Name: Stuart Wilson, Drata
Uploaded: 2024-11-02T01:47:00.000Z
Duration: 15 min 19 s

Clips
More from theCUBE + NYSE Wired present the East Coast AI Leaders Executive Series

Stuart Wilson

Builder

Reevo

play_circle_outline Continuous compliance and automation in managing security reports

play_circle_outline Leveraging AI for Security Questionnaire Automation

Info
Transcript

Stuart Wilson, Drata

Stuart Wilson

Builder Reevo

TheCUBE is covering an event at the New York Stock Exchange with Stuart Wilson, VP of Operations at Drata. Drata is a security compliance automation platform, helping GRC teams manage compliance programs in one place, from collecting evidence to monitoring controls. They are a SaaS platform hosted on AWS, with over 5,000 customers globally.

The discussion focuses on the importance of compliance in the rapidly evolving AI and security landscape. Drata automates compliance, providing a seamless experience for customers to ensure ongoing compliance ag... Read more

explore Keep Exploring

What is one way to ensure that your company remains up to date with constantly evolving regulations and frameworks? add

What framework can help an organization stay compliant when using AI, and how are tools like Security Questionnaire Automation being leveraged for product and customer compliance? add

bolt Powered by CUBE AI

Stuart Wilson, Drata

>> Welcome back everyone to theCUBE's coverage here in New York City at the New York Stock Exchange. The Cube East, our studio on the east coast. Opening up a new presence here, slowly rolling it up, getting ramped up, soon to be full-time in 2025. You'll see a lot more coverage. Certainly a lot of local action, local founders, company businesses, AI is the top story. Of course, the technology wave is up and down the stack from semiconductors all the way to the top. Of course, Silicon Valley is where our home is and Boston so connecting Silicon Valley and Wall Street together is what we're going to do. We've got Stuart Wilson here, VP of Operations at Drata. Great to have you.

Stuart Wilson

>> Nice to be here.

>> Thanks for coming on. You were waiting out in the hallway. You missed your time, but back in. Wall-to-wall coverage on Wall Street. This is where it's at. IPO today, big day today.

Stuart Wilson

>> Yeah, seriously. Glad to be here.

>> Talk about what you guys do. Set the table. Take a minute to explain the company mission, vision, what you guys are, status of the company, size.

Stuart Wilson

>> Yeah, absolutely. So Drata is a security compliance automation platform in a one-line summary. Ultimately what we do is we help our GRC teams to manage their compliance programs in one place. Everything from collecting the evidence and monitoring their controls that are important for their business, and providing an end-to-end compliance experience to ensure that they're ultimately ready for their audit and whatever those audits may be.

>> Are you guys a SaaS platform? Do you load software on servers at a data center? What is the consumption piece of the technology?

Stuart Wilson

>> Yes, so we are a software as a service platform, annual licensing fees is primarily our business model.

>> Which cloud are you guys hosting on?

Stuart Wilson

>> AWS.

>> Cool, so you're part of the startup program there?

Stuart Wilson

>> We are.

>> Okay. How big is the company?

Stuart Wilson

>> We're about 500 employees. Grew about a hundred percent year-over-year last year. We're over 5,000 customers globally.

>> Not a small company, not a startup. Certainly growing here in the global partner program. Not the global startup program for AWS. Okay, so you got a lot of customers. I mean, this is something that David and I always talk about compliance all the time. With this AI wave, governance is the huge conversation of which compliance is part of. With AI, the number one conversation that comes up, certainly in the security field is, okay, I need to explain things. I need AI to write reports. Okay, check, we've done that. It's not poetry, it's reports. Okay, productivity gain, check. But now you've got to have traceability and not lineage, but actually explainability of data supply chain so that becomes a big conversation we're hearing. Then never mind all the other checks and balances that are needed on security compliance, SOC reports, pen tests. I mean, scope the compliance problem opportunity for me, because I mean, I'm just looking at the security side and see huge, never mind other regulated industries. You've got 5,000 customers, what's the aperture scope? The landscape.

