Drata vs QL Security

Drata is a compliance automation and governance, risk and compliance (GRC) platform founded in 2020. Its about page lists offices in San Francisco, New York, San Diego, London and Sydney. It says more than 8,500 organizations use it, and it reported about $100 million in annual recurring revenue in February 2025. Its last disclosed round was a $200 million Series C co-led by ICONIQ Growth and GGV Capital in December 2022 at a $2 billion valuation, which took total funding past $328 million. It bought Harmonize.io and oak9 in 2024 and the trust center company SafeBase for $250 million in February 2025. The platform offers more than 30 pre-built frameworks with continuous control monitoring, automated evidence collection, policies, risk management, third-party risk management with agent-based assessments, and a Trust Center built on SafeBase. Its AI features include questionnaire assistance, mapping policies to controls, explanations of failed tests and an MCP server. More than 175 audit firms are in its Audit Alliance. **AI compliance coverage** Drata has framework pages for ISO/IEC 42001, which maps the standard's requirements to its control library and links AI-specific risks to controls, and for the NIST AI RMF, supported since December 2023. It also lists AIUC-1. The EU AI Act is not in its framework list; the Act is mentioned only for AI Agent Governance, a limited-availability product announced in August 2026 that enforces policy on AI agents and maps to ISO 42001, the EU AI Act and AIUC-1. **Who it's for** Growth-stage and enterprise companies running SOC 2, ISO 27001 and similar programs that want ISO 42001 or the NIST AI RMF on the same platform. It is not a model testing or LLM content filtering tool.

QL Security is a UK-based consultancy providing AI security, governance, compliance, assurance, and ISO/IEC 42001 implementation support for organisations managing AI risk. Services are delivered as an advisory engagement rather than a SaaS product.