He Sold a SaaS Vitamin 7 Years Then Found Product-Market Fit

[00:00:00] Omer Khan:

Adam, welcome to the show.

[00:00:01] Adam Markowitz:

Thanks for having me.

[00:00:02] Omer Khan:

It's my pleasure. Do you have a favorite quote that you can share with us?

[00:00:07] Adam Markowitz:

A favorite quote? I'm not a big quote guy, but I do actually have one written on the wall over here. If I could turn my monitor, you'd be able to see it. It says, uh, may you always remember to enjoy the road, especially when it's a hard one. I think it's very appropriate for, for founders, entrepreneurs, um, and it was, uh, Kobe Bryant who actually said Yeah, love it.

[00:00:28] Omer Khan:

That's a good one. So tell us about Drata. What does the product do? Who's it for? And what's the main problem you're helping to solve?

[00:00:37] Adam Markowitz:

Yeah, Drata's a 5-year-old company. It's a trust management platform with multiple products that solve a number of use cases from compliance automation to security assurance and third-party risk management. About 5 years ago when we started, around the— we saw a pretty big problem. We lived the problem ourselves, and it was around how trust, frankly, was being earned and maintained business to business. Trust is foundational to our company, to our vision, our mission. And for me personally, just in life, it's— I would say outside of time, trust is one of our most precious assets. And we saw trust being earned in these point-in-time, take-my-word-for-it type moments, whether it was point-in-time audits, point-in-time questionnaires or assessments between companies. And fundamentally, that felt broken, and we lived that ourselves.

[00:01:29] Adam Markowitz:

And so it's been 5 years of delivering now multiple products within this platform, a trust management platform to help companies earn and maintain trust as they scale.

[00:01:39] Omer Khan:

Great. And give us a sense of the size of the business. Where are you in terms of revenue, customers, size of team?

[00:01:46] Adam Markowitz:

Yeah, about Again, we're turning 5 in a couple of weeks, so it'll be a fun birthday. But over 8,000 global customers now across more than 60 countries. We've got over 600 employees. Those 8,000 customers range from small startups pursuing compliance frameworks like SOC 2 and ISO 27001 for, for the very first time, all the way to the Fortune 100. So it's been a story of rapid hypergrowth for sure over 5 years.

[00:02:15] Omer Khan:

Right. And revenue?

[00:02:16] Adam Markowitz:

We crossed $100 million before our fourth birthday, so almost a year ago.

[00:02:23] Omer Khan:

That's pretty amazing growth.

[00:02:25] Adam Markowitz:

Quite the ride and still very much getting started.

[00:02:28] Omer Khan:

Yeah. And you've raised what, just over, was it $300 million to date?

[00:02:35] Adam Markowitz:

Yeah, just over $300 million over those 5 years. The reason we exist is because you.

[00:02:41] Omer Khan:

Cannot stay ahead of all threats. So what we do is we block by default.

[00:02:45] Adam Markowitz:

If it's not on the list, it cannot run in your environment. And that is our core focus. Zero trust principles. The core of ThreatLocker is zero trust. 24-hour, 365-day-a-year support. We've got some of the most advanced threat intelligence team. And this isn't an outsourced offshore response. It's our staff in our offices helping our clients directly who really understand the product and really understand the threats.

[00:03:09] Omer Khan:

We'll talk about the story of how you built Drata, but you've got an interesting background, very interesting background actually. And so I want to talk a little bit about that because then it will make sense in terms of your previous startup and how that led you to building Drata. But before that, the first question I have for you is like, did you want to be an astronaut when you were a kid?

[00:03:30] Adam Markowitz:

Still do. Yeah. Who doesn't? Yeah, I think I was maybe like 4 years old when I realized that that was a pretty cool dream to have. And yeah, I don't think I've ever truly grown out of it. And that definitely led me down an educational journey in aerospace and astronautics, and now still a side passion of mine.

[00:03:55] Omer Khan:

Yeah, so the reason I asked that is because you worked on the space shuttle project, right? You were working for a contractor who was working with NASA at the time?

[00:04:06] Adam Markowitz:

Yeah, right out of undergrad, I landed my dream job working on NASA's space shuttle program. This is in 2008. And I worked in the program, the main engine team for 3, 3 and a half years, right up until NASA retired the whole program, the space shuttle program. And so that was a dream come true because that Growing up in the '80s, '90s, that was the very program that inspired me to want to be an astronaut in the first place. And so getting a chance to work on it, didn't realize it was going to be the tail end of the program when I started working on it. But, you know, hindsight 20/20, it's incredibly proud that I got the chance to do that. Yeah, really special.

