A 1,500-person building materials manufacturer had built two SaaS products its enterprise customers wanted. What those customers also wanted was a SOC 2 attestation, and the company had nothing to show them: no controls, no documentation, no audit history. With an end-of-year audit target and a lean security team starting from scratch, they needed a platform that could handle two separate compliance scopes simultaneously and get them to audit-ready without a consulting firm running the show.
[ The Problem ]
Enterprise customers were asking for SOC 2. The answer was silence.
Two SaaS products. Two distinct compliance scopes. Zero infrastructure to support either. The security leader understood audit requirements intimately from prior experience, but translating that knowledge into repeatable, auditable controls across a hybrid cloud environment was a different problem entirely.
The business consequence was concrete: without SOC 2 attestation, enterprise procurement conversations had a ceiling. Every quarter without certification was a quarter of stalled expansion. A consulting-only path could produce a one-time audit but couldn't deliver the platform-level automation the team needed to operate independently at scale.
[ What they needed ]
The security team needed to simultaneously:
- Stand up compliance infrastructure for two SaaS products from a cold start
- Map controls across separate workspaces for two distinct product entities
- Integrate with a hybrid stack spanning Azure, AWS, Entra, GitHub, Intune, and Jira
- Reach audit readiness by end of year without a large internal compliance team
- Evaluate platform automation against consulting-only and bundled-audit alternatives
- Secure a three-year budget commitment from a cost-conscious leadership team
[ Why Drata won ]
Selected over Vanta, Drata won because five weeks of structured hands-on testing made switching to any untested alternative feel like unnecessary risk.
Workspace architecture for dual-entity compliance: Drata natively supported two separate product scopes within a single platform. Bundled-audit competitors and consulting firms had no equivalent structural answer for a two-product, multi-domain environment.
POC execution created asymmetric familiarity: Drata had the security leader testing the platform within 14 days of discovery. Thoropass was never tested. By the time the internal business case was presented to the CTO, Drata was the known quantity and every alternative carried the risk of starting over.
Auditor independence matched the buyer's practitioner instincts: The security leader's background gave him a clear view of what auditor lock-in costs over time. Drata's model let him choose and change auditors freely, which Thoropass's bundled offering could not match.
Commercial advice aligned with demonstrated capability: Recommending the guided self-service implementation package over the full-service option, after the security leader had proven he could operate the platform independently during the POC, built the kind of credibility that made a three-year commitment feel like a reasonable ask.
[ How Drata solved it ]
Drata's workspace architecture provided native separation for the two product entities, each requiring its own compliance scope, without custom workarounds or duplicate manual effort. That structural fit was the foundation everything else was built on.
Drata's integration layer was validated across the full hybrid stack through five structured proof-of-concept working sessions, covering Microsoft Entra, Azure, AWS, GitHub, Intune, and Jira. Where gaps existed, such as endpoint management via a non-native connector, the team scoped practical workarounds rather than leaving them as open questions.
Drata's auditor-agnostic model matched the security leader's practitioner instincts. He valued the ability to select and change auditors independently, a flexibility that bundled-audit competitors could not offer. The proof-of-concept sessions demonstrated not just that the platform worked, but that a lean team could operate it without ongoing outside support, which directly addressed the self-sufficiency requirement that shaped the entire evaluation.
[ Before and after Drata ]
Before Drata, two SaaS products had no compliance infrastructure and no path to SOC 2 attestation, leaving enterprise expansion conversations without a credible answer. After, both product entities have dedicated compliance workspaces, an audit timeline is in motion, and the security team operates the platform independently without relying on outside consulting for day-to-day compliance work.
[ Business outcome ]
The company entered a 36-month compliance program with a defined SOC 2 audit path, two product workspaces configured, and a managed service partner engaged for implementation guidance. The end-of-year audit target became a scheduled deliverable rather than an aspiration.
The security leader's internal business case, built on three weeks of hands-on platform experience, earned CTO approval for a multi-year commitment. Enterprise conversations that had stalled on the absence of attestation now had a credible timeline to point to. A HIPAA framework expansion is already scoped as the next phase, extending the compliance program to cover the full range of customer requirements.