Name: Unveiling Drata’s Latest Agentic AI for Vendor Risk Management
Uploaded: 2025-08-13T17:00:48.643Z
Duration: 23 min
Description: Unveiling Drata’s Latest Agentic AI for Vendor Risk Management

Transcript for "Unveiling Drata’s Latest Agentic AI for Vendor Risk Management": Good morning, everyone. We're just gonna give everybody a few minutes to to join and settle in, and then we'll get started here shortly. Hey, Brian. You are muted. We continue. Oh, I'm sorry. I'll get started. Let's let's do a redo. I thought I was on on mute. Hi, everyone. How are you? Thanks for thanks for joining us. Really appreciate the time. We're gonna have a thirty minutes, thirty minutes together, and we're gonna share and unveil what we talked about at Black Hat. Of course, for those who were there, thanks for spending time with us. It was amazing seeing all of our, you know, prospects and customers. And those who were not, we hope that this is going to be as exciting, to you as it was for everybody that was that was there with us. Can you guys hear me? Looks like we have some Yeah. Okay. We can hear you. Alright. I just saw some chat questions. Alright. We've got we can perfect. Thank you. Awesome. Yes. We've got some exciting things to talk to you about. Just a quick, quick slide for intros. I'm Brian Naomi. I lead product here at Drata. With me today is, Bob and Sean, who leads, AI products here at Drata, and we are super excited to talk to you about our Agintiq AI transformation. Though before we go, too far out, of course, for some of you who may already be familiar with with Drata, you are, already familiar with our journey. But those who aren't, we started our journey I just wanna start with our, mission, which is to be the trust layer between, between great companies. We started our mission, as a, with compliance automation for SOC two and have now grown in the past four and a half years to be a complete trust management platform. And we serve over 8,000 customers globally, including a third of Cloud 100. We've, you know, our trust management platform, we has four primary key pillars, for to to it with, compliance, with compliance, continuous compliance being the first one, which allows customers to continuously, control, continuously monitor and collect evidence across 26 different frameworks, globally. Second is around an integrated risk management capability with vendor risk and internal risk management capabilities, which allows all of you to manage your internal and external risk in one configurable platform and see the your your holistic risk, at one in in one view. And our automated governance capability, which allows you to, you know, scale the risk and compliance programs, with streamlined workflows and, of course, proper oversights across the board. And lastly, our security assurance, which is we we welcome SafeBase into our Drata family, that helps you build trust and turn your security and compliance program into a revenue driver, so that by showcasing your security posture continuously to your customers, prospects, and partners. So, that's a little bit about that's a little bit about Drata, but, and and some of our top news the top customers. And as I mentioned, we have over 8,000 customers, globally with, with with a third of a cloud 100, and, they are leveraging Drata to its full extent. Everything from the continuous compliance, across multiple frameworks that we talked about to ensuring that they are always on audit ready, and operating their program effectively to managing their vendor and and third party risk within Drata. And, of course, taking advantage of security assurance with trust center to build trust faster and make security and compliance into a revenue driver, and, of course, a unified risk management capability to allows customers to understand holistically the risk, to your to their business and be able to communicate that to executives and and board members. Now let's talk about our AI journey. This is this is the exciting part. Hopefully, that gives you a little bit of a perspective on on on Drata if you are not familiar with us, and, what but now we are transforming our trust management platform to an agentic AI trust management platform. We have been on this journey since last year. Some of the capabilities, that you've seen us release within the product, have already are already available to you. But we think about these as three different layers into our AI journey. The first with, with embedding AI to enhance your experience across the board. Some of the capabilities you've seen already is AI powered questionnaire assistance, a AI soft two summary capabilities for vendors, AI vendor questionnaire summary. So when you send out a questionnaire to your vendors, receive answers, we automatically summarize, summarize those. We will be releasing more capabilities like that, for, showing you AI test failures. So you could see a summary of all of your, test failures, AI powered trust library in Safebase so you can quickly search for answers and get a get a condensed response, and so much more capabilities that's coming in to use AI to enhance your experience. The second layer of our AI strategy, it's about AI on demand. So this started for us with what, with our Drata's, MCT server that we introduced, a months back. Now this also gives you ability to really extend the capability of the product outside outside. So for instance, you can now leverage Slack, to ask questions, security questions, and get those responses really quickly. This enables everybody across your team to be able to, get access to information super quickly. But what we're here today to talk about is the next layer of our transformation, which is our agentic AI transformation. And we're starting with three agents that we're gonna be rolling out over the next, few quarters, VRM agent, our trust agent, and our compliance agent. I'm gonna go, in into each one of these into a deep load of details, and then we'll dive into one. VRM agent, it's all about automating the entire, vendor risk management and assessment process for you. We know that is painful. We know the fact that you have to go and grab information from from multiple sources, being able to review these documents, and then assessing the risk to your vendor. That takes an enormous amount of time from every single one of you all who are managing your vendors. Where our when so our VRM agent is going