[00:04:48] Omer Khan:

Yeah, because we were talking earlier and I said when I was doing research for this interview, I was like, How does somebody working on the space shuttle go to you building, know, becoming a startup founder? So it's sort of an interesting journey. But before you started Drata, you built and sold another startup called Portfolium, right?

[00:05:11] Adam Markowitz:

Yeah. And know, so, you I, again, growing up, I was on that aerospace track. And so, you know, I talked to other founders who were just like, from the moment they were 4 years old, they wanted to build companies. They wanted to. I just was not ever in my mind. Um, it's almost like an accidental entrepreneur. Um, and so, but there is a kind of a method to the madness here, right? So I landed that dream job working on the space shuttle program, um, by doing something that ultimately became the light bulb moment for starting that company, Portfolium. So I brought a portfolio into my job interviews in 2008 to try to stand out and basically prove everything that an interviewer would find on my resume with evidence.

[00:05:56] Adam Markowitz:

You know, coming out of undergrad, I look around the room and all of the interviewees, myself included, we all took the same classes, we had similar GPAs, we went to great school, and yet we're interviewing for this company. Like, what's going to make me stand out? How can I take that bullet point on the resume and prove it, give you like the assurance that there's more than you just, know, the word leadership on a resume. And so it worked. I landed my dream job, right? I stood out and it was this lightbulb moment that there's something here, there's something to this. And after NASA retired the space shuttle program, I found you myself, know, wanting to take that passion project and turn it into something like a company. And so first had to turn into a product and so learned to code and Enough to be dangerous. And back— this is back in 2013 now, um, so before even there was like coding boot camps and stuff. So a lot of YouTube videos, time on Stack Overflow, and got to a point where I had something that I could put in front of students that was kind of like a LinkedIn centered around an e-portfolio instead of a resume or a profile.

[00:07:03] Adam Markowitz:

I give them the ability to upload and showcase evidence of their skills, so projects, papers, presentations, And that was the initial phase, I guess, the MVP of what ultimately became a company called Portfolium.

[00:07:16] Omer Khan:

What did you build the product with? What was the tech stack?

[00:07:23] Adam Markowitz:

PHP and MySQL.

[00:07:25] Omer Khan:

And you taught yourself how to put—.

[00:07:28] Adam Markowitz:

I have no ego whatsoever, and the code that I was writing back then was held together with, you know, sticks and bubble gum. And so, um, I knew, you know, day one I, I had to obviously find myself a technical co-founder. And I lucked out because I, I was able to join an incubator, a startup incubator program here in San Diego called Evo Nexus, where on the very first day, uh, I met Daniel Marashlian, who ended up becoming our co-founder CTO, and took everything I wrote and rewrote it from scratch, uh, And I think he said he still saved the code somewhere so we could look back on it and laugh one day. But there was a— I think he appreciated, one, the humility to like, you know, know, what I'm building here isn't— this is an MVP, I need to prove this out. And also just the you relentless, know, competitive drive to figure out whatever it was going to take to get this into the hands and prove that I had something here.

[00:08:26] Omer Khan:

The thing with Portfolium is that you eventually went on to sell this business for like $43 million. And you had how many, like over, I had a number somewhere here, but like, what was it like over 5 million students on the platform and you had sold this to a bunch of universities, right?

[00:08:48] Adam Markowitz:

Yeah. And so obviously it was a long journey in a very difficult space, right? Education technology, edtech is notorious for a lot of good reasons. But we— it was a long path of product-market fit for Portfolium. Obviously, I experienced the pain and then a solution, but went through a really interesting process of validating that. And, you know, nothing by the book in terms of, you know, a lean startup or anything like that. In a lot of ways, it was a solution in search of a problem. And it wasn't until we started selling into— partnering with them and selling into universities to where we could really get this into place where it's— I called it even a company rather than just a product because in order to eventually have a business model where we're charging employers to recruit students and recent grads, we had to have millions of students. The chicken or egg problem of a two-sided marketplace.

[00:09:43] Adam Markowitz:

We need that supply. And so just boots on the ground trying to get students to use something like portfolio, we did a decent job. I mean, within, you know, 12 months, we had about 30,000 students, uh, using the platform. It's nowhere near enough. Um, and so we started getting partnering with and selling into universities, um, and learned a lot in that process. But the beauty is the university got to help their students with the— provide them a tool to help them land great careers, um, and also be able to prove that the education they're receiving actually does lead to valuable careers because of the data on the backend allowed them to, at least in aggregate, showcase that where their students are landing great jobs and what industries based on what majors. Um, and so chicken and egg problem was pretty much solved at that point. We sold into over 500 universities in a 2.5-year period, and that then brought in millions of students and recent grads into this network that then jump-started things.