Stuart Wilson

>> Yeah, and so are you asking how big is the compliance space as a whole or more around-

>> No, What are the core issues around what qualifies as compliance? Give me some examples of how large the nuances are. There's five zillion things we got to manage over here. I mean, I don't know. I mean I know security and I know some data center and cloud stuff, but what's beyond that?

Stuart Wilson

>> How I think about it is you've got security and that's detecting anomalies, actually remediating those issues, making sure your environment's actually secure. Then you've got the compliance side of it and the compliance is making sure that across these important frameworks, SOC 2, GDPR, ISO, HIPAA, et cetera, that you are maintaining compliance against those standards that are readily acceptable by customers who want to work with you. That's kind of the scope in which I would say compliance falls in.

>> What are you guys targeting? You guys have a specific industry that you guys are targeting?

Stuart Wilson

>> Yeah, I mean theoretically it's any customer out there. Anyone who handles customer data or personally unenviable information is going to need to be compliant in some form or fashion at some point. We've got customers on the small end all the way to some of the biggest companies out there and across the world.

>> We have a great startup coming in here talking about small language models, SLMs, which we've been using that word and we have a new research coming out on Causal AI, which is around, okay, what's the causation of this? You started getting beyond the reasoning, beyond the reinforced learning. It's like, okay, this causation's next best action, those kinds of things. One of the things that comes up all the time is S doesn't stand for small anymore. It stands for security, sovereignty. You have now a data problem now when you start having all this new data being thrown off because you're consuming data, you're getting more data, so there's more data coming in. It's always been that way, but now you have other issues emerging. What's your reaction to that? Do you guys see a clear line of sight of things that you're looking at right now that's different post-gen AI launch?

Stuart Wilson

>> Yeah, it's a good question. I would say new problems are rising all the time with AI. We've got people inside your organization who want to leverage ChatGPT or whatever it may be. You've got companies who want to use it across their different departments for different use cases. I think we're still in the early innings of what are the compliance standards and what are the right frameworks by which you can regulate the use of AI in organization. NIST AI RMF is a framework that recently came out that we support on our platform for framework compliance for those who want to use AI in their organization as just one example.

>> Do you guys deal with encryption and security compliance?

Stuart Wilson

>> Pardon me?

>> Do you deal with encryption and security compliance issues?

Stuart Wilson

>> Absolutely. I mean, that's a lot of the requirements against some of these framework standards. Is your data encrypted at rest? Do you have two factor authentication across your employee base? Pulling in that information to maintain or to ensure that you're compliant on an ongoing basis is a big valuable platform like Drata.

>> Okay, so let's back up and zoom out for a second because it sounds like you got a good view of the compliance landscape.

Stuart Wilson

>> I try.

>> How does a customer consume the product? Take us through the life of a customer deployment. How do they get started? What's the engagement look like? What's the couple of things they do out of the gate? Then how does that render itself? Do they take all compliance? Do they start chipping away at it? I mean, take us through some of the engagement deployment.

Stuart Wilson

>> That's a really good question. I think it depends on the type of customer you're talking to. You've got some customers who don't even have a GRC program. They don't even need where to start. That's kind of like the SOC 2 in a box, help me just figure this out. Then you've got some who are established GRC programs. They've got SOC 2, they've got all these frameworks, but they're doing it all manually. For those customers, it's about how do we chip away at that workflow? How do we automate a lot of the things that are looking and in fact improve upon it from the standards that they didn't even know were available to them? Then for the earlier customers, it's how do we get them set up with confidence? The analogy I like to use is, let's say you're taking a test and there's two ways you can pass the test. You can get an A+ or you can get a C+, but either way you pass it. So with Drata, we want to make sure that you have the tools and the confidence and the trust in us to know that you can get an A+ should you seek that out.

>> Or it's the same test with different answers every time, but the teacher doesn't know the answers are the same so you just cut and paste the old report and put it in. I mean, this manual report thing is a big deal. I want to get your thoughts on this because I've seen this a lot where the agility wave of the cloud came in. A lot of the compliance tests were inadequate. They were driven for data centers, not for cloud so a SOC report today is good, and then I just pushed new code yesterday, now I got to do it again. So I've seen, I've heard from a friend that people just cut and paste the previous report and submit it and roll the dice.

