Drata

Type: company (compliance-automation vendor extending into AI-agent governance) Sector: SOC 2 / ISO compliance-automation platform, now positioning into AI-agent governance and evidence First seen: 2026-08-05 (Black Hat vendor round-up) Last updated: 2026-08-14

Created 2026-08-14 from S-2026-08-04-drata-ai-agent-governance and S-2026-08-05-blackhat-agent-governance-cluster (page-creation trigger: second source on the company).

Snapshot

Drata is a compliance-automation vendor (SOC 2 / ISO evidence collection heritage) that put AI Agent Governance into Limited Availability on 4 August 2026 — a device-level sensor plus an MCP-proxy control point that discovers and governs internal AI agents [S-2026-08-04-drata-ai-agent-governance]. It matters to this wiki as a fourth claimant category (alongside AI-governance platforms, SecOps and identity vendors) to the AI-agent inventory and enforcement layer, and as the only vendor captured this week naming specific regulatory frameworks (EU AI Act, ISO/IEC 42001, AIUC-1) in its own release rather than leaving the mapping to wiki inference [S-2026-08-04-drata-ai-agent-governance].

Positions / Claims they advance

• Explicit regulatory-framework mapping in the primary release: AI Agent Governance is positioned to “map to the same controls and evidence logic that already power compliance programs” against the EU AI Act, AIUC-1 and ISO 42001, and is framed against “EU AI Act enforcement beginning earlier this week” (early Aug 2026) — a control-mapping claim, not a conformity assessment, with no auditor acceptance cited [S-2026-08-04-drata-ai-agent-governance].
• Pre-execution enforcement architecture: a background Drata Sensor watches desktop/browser AI and local models; an MCP Proxy sits “at the point every agent’s tool call passes through” and evaluates each request against policy; policy is authored as plain-English intent, compiled to machine-enforceable rules, and “enforced inline so a violating action is stopped before it executes”, simulated against a year of historical traffic beforehand (“zero false-positive risk” is vendor marketing, unverified) [S-2026-08-04-drata-ai-agent-governance].
• Evidence artefact: on-device-masked telemetry feeds a durable, tamper-evident evidence feed, with per-action logs and per-agent trust scores as the claimed output — retention period, immutability mechanism, exportability and auditor acceptability are all unspecified [S-2026-08-04-drata-ai-agent-governance].
• “Discover, monitor, govern, and prove traceability” of internal AI agents was the framing at initial Black Hat disclosure (5 Aug secondary digest, later superseded by the fetched primary release) [S-2026-08-05-blackhat-agent-governance-cluster].
• Scope and customer base: ships first for Anthropic agents, with OpenAI/Vertex/Bedrock coverage “in active development” — leaving mixed-provider FS estates only partially covered. The only named customer is Sonatus (automotive software, non-FS); no EU/UK regulated-FS reference is named [S-2026-08-04-drata-ai-agent-governance].

Relationships

• relates-to → AI Governance Platforms — fourth claimant category (compliance automation) to the AI-agent inventory and pre-execution enforcement locus, and the only vendor this week naming specific regulatory frameworks in its own release [S-2026-08-04-drata-ai-agent-governance].
• relates-to → EU AI Act — explicit (vendor-asserted) control-mapping claim against EU AI Act enforcement obligations; not an independently verified conformity claim [S-2026-08-04-drata-ai-agent-governance].

Tracked changes

• 2026-08-04 — AI Agent Governance announced at Limited Availability: Drata Sensor, MCP Proxy inline pre-execution enforcement, tamper-evident evidence feed; explicit EU AI Act / ISO 42001 / AIUC-1 framing; Anthropic-first scope; Sonatus named as sole (non-FS) customer [S-2026-08-04-drata-ai-agent-governance].

Open Questions

• What retention period, immutability mechanism and export format does the tamper-evident evidence feed use, and would it satisfy EU AI Act Art. 12 / SS1/23-grade record-keeping in an examination? (Unspecified by the vendor.) [S-2026-08-04-drata-ai-agent-governance]
• When will OpenAI/Vertex/Bedrock coverage ship, and does the Anthropic-first sequencing leave a material gap for FS estates running mixed model providers? [S-2026-08-04-drata-ai-agent-governance]
• Is there any named EU/UK regulated-FS production deployment? (None named in any source to date; Sonatus is the only named customer and is non-FS.) [S-2026-08-04-drata-ai-agent-governance]

Sources

• [S-2026-08-04-drata-ai-agent-governance] → S-2026-08-04-drata-ai-agent-governance — primary Drata press release, fetched in full (medium authority; primary, self-interested; capability and regulatory-mapping claims vendor-asserted, unverified).
• [S-2026-08-05-blackhat-agent-governance-cluster] → S-2026-08-05-blackhat-agent-governance-cluster — SecurityWeek Black Hat USA 2026 vendor round-up (medium authority for the announcement, low for capability detail; digest paraphrase, superseded for Drata by the primary release above).