Their monitoring dashboard is fantastic for identifying monitoring and compliance gaps, and their policy creation module is a game-changer for getting company policies created or updated. Review collected by and hosted on G2.com.

The way test failures are presented in the pure JSON test output can sometimes make it take an unnecessarily long time to figure out which resource is causing a compliance error. The AI-generated output for these failures has improved, but they could still benefit from better JSON parsing so that, even when the raw output is shown, the user only sees the failures. Review collected by and hosted on G2.com.

Pricing. I do not like nothing else in this SW Review collected by and hosted on G2.com.

The role-based model is horrible. You need this software for compliance, but you can’t properly manage your users within it. It feels like they only give you two options: either you do everything yourself, or you have to grant overly broad permissions to others, which then breaks compliance. You cannot manage different companies simuntenioustly because other they cannot spleat access between entities. And DRATA has no trust center, in their case Trust center it is other company and you will need to have addtitional discuttions with them about pricing and functionality.

Limit list of integrations.

Integration which exist is often are not working.

The company deleted support and replace it with AI agent. Review collected by and hosted on G2.com.

I love that Drata makes the compliance process so much easier for our ISO27001, SOC2, and HIPAA certifications by doing all the heavy lifting for us. I also appreciate the ease of use; it was so easy to get started, and the UI just makes sense. The way it breaks things down into sections like compliance and risk is really helpful. Setting up Drata was incredibly easy, I was set up in a day. Review collected by and hosted on G2.com.

Buying a new framework is incredibly expensive! One additional framework I've been quoted 1/3 of my subscription price! Review collected by and hosted on G2.com.

I use Drata for security and compliance, especially for policy creation and ensuring SOC, HIPPA, and GDPR compliance. Drata is crucial in policy creation and control monitoring, making the process of policy creation easy and allowing us to account for all the controls needed for audits. The platform is very easy to use, with a user-friendly web UI and layout that makes navigation simple. I appreciate how well-organized everything is in the Drata UI, allowing me to see, acknowledge, and collaborate on policies effortlessly. It's intuitive and doesn't feel cumbersome like other platforms. Setting up Drata was also easy, and our representatives made the process smooth. This was my first experience with a compliance tool like Drata, but it was easy to learn, and I would definitely recommend it. Review collected by and hosted on G2.com.

The collaboration when drafting policy could be better. I've run into issues where multiple people working on the same policy end up conflicting with each other's edits. We tried using Word for live collaboration, but that was clumsy. A live editor would be a game changer! Also, versioning could be improved and more detailed. I think a feature to 'check out' a policy so it isn't editable by others could help avoid conflicts. Review collected by and hosted on G2.com.

It’s a decent tool for tracking SOC 2 compliance rules and controls. It also integrates with our HRIS, which helps keep things connected and easier to manage. Review collected by and hosted on G2.com.

The “tests” for various controls aren’t very intuitive, and at times they feel more arbitrary than helpful. Pricing also seems high relative to the platform’s actual capabilities. During onboarding, the reliability of the tool was oversold, which made it harder to gauge how deep we needed to go with our controls and any supplemental tracking tools. I would have preferred clearer, more practical guidance throughout. Review collected by and hosted on G2.com.

What I like about Drata is how it transforms compliance from a manual, point-in-time effort into a continuous, automated process. Its integrations with tools like cloud providers and identity systems make evidence collection largely hands-off. The dashboard is clear and accessible, giving both technical and non-technical stakeholders quick insight into compliance status. Overall, Drata makes it much easier to stay audit-ready without the usual operational burden, and it scales well as organizations grow. Review collected by and hosted on G2.com.

What I dislike about Drata is that the initial setup and configuration can be time-consuming and sometimes confusing, especially when mapping controls across multiple frameworks.The platform can also generate a high volume of alerts or tasks, which may create noise if not carefully tuned. Review collected by and hosted on G2.com.

I really like the ease of use and the support that Drata provides, especially for a small team like ours. It's helpful to have a tool that works for us in terms of compliance. Drata gives us an overview of all necessary renewals for evidence, and the use of templates is really handy. It's nice that Drata offers many easy setup configurations. Review collected by and hosted on G2.com.

The platform is sometimes a little bit slow and minor bugs. Sometimes I have to wait for tech support to answer for bugs which slows me down, or wait for page loads longer than usual. Review collected by and hosted on G2.com.

I like Drata's interface and the ease of usage. It's great that it updates automatically when something needs fixing, so I don't have to worry about manual interventions. Compared to other tools, it gives me a sense of knowing exactly what to expect and how things will work. Also, the integrations are pretty good, even though there's room for more apps to be added. Great policy templats. Review collected by and hosted on G2.com.

Lack of integrations and maybe a little bit of lack of comprehensive rules regarding for example systems that should not be included / scanned. It doesnt use most secure way of connecting applications via OIDC / workload identity systems. There was a lack of ability to import evidence from other vendors, so we had to do a lot of stuff manually. Review collected by and hosted on G2.com.

I find Drata quite intuitive to use, and I appreciate that it has a lot of built-in integrations along with the ability to build custom ones for the things that are missing. The quick support and the good template library also stand out to me. The initial setup was quite easy and intuitive as well, and I found the documentation to be pretty good. Review collected by and hosted on G2.com.

The policy editor isn't great and could use better formatting options. There are generally bugs in the system and there's absent functionality, like the inability to download all policies regardless of their status. Controls aren't automatically mapped to the ISO framework, and having an internal mapping would make things easier. Support availability in the APAC timezone is missing. I'd also like the ability to export data sets from all views based on selection or all of it. Review collected by and hosted on G2.com.

Comes with a Drata Trust Center that's relatively easy to manage. That's pretty much the only thing that hasn't broken on me this past year. Review collected by and hosted on G2.com.

Drata seems to have major breakage on what seems to be a monthly basis.

- MDM integration is currently broken

- Audit hub messages from auditors are currently broken

- Using a custom framework, only your auditors can create the controls (and control mappings in the audit hub vs what's in your view of the custom framework are not kept in sync)

I've reached the point where I'm running audits outside of Drata because Drata is so broken.

Customer Service seems to have taken a major step back in quality. I've been advised at least twice to make dangerous changes that each time broke my Drata instance (Google, HRIS). Review collected by and hosted on G2.com.