{"record":"Drata evidence record","url":"https://nexalign.io/vendors/drata","vendor":{"slug":"drata","name":"Drata","domain":"drata.com","category":"grc","categoryLabel":"Governance, risk and compliance"},"lastChecked":"2026-07-18T10:20:34.677Z","coverage":{"earliest":"2026-01-21T14:21:48.000Z","latest":"2026-06-19T22:18:31.813Z"},"terms":{"isRanking":false,"isRating":false,"statesSuitability":false,"note":"This is a record of what public sources hold about a named company. It states no ranking, no rating and no suitability verdict, and none may be derived from it. An absent or small record means the public registers publish little under that name; it is not evidence that a product is secure. A larger advisory count generally reflects wider deployment and more scrutiny rather than a weaker product.","licence":"https://nexalign.io/vendors#licence","corrections":"info@nexalign.io"},"totals":{"evidenceItems":5,"kindsOfSource":3,"attributedAdvisories":0,"knownExploited":0,"registerEntriesNotAttributable":0,"practitionerThreads":0,"independentItems":1,"vendorPublishedItems":0,"shareFromSourcesTheVendorDoesNotControl":1},"sources":[{"source":"Engineering discussions","operator":"Hacker News, public threads","classification":"independent","items":2,"latest":"2026-02-10T21:07:28.000Z"},{"source":"Practitioner discussions","operator":"Reddit, public threads","classification":"independent","items":2,"latest":"2026-02-23T13:45:44.000Z"},{"source":"Analyst, review and reference sources","operator":"Recognised analysts, review marketplaces and technology press","classification":"independent","items":1,"latest":"2026-06-19T22:18:31.813Z"}],"advisories":{"shown":0,"total":0,"truncated":false,"items":[]},"practitionerThreads":{"shown":0,"total":0,"truncated":false,"items":[]},"independentCoverage":{"shown":1,"total":1,"truncated":false,"items":[{"title":"Drata vs. Vanta Comparison 2026 | G2","host":"g2.com","url":"https://www.g2.com/compare/drata-vs-vanta","date":null}]},"vendorPublished":{"shown":0,"total":0,"truncated":false,"items":[]},"openQuestions":["No advisory indexed under the name Drata was found in NVD, the European Vulnerability Database, the CISA catalogue of known exploited vulnerabilities or CERT-Bund. That is not a clean bill of health. Products are frequently registered under a parent brand or a component name.","No public practitioner discussion naming Drata was found in the indexed threads. Operational experience with this product is not represented in this record.","No authoritative source contributes to this record. Everything rests on independent coverage and on Drata's own material.","Pricing, contract terms, notice periods and support commitments are not part of any public register. They come from the vendor and belong in a negotiation record.","Certification status such as ISO 27001, SOC 2 or BSI C5 has to be checked against the current certificate and its stated scope. A valid certificate can still exclude the product being bought."]}