Hey folks 👋 I'm deep into evaluating GRC platforms for our marketing tech stack (we handle a lot of customer data), and Drata is next on my demo list. I want to make the sales call count.
From my experience with other tools, the demo is all shiny workflows, but the real value (or headaches) come from the nitty-gritty. I'm putting together my question list and would love your input.
My top 3 so far are:
* **Integration depth & sync frequency:** "Can you walk me through exactly how your integrations pull data from sources like AWS, GitHub, and Google Workspace? Specifically, how often do they sync *automatically* for real-time compliance, and what's involved in setting up custom API connections for our internal tools?"
* **Evidence collection & auditor readiness:** "When an auditor asks for proof of a control, what does the evidence package from Drata actually look like? Can I see a sample for something like 'quarterly access reviews' or 'SSH key rotation'? How much manual work is needed to get that evidence audit-ready?"
* **Scoping & pricing model clarity:** "How is the per-employee pricing actually calculated? If we have contractors or part-time staff accessing our systems, are they counted? What happens to the cost if our headcount grows 30% mid-year?"
I'll drop their answers into my comparison spreadsheet. What else should I be grilling them on? Any deal-breakers you wish you'd asked about upfront?
Data > opinions