Stuart Wilson

>> I wouldn't recommend that.

>> But that's just the labor problem. This sounds like you guys take care or that.

Stuart Wilson

>> The reality is, I imagine where you're hearing that are large organizations are ones who have a diverse customer array, where they're in different regions and different sectors, different verticals, and there are a lot of frameworks you need to comply with. It's just a lot of manual work. With a platform like Drata, we're constantly updating those requirements so as those regulations get updated, we make sure that that's represented in the platform so you're always up to date in an ongoing way. One way that I like to think about the evolution of the space is wave one you had everyone was Wild West. You didn't have established frameworks or requirements. Then you had SOC 2 in the world that came out, you move into wave two, and you got this done every year once. That's a finite period of time. What are you doing for the rest of the nine months of the year that you haven't gone through an auto process? Now we're in wave three of continuous compliance.

>> Yeah. Of your 5,000 customers, what's the pattern around, okay, I got changes to my topology. I mean Gen AI is just another application. AppSec review is coming, but it's always on it because it's generating something new every time. How do you manage the compliance on that? Is that something where there's auto, is automation involved? I can see other areas where obviously the workflows can be obviously the same. Nothing changed so everything's good. Observability comes in. Okay, test all that.

Stuart Wilson

>> Yeah, and rephrasing the question, are you asking how do we leverage AI within our product to suit our customers?

>> Yeah, how do you guys handle the generative aspect of AI because Gen AI is just another app feature. It's just AppSec application review. I mean, Amazon calls AppSec review, so hey, a new app, so you got to put it through the paces. Go to the airport, you get that TSA pre and clear, you go right through or you stand in line, take your shoes off and belt and put your laptop on the tray. I mean, one's better than the other. I mean, I just want to get on the plane. I don't really go on an extend line.

Stuart Wilson

>> No, you're totally right.

>> But that's what it's like to go through these reviews.

Stuart Wilson

>> Yeah, so the use of AI within an organization, there are frameworks that help you stay compliant, that's NIST AI RMF that I had just mentioned before. How we're leveraging those tools for our product and for our customers would be a relatively new product called Security Questionnaire Automation. A lot of these GRC teams, they're constantly answering those questions. They're giving out those questions and so that is a laborious process, but the answers to those questions can largely be satisfied by the knowledge repository you have in your database and the requirements that are built in the platform so we can automate the answers to those questions.

>> How would you explain the core value problem? What's the main benefit of your solution for the customer? What do they get out of what's in it for them?

Stuart Wilson

>> In one word, automation. Confidence in the automation and compliance of your program all in one place.

>> What technical implementations needed to do that?

Stuart Wilson

>> Well, so it varies on the customer, but depending on your infrastructure stack, we ingest and we have over a hundred plus integrations that we work with and growing every single day. We'll constantly pull in that information so that we can satisfy the requirements across this framework that you're looking for, so it really varies.

>> The way you guys are organized, you have an implementation team, so I mean you guys got to integrate.

Stuart Wilson

>> Well, we do.

>> Intentionally with the customer.

Stuart Wilson

>> Yes. We have an incredible customer organization and we have a number of different teams from customer support to compliance advisor.

>> I'm sure they're welcoming you with open arms. I mean, it sounds like, it's not frictionless, but at least once someone says, okay, I get it. You're going to set me up for compliance reporting, client integrations, forward the data. I need to minimize what I know is disruption and bunch of muck that I got to deal with.

Stuart Wilson

>> We want to create that frictionless experience. It goes back to the example I gave before. You can pass a test with a C+ or an A+. We want to make sure we've got the platform support so you can get that A+ every time.

>> Or not take the same test multiple times.

Stuart Wilson

>> That too.

>> And not know the answers either time.

Stuart Wilson

>> Exactly.

>> Well, I mean this is the key. I mean, I've seen people complain about how their time's being pulled away from their project because some other department needs them to answer something on their side of the test. Now not only take your test analogy, the person taking the test has to go to ask a friend, interrupt his life and saying, help me answer this question. I don't know what to say.

