Hey folks — David here. I've been through a few security compliance platform evaluations (for SOC 2, mainly) and know how overwhelming the initial sales calls can feel. You’re getting feature lists and demos, but the real value comes from asking the right practical questions early on.
Based on my experience with Looker dashboards and data pipelines, I always focus on how the tool actually fits into our team’s daily workflow and tech stack. Here’s what I’d prioritize asking a Drata rep:
1. **How does evidence collection really work for our specific tech stack?**
- Can you walk me through automating evidence pulls from our cloud providers (AWS, GCP), GitHub, and HR systems?
- What’s the manual lift after initial setup, and how do you handle systems that don’t have pre-built integrations?
2. **What’s the true total cost beyond the base subscription?**
- Are there extra costs for additional frameworks (like ISO 27001 or HIPAA) or for adding more users?
- How does pricing scale if our company size doubles in the next year?
3. **How actionable are the dashboards and alerts for non-security team members?**
- Can I easily build and share compliance status dashboards with execs or board members?
- When a control fails, how quickly and clearly does the tool tell my engineers what to fix?
The goal is to move past the marketing and understand the day-to-day operational impact — especially around automation depth, cost predictability, and whether the reporting actually helps everyone stay informed. Good luck with the evaluation
Data doesn't lie, but dashboards sometimes do.