and where we’re going, and, like, that we’re marching towards an IPO, but, like, those options were gone.” For a founder reading this with a term sheet on the desk, it’s the most useful sentence in the episode: a higher valuation is also a decision about which endings are still possible.

A mark of success

On the technical side, the hard days are incidents, and he talked about them without flinching.

“I would say on the technical side, probably, you know, there’s incidents that happen just like at any shop, and you get through those. It’s almost a mark of success, you know.”

Daniel Marashlian, at 19:53

“Yeah, it happens,” I said, and he went on to the part he finds rewarding: “you see the people that step up, and you see the people that truly are experts at their craft, but also have care for their customers and their business.” That’s the culture side of incident response. The engineering side, making sure the next incident reaches as little as possible, is what Once They’re In is about.

Winamp was out of Sedona

I asked what he’d tell a younger Daniel. Stick with sports, he said. He’s a big tennis player who came to it at about 16, though his mother had put him in lessons at six, and he’d tell himself to stick with that and with a team sport, because “it’s all about the team and the people that build the product.” Sasha asked where he grew up.

“In Sedona, Arizona, a little tourist town. When MP3s first came out, the world’s largest MP3 player was called Winamp.”

Daniel Marashlian, at 22:18

“Oh, I used to use Winamp,” I said. The record backs his hometown claim. Nullsoft, the company behind Winamp, was founded in Sedona in 1997 by Justin Frankel, Winamp was written by Frankel and Dmitry Boldyrev, and AOL bought Nullsoft in 1999 for $80 million (Wikipedia, Wikipedia). For a geeky kid, seeing that “something like that could be built from that small town” mattered, and he remembered Sedona as “like 8,000 people.” The 2020 census counted 9,684 (Wikipedia), which makes his point better: it’s a very small town to produce two of these stories.

“So now I feel like with Drata, I think we beat that number to have the biggest tech success out of Sedona.”

Daniel Marashlian, at 22:34

These days tennis is how he switches off, “the rest of the world melts away,” along with friends, family and the beach in San Diego.

Two tools he wishes someone would build

I asked for the tool he wishes someone would just build. He had two, and a confession first.

“I don’t want to know how the canvas is made. Just let me go buy a canvas and I’ll use it, right?”

Daniel Marashlian, at 24:10

It’s a lovely line from someone whose last company sold to the makers of Canvas, and it’s the buy-don’t-build instinct of a developer who would rather write the product than run the infrastructure. The first wish is about incidents. Drata deploys on AWS Elastic Container Service, and a one-line fix still has to build a container, release it and swap the running ones out: “it’s like 20, 30 minutes, based on however long things take. And it’s like, I need that down to, like, one minute or three minutes.” He misses the days when “like PHP, just push the file to the server and it’s up, because it’s interpreted.”

The second one is bigger. In his words, “honestly, I think this would be a trillion-dollar idea,” and “I think AI is really going to help eventually solve it for people.” As software grows, every change depends on more of the system, and the hard question is always the same: “What does it impact?”

“So a tool to say, hey, you’re changing this one line of code or this function, you need to go check these six spots.”

Daniel Marashlian, at 24:10

The field has a name for the second one, change impact analysis, the study of a change and its potential consequences in a product that’s already deployed (Wikipedia), and since we recorded, AI coding tools have gone after it directly. Scott Dietzen described Augment’s version on episode 74, where the AI watches one change and infers what else in the repository has to change with it. The security version of his wish is the one we care about most: before a change ships, know which controls it touches, so the evidence and the review follow the code. And the buy-don’t-build instinct runs all through Drata. In May 2026 Daniel wrote that Drata runs Socket “across every repo” for supply chain risk (LinkedIn), the company Feross Aboukhadijeh described on episode 36.

“I would love that,” I said. “This sounds magical.”

Dive in with both feet

I asked him to leave our listeners with some advice, and he spoke to the founders.

“my advice is it’s going to be the hardest thing that you’ve ever done, but at the same time, extremely rewarding. Just dive in with both feet and go all in.”