Stuart Wilson

>> A lot of what you see today are companies that have to go to their engineering team and they have to go get screenshots of different parts of the infrastructure stacked in order to satisfy the requirements, but we can adjust all of that now, especially in an increasingly cloud-native world where we can satisfy all those requirements automatically. We can automate the screenshot taking, if you will, of those.

>> You got instrumentation in place on the integrations, so that's all current so as these reports come out, someone's doing a big sales deal. Hey, I love your product, you got to fill out this report. There's no lag between turning that sales and we just go, boom, there it is.

Stuart Wilson

>> Going back to what we were talking about earlier, now we're kind of in what I'll call wave three of compliance industry where ongoing compliance is important. That's where trust center and establishing that for others to be able to review.

>> You kind of printed money basically business.

Stuart Wilson

>> Business is good.

>> Business is good. What are you guys looking for now? You guys need more go to market, more engineers? What's the core business model? What are you guys looking to do now? Put a quick plug in for folks watching, because you got a great business model. You take away the pain and give people freedom and use to solve a lot of problems.

Stuart Wilson

>> Well, we got a lot of fun stuff that we're working on right now. I would say in three areas it's doubling down on the product and we're maniacally focused on that customer experience and what those teams need. It's doubling down on the customer experience and making sure, to your point, you're set up for success and there's that frictionless experience for smaller customers, but also for the larger ones. Sophisticated workflows tie into that as well for some of our larger businesses. Then supporting customers internationally as well. Majority of our customers are domestic today, but we have customers in over 50 other countries and we want to support them in a more dedicated fashion.

>> I mean, your only objection of the way I see it is that the getting over the bar of, okay, you're legit. How much time and effort do I need to invest to get the value proposition locked in? I mean, I'm sure all the personas love you. The CFO loves you because the risk management piece, the people who are taking the pain away, they love you.

Stuart Wilson

>> Third party risk management is a big piece of our product platform, that's right.

>> The people and the jobs like it because it's one click. I got an agent taking my test for me gets A+ every time. Why not? Why not do that? Who needs school?

Stuart Wilson

>> Another thing about that too is go to market teams love it as well. If you think about some of the smaller-

>> Sales close.

Stuart Wilson

>> What takes a big chunk of the time and security in a sales cycle is the security review process. If that would've otherwise, if you could shrink that down by 75% because you're able to answer those questions in a more automated fashion or a more thoughtful way, it gives you confidence. You're able to shrink that time down and drive that value so you get faster sales cycle times.

>> What's the revenue model? How do you guys charge? You don't have to say the price, but if you want to say it, you can say it. Are you whale hunting in terms of the go-to-market? Do you have an onboard bottoms-up? Is it top-down? Obviously you have good stakeholder targets, all of you, but it's a buy the drink? Is there a professional services?

Stuart Wilson

>> Short answer is a little bit of all the above. I would say it's a mix of inbound and outbound motion from a pipeline perspective. We have a variety of different price points that suit our customers needs that align that value as closely as possible and it's all subscription basis.

>> Where's HQ? New York?

Stuart Wilson

>> San Diego actually.

>> San Diego, okay good. You're in California.

Stuart Wilson

>> We've got about 500 plus employees all across the US and the world now.

>> Yeah. Cool. Well, thanks for coming on theCUBE. Appreciate it.

Stuart Wilson

>> Yeah, absolutely.

>> Put a commercial out there. Give the final 30 seconds, give the pitch.

Stuart Wilson

>> Yeah. If you're looking to manage your compliance program seamlessly and effectively in all in one place and automation is something that you value, then you should come talk to us, drata.com. We'd love to hear from you.

>> Yeah, another great example of a workflow. Domain expertise are needed. Automation, trust, delegation. Getting those loops closed, but also manage and turning them to value. This is theCUBE. We're doing our part from day three of Media week. I'm John Furrier, host of theCUBE. Here at the NYSC, our new East Coast location in Silicon Valley and Wall Street. Thanks for watching.

Stuart Wilson

>> Thank you.