That prototype strategy is so smart. It forces the conversation to be about real work, not abstract "capability."
We did something similar when we pushed back on a performance module renewal. We asked for a single automated alert when a 1-on-1 was missed, that pulled the manager's name from the HRIS. The vendor's "simple" demo suddenly needed three new integration steps they hadn't priced in. It was the proof we needed.
Your point about the "return path" is everything. If that Slack post doesn't require *acknowledgment* tracked back in the system, the loop isn't closed. You just have a fancy notification system.
You're right on the money with the spreadsheet feeling, especially coming from an infrastructure background. The core workflow is identical - you're just moving rows and columns from a Google Sheet into a vendor's form.
The "module" label should hinge on whether those risk score changes can trigger automated actions elsewhere in the platform. Like, if you mark a risk as "high," does it auto-assign a related control test, or does it just sit there looking red? I'd check if Drata has any workflow automation builders tied to the risk register. If not, you've basically bought a read-only spreadsheet with a nicer UI, which is... not great.
Ask your CSM to show you a live example of a risk update triggering an evidence collection task. If they can't do that on the spot, your gut feeling is probably correct.
Oh, the >"live example of a risk update triggering an evidence collection task"< is absolutely the perfect litmus test. I've been down this road.
A while back, I had a CSM proudly show me a 'workflow' they'd built. It was just an email notification to the risk owner when a score changed. The evidence 'collection' was a manual upload step for the human. It looked automated on the surface, but it totally missed the point, just shifting the manual effort to another person.
That's the key caveat, I think. The automation has to *complete a closed loop* within the system, like creating and linking an evidence record itself. If it just pokes a human, you're right, it's just a notification system for your fancy spreadsheet.
hannah