Daniel Marashlian, at 27:18

His version of going all in is learning. “It’s tempting to sit down and turn your brain off and watch the reruns of Friends or something at night. But instead of that, learn about a new, you know, design paradigm.” Go watch “the F8 conference or whatever it may be,” he said. “Just learn, keep learning.” And for the founders just getting started with compliance, he closed with Drata’s pitch, roughly 500 hours a year to maintain a SOC 2 report, down to about 50, “So it, it just makes it easier.”

What happened after the tape

The months after the recording were busy. On February 11, 2025, Drata agreed to buy SafeBase, the trust center company founded in 2020 by Al Yang and Adar Arnon, whose trust centers more than 1,000 organizations had used, with the deal expected to close later that month (Drata). About a week later, at four years since launch, Drata reported $100 million in annual recurring revenue, more than 7,000 customers and 60 percent year-over-year revenue growth, with frameworks like DORA, NIS 2 and ISO 42001 added along the way (Drata).

The episode aired on March 11, 2025. That summer Drata’s questionnaire AI passed a million questions, and in August Daniel published his four-stage AI roadmap. In February 2026, at five years, Drata opened a headquarters in San Francisco and counted more than 8,000 customers (Drata), and that April it unveiled a new brand “inspired by mission-grade aerospace discipline,” which fits the founding story on its about page, where Adam Markowitz starts out on NASA’s Space Shuttle Program.

On June 10, 2026, Drata declared AI agent governance the next major enterprise security category and revealed the product it is building for it, extending a platform it said 8,500 organizations use (Drata). In July its research found only 13 percent of GRC professionals fully confident in their AI visibility (Drata), and on August 4 the product went to limited availability, shipping first for Anthropic.

Daniel’s own writing kept coming back to the messy middle. His August 2026 report on SOC 2 is the one quoted above, and in September Drata launched agentic third-party risk management (Drata). On October 28, 2026, Fortune’s fourth annual Cyber 60 put Drata at number 8 among growth-stage companies (Fortune). And this week Daniel is back in his own community, speaking at San Diego Startup Week from November 2 to 6 (LinkedIn).

The phrase I keep from this episode is his first one. The first engineer is the security engineer, and the work that eats that engineer is the messy middle: the screenshots, the meetings, the questionnaire answered for the tenth time. Automate the middle and the two ends get better too. The structure gets more attention, and the report means more, because it’s built from evidence that never stopped flowing.

Did you catch it? A six-question quiz

Is your compliance program stuck in the messy middle?

Daniel’s line between structure, the messy middle and the artifact makes a good test of any program. This scorecard asks eight questions about yours, from how evidence gets collected to who answers the questionnaires.

What does the messy middle cost you?

Daniel’s numbers were 500 hours a year to maintain a SOC 2 report by hand and about 50 with automation, and three of six engineers for Portfolium’s first report. This calculator puts your own numbers next to his.

From Winamp to agent governance

Everything on this page sits on one timeline, from a Sedona software company to agents with their own governance. Filter it by thread.

What to do this week

Five things, in the order Daniel’s story suggests.

1. Count the hours. Add up what your team spent last quarter on evidence, audits and security questionnaires, and put it in the calculator above. Most teams have never written that number down.
2. Automate the evidence your auditor samples most. Access reviews, MFA, offboarding and change management are usually the top of the list. Connect each one to a test that runs every day, and give someone the job of reading the failures.
3. Build one answer library. Collect the answers from your last ten questionnaires in one place, give it an owner and publish what you can on a trust center, so the next buyer doesn’t start a meeting.
4. Ask your AI vendors how your data is kept apart. In writing: isolated per customer or not, trained on or not, and who else sees it. Daniel’s team answered that question before shipping a single AI feature.
5. Pick your first report on purpose. If a deal needs proof now, a Type 1 can start the record while the Type 2 observation window runs, the way Drata launched with its own report in hand. Don’t pull half your engineers to get there.