G2

Emre Utku S.

Chief Information Officer

Small-Business (50 or fewer emp.)

8/7/2026

"Great framework for information security audits and overall compliance"

4.5/5

What do you like best about Drata?

I like the thoughtfully designed UI, the AI chatbot, and the relatively fast human support. The integrations with other tools still have room for improvement, but overall, it’s been a better experience than some competitors. I also appreciate Drata Autopilot and how easy it is to quickly test integrations to confirm their capabilities and performance. Review collected by and hosted on G2.com.

What do you dislike about Drata?

There are some limitations in how the integrations are designed. With certain tools, the integrations leave you with very little control, and the available capabilities remain fairly high-level. In most cases, though, they make up for that with support.

That said, I think the scope of onboarding and the accelerator program is also too high-level. They help you collect some standard documents and fill in general fields in your Drata setup, but those aren’t the real pain points. They also provide generic policy templates. If you have zero policies in your business, you could try to implement what’s in those templates as your policies. However, if you already have policies in place, there’s little value in the provided templates.

If they took the time to understand your business and your current state, and then helped you align your existing policies with the requirements, that would make for a much better accelerator program experience. Overall, Drata is a great tool if you already know or understand what you need to do to achieve compliance, and it works well for us. Review collected by and hosted on G2.com.

What problems is Drata solving and how is that benefiting you?

We’re working to comply with information security standards and obtain ISO 27001 certification, and Drata is giving us a solid framework for that journey. It’s been a great starting point and template for managing the entire process. It helped us save weeks of planning for our compliance project, and it will likely save us hundreds of hours over the long run, since most of the things can be managed through the platform—policies, vendor reviews, and other documents that are created once and then kept up to date, automated integrations with our tools (MDM, Infrastructure, HRIS, Identity, Version Control, etc.), annual trainings, and more.

That said, it's not a magic wand that reduces the time required to prepare for a certificate to 100 hours. It depends heavily on your company's compliance posture, and if you're a beginner, it'll likely take months to write your policies, review your vendors, set up your integrations, and remediate failing configurations by redefining your procedures and updating your policies, etc. Review collected by and hosted on G2.com.

Response from Lizzie Higgins of Drata

edit

Hi Emre,

Thank you for sharing such detailed and thoughtful feedback on your experience with Drata. We're thrilled to hear that you appreciate our UI and support mechanisms, both machine and human :) We also think Terrious is the best! Our team appreciates your concerns about integration control and this has been surfaced to the product team. Additionally, our GTM teams have been looped into your feedback about the onboarding process.

Your experience is so valuable to us, and we aim to continuously improve our services to better meet your needs. We're here to support you on your ISO 27001 journey and beyond and to ensure Drata continues to benefit your organization. Keep up the great work!