Drata vs Lasso Security

Drata is a compliance automation and governance, risk and compliance (GRC) platform founded in 2020. Its about page lists offices in San Francisco, New York, San Diego, London and Sydney. It says more than 8,500 organizations use it, and it reported about $100 million in annual recurring revenue in February 2025. Its last disclosed round was a $200 million Series C co-led by ICONIQ Growth and GGV Capital in December 2022 at a $2 billion valuation, which took total funding past $328 million. It bought Harmonize.io and oak9 in 2024 and the trust center company SafeBase for $250 million in February 2025. The platform offers more than 30 pre-built frameworks with continuous control monitoring, automated evidence collection, policies, risk management, third-party risk management with agent-based assessments, and a Trust Center built on SafeBase. Its AI features include questionnaire assistance, mapping policies to controls, explanations of failed tests and an MCP server. More than 175 audit firms are in its Audit Alliance. **AI compliance coverage** Drata has framework pages for ISO/IEC 42001, which maps the standard's requirements to its control library and links AI-specific risks to controls, and for the NIST AI RMF, supported since December 2023. It also lists AIUC-1. The EU AI Act is not in its framework list; the Act is mentioned only for AI Agent Governance, a limited-availability product announced in August 2026 that enforces policy on AI agents and maps to ISO 42001, the EU AI Act and AIUC-1. **Who it's for** Growth-stage and enterprise companies running SOC 2, ISO 27001 and similar programs that want ISO 42001 or the NIST AI RMF on the same platform. It is not a model testing or LLM content filtering tool.

Lasso Security provides an AI Security Platform that delivers visibility, control, and protection across AI models, agents, and applications for enterprises. The platform inventories AI assets including agents, models, prompts, tools, and guardrails via discovery and AI-BOM features. It offers AI Security Posture Management for misconfigurations, supply chain risks, and alignment with NIST and OWASP frameworks. Automated red teaming uses a library of over 3,000 attacks covering OWASP Top 10 and agentic threats like context poisoning. Runtime enforcement provides zero-latency decisions with remediation guidance, while AI Detection & Response leverages MITRE and OWASP for threat detection with 98.6% accuracy and sub-50ms latency, including intent analysis for anomalies. Lasso targets enterprises adopting GenAI, particularly regulated sectors, enabling secure innovation through real-time risk reduction, governance, and compliance support. The platform maps to frameworks like NIST AI RMF, EU AI Act, and ISO/IEC 42001 via runtime policies and audit trails, integrating with tools like Cloudflare and Palo Alto Networks.