to completely automate that entire workflow for you. Super excited to show you that. We'll we'll come back to this. Next is our trust agent. We understand that we wanna you we wanna use your trust center to, again, continuously build confidence, with your customers, prospects, and partners. So our trust agent will ensure that you, that we orchestrate internal tasks that's required to continuously keep your trust center up to date, recommend updates that you need to make to your trust center in order to make that more of a revenue driver for you, and, of course, continuously answer questions as they come in, internally or externally. The third is our compliance agent. Our compliance agent will help you make sure that your controls are operating effectively, that you have the the evidence and validation of that evidence of, across all of your controls. So you go into your audit, experience with much more confidence that you have everything you need because the compliance agent will not only verify everything that's on the controls, will also alert you of, you know, grifts that happen, with the feed control updates and we'll ensure that all of the gaps are closed for you. So really excited about what we've got coming up with all of these three agents of our VRM agent, our trust agent, and our compliance agent. But now I'm going to turn it to Bobin to show you VRM agent in action. Bobin? Thanks, Brian. Hey, everyone. Really excited to share more about, the VRM agent that we have been working on. Before I go, into the details of VRM agent, let me share a little bit more about, what our journey has been. Let me share my screen. Brian, can you share your screen again, if you don't mind? Oh, I can't hear you. Yeah. Thanks. Yeah. If you don't mind putting it in the presentation mode. Alright. I'm I'm really excited to talk to you more about VRM agent and and walk you through the what it's going to look like. But before I I go into the details, in case if you haven't, if you don't, know what the journey of our BRM product has been, I want to share more about that. We have been really intentional about it. The first chapter was about enabling our customers to centralize their vendors by creating vendor profiles, automating the vendor questionnaires and and providing a comprehensive risk profile of that vendor. This streamlined the process and made the due diligence much easier. In the second phase, we focused on using AI to assist the customers in doing vendor assessment through features like AI driven SOC two summaries and questionnaire summary. This helps them save time and accelerate the reviews. The third chapter which we are really excited about is where we make it fully AI driven end to end, specifically an agentic experience as Brian was just talking about. I'll I'll tell you more about it in the next slide and let me walk you through, as well. So if you go to the next slide, Brian. So as we began our, sharing our vision with our customers, one message came through loud and clear. Start with vendor risk. Every security leader we spoke with said the same thing. They're managing thousands of vendor with limited headcount, and, there is no real way to scale this and assess the risk in real time. And they all acknowledged at at a hard rule. Like, most breaches don't start inside the overalls. They start with a third party. As one sees so put it to us, like, when my board asked if one of the vendors was affected by the latest breach, I can't afford to say I don't know or was I'm still waiting on my team. So vendor reviews today are are broken. They are slow, they are inconsistent, and then they take too long. So teams are stuck, chasing PDFs or documents, parsing self attested questionnaires, and reapplying the same evaluation criteria over and over again. So it's it's just doesn't scale. So we build something smarter, and the next era of trust doesn't really begin with more checklist. It starts with continuous intelligent oversight across your entire extended enterprise, and and that's what we are building, the vendor risk management agent. It's gonna come in q four. So this agent is isn't just a tool, to speed up the checklist. It's a it's a system, an intelligent system that manages the entire vendor evaluation life cycle. So from criteria creation to document collection to risk scoring, a follow-up questionnaire, it it just does it all. Let me, show you how it's gonna work. Right? Brian, if I may take over the screen. Okay. So the day starts as as usual. You can come into our platform in the vendor area, and the AI agent immediately gets to work. It has already, evaluated the vendors that it has been monitoring, and it it identified as a potential security incident that's affecting five, of your vendors. And the primary culprit here is beaconly because of which the rest of the vendors are effect, affected as well. So the system or the agent, highlighted this for you. And as a user, you can dig into more details. It it tells you when the incident happened, the source is the the safe based trust center, essentially, because we have been monitoring the vendor as as they are using the trust center. So we are able to identify the event that happened and highlight, highlight the why. So in in this case, the agent, guides you on what actions you can take as well. So the first one is either you can send a questionnaire to gather more details about the incident. You can activate the incident's response, contact your security team, or, review the vendor access. So it also, recommends that in this case, it's better to send the questionnaire. So as a user, you can go ahead and send the questionnaire. The agent will send the questionnaire, and as soon as the questionnaire is filled out and received back, it will give you the details, as well. So this is while, it's about continuous monitoring with the agent is able to do. One of the things that we hear from our customers and CISOs is the hardest thing is when they have to manage hundreds and thousands of vendors. And they do reviews for this on recurring basis, and it's very, very hard to scale when when you have so many vendors. So that's where the we are an agent that we are developing essentially has a big impact. It automatically does all the work for you, for your existing vendors in the background. So in this case, if you look at these four, it has already kicked off, the review process. So the first one, it has already gathered the documents and run the assessment, on this vendor, and is able, to highlight that there are four updates that you should review. The second one, it has already sent a reminder to the vendor to collect the documents. For the third one, it has already collected the document, is about to start, the evaluation process, and the fourth one, it's it's waiting for a response on the questionnaire that has already sent out. So you can imagine when you have hundreds or thousands of vendors, this can have a really, really big impact because it's saving your team time so they can more focus more on strategic, things to do and focus on the vendors where there is a risk rather than going through the process, for each of these vendors on regular basis. So, expecting this to have a really big impact and help the security teams evaluate the vendors. The third, use case, is around new vendors. When you have a new vendor and you want to do a security review for, these vendors, you can come in and the agent already highlights for you what are the new, vendors it has identified in the system. So you can select these vendors and and with one click, you can start the security review for these, and the agent gets to work. Let's look at what it's doing for the first vendor. So as soon as you start, the the vendor review and kick off the agent, it gets to work. It it realized that this vendor, is in using SafeBase trust center, which make this much easier. It's seamlessly able to collect all the documents from the trust center as well. So it's sending a request to get access to the documents. And as soon as the access is granted, it gets to work. It goes there to then collect all the security documents, It evaluating all the security documents and doing the assessment. So on the left side here, you see that as soon as it starts evaluating, it starts populating the criteria. It's evaluating the status of those criterias and and what the outcome is. So these are the criterias that, as a user, you are able to set up front, actually, and you can do that, based on the type of the vendor and the impact level that this vendor is gonna have. So you can set up criteria for, let's say, for example, a medium, impact level vendor. So every time a vendor which has a medium impact level, the agent knows which criteria it's supposed to evaluate. So in this case, as it went through the assessment, it's able to tell you exactly for each criteria what the status was, whether it was met, unmet, or inconclusive. It's able to provide you the summary and gives you exact granular details on what it evaluated, what matched, and what did not met the criteria essentially. So it's able to provide the rationale, as well. So it's able to do this, in a very detailed way. If you look at the agent interface on the right here, you can say that as soon as it was done, it provided overall summary of what the assessment was. So 10 of the criterias were met, one was not met, and and three of them were inconclusive. So based on this evaluation, it also recommends that, hey. Given the the, impact level of this vendor, you should be creating a follow-up, questionnaire for this vendor to get additional details. So it goes ahead and then creates the follow-up questionnaire or the gap questionnaire and automatically send this out as well. So as you can imagine, a vendor, assessment that used to take days can now be done in minutes with, our PRM agent essentially doing majority of the heavy lifting for you, essentially. And it gives you enough configurability so you can configure what exact criteria you want to evaluate, and it does all the work for you and sends out, the out, follow-up questionnaire if needed, as well. So in this case, it was SafeBase trust center that it, got access to and it was seamless. But in case the vendor that evaluating doesn't use, a SafeBase trust center, not a problem at all. You provide all the documents that you have already received, from the vendor or a questionnaire filled out that you have received from the questionnaire, from the vendor. You can go ahead and and the agent gets to work and evaluates within the document you provided, already, actually. So, irrespective of the vendor being in safe place or not, the agent does the entire assessment, for you. So this as you can see, this could be extremely impactful and save a lot of time for our customers. So can't really wait to get this hands of our customers and see what impact, it's going to have on them. With that, handing it back to you, Brian. You like to mute me? Let me go ahead and share my screen here. Alright. Well, thank you. Thanks, Bhavin. That was, that was pretty awesome. I, there was some some questions in the chat that I answered. We will have time to answer more of your questions, over the coming over the coming days and and and, and and weeks, as we ramp up, and get ready for the for the beta of the of the VRM agent. I do wanna tell you a little bit about, Drataverse, our city tour, that, that will again, we'll share more information about all of these agents, especially the DRM agent, and how it works. We're going to be in San Francisco on September 23, New York, September 25, and then London, October 7. We've got some amazing, featured speakers, of course, from Netflix, CrowdStrike, Notion, and more. Go ahead and register if you haven't registered. So, we'll share a lot more, details. And, and, I know there were questions in chat that we we attempted to answer all of those, but we would love to spend time with you one on one, and, and and and show you even more details of how this works, accounting for multiple scenarios, whether your vendor has a trust center, whether your vendor doesn't have a trust center, whether they whether we are going to send out questionnaires and get those information automatically for you. All of those questions could be answered for you in in in one on one. So go ahead and scan this, and then, reach out to us. We'll we'll be happy to walk you through, the details of every scenario and answer all of your questions. And, of course, get your feedback as we enter the beta phase for this for this agent. I hope you're as excited as we are, about this. We're super excited. Team's working incredibly hard to get this to you, and resolve this this major major pain point. Alright. With that, thanks everyone for your time, and, we'll be in touch soon soon. Thank you.