[00:10:39] Omer Khan:

So, so when you started out the, these, well, first of all, you said you went through this really unusual way of to sort of validate the product. Tell me a little bit more about that.

[00:10:51] Adam Markowitz:

Unusual in the sense that, yeah, first time founding, an accidental entrepreneur, hadn't really even read a book or been surrounded by, you know, any other SaaS company doing anything really. And so learning a lot of things the hard way, unfortunately, but it served us well going forward. I was obsessed with iterating on that user experience, the actual student in this case. It was a free product for them. And so getting in the room with them and letting them tell me what they want and how they want it and then quickly delivering, like, there was great lessons in all of that. So that by the time we actually had a sustainable business model selling into universities, we got to show the university before we even sold them anything that, hey, your students are already using this. And What other edtech product can say that on the very first— in the very first meeting showcase the fact that you're not going to have to really push your students into this? They're already using it. So we're just going to increase that adoption by actually partnering and making it official.

[00:11:55] Adam Markowitz:

But that was, again, a very, very long path versus had we just started from day one saying this is an edtech company, we're going to go and sell this to these universities, like that would have been very different. I don't know if it would have been better. Frankly, when I look back on it, only because I do think the, the beauty was in that iterative process in the beginning, working with students even though they weren't the buyer, if that makes sense.

[00:12:15] Omer Khan:

Yeah, yeah. So what was the business model like? What were the universities paying for if this product is already available free to students?

[00:12:26] Adam Markowitz:

And so we layered on top of this just kind of social professional network where the students got this value and we're connecting with employers and showcasing their skills. Universities historically had adopted ePortfolios to do learning outcomes assessment for accreditation purposes. So that was all of a sudden a true need that universities had. And so we layered on tooling that allowed the universities to do that and do it in a much more efficient way. And so there was now real tangible benefit, real ROI for the university, not just in helping their students land jobs and being able to report on that. That was great. But there wasn't like know, a, you a line item in the budget for something like that. There definitely was for learning outcomes assessment.

[00:13:08] Adam Markowitz:

Again, historically, that's why they would adopt something like an ePortfolio. So there was some explaining to do as to, hey, yes, this is an ePortfolio to do that, but it's also an ePortfolio to help your students launch their careers. And so by bringing both those together, it definitely helped us differentiate and became part of how we sold.

[00:13:26] Omer Khan:

I've talked to several founders who are in the edtech space, and one thing that they all share is the complaints about trying to sell to universities, whether it's trying to figure out how to figure out who the ideal buyer is, who has the budget, the long sales cycles. When you look back at your experience, what's one thing that you learned from that that if you had known when you started out might have made things a little easier?

[00:14:00] Adam Markowitz:

It's a good question. Like I said, we were 3 years into this journey before we started actually building those learning outcome assessment modules. That's too long. We could have gotten to that realization sooner. That's one thing of like making sure it's tied to like a budgeted line item. Universities, each one has various initiatives. The good thing is they're very— at least the public universities are— it's all public information and it's showcased proudly across their websites and materials, including ownership accountability across different departments in university. And so, you know, grass is always greener.

[00:14:40] Adam Markowitz:

I mean, there's a lot of good things actually about selling into edtech too, like that being one of them. You could— yes, it's a long sales cycle, but understanding what the initiatives are for, for the year, for the that set of years and who's ultimately responsible and is going to care, you start recognizing those patterns. For us, it was, you know, offices of student success started forming more and more across these different universities. I will say the hardest, one of the hardest parts was getting those first, let's say, 5 handful of universities to ultimately become customers, which can be said for any startup, right? Those first customers, typically the hardest. Maybe in edtech more than other you spaces, know, no one wants to be first, but no one wants to be last either. And so there's a bit of a snowball effect once a handful of universities are now on board showcasing evidence of success and then getting on a webinar, providing case studies, success stories. Well, then you get you get that, that flywheel going. But those, those early days were brutal.

[00:15:39] Omer Khan:

So let's, let's talk about Drata. You eventually sold PortfolioM. And I think it was a couple of years, a year or two later before you started Drata. And one of the reasons for it was some of the pains that you experienced at PortfolioM with SOC 2 compliance.

[00:15:58] Adam Markowitz:

Yeah, it's funny. I will say PortfolioM was bought or was acquired. It really wasn't sold. And the difference really just being like, we weren't out trying to sell the company., we were, we finally hit this nice inflection point. We actually had true product market fit, again, millions of students, hundreds of paying universities, and we hadn't even truly unlocked the employer revenue, which was ultimately going to be the real driver. Um, when one of our partners who we were tightly integrated with, a learning management system, Canvas, their parent company Instructure, you know, they basically had a front row seat to the traction and saw the students across all their universities adopting this. And so that was, that was how that ended up happening the way it did and as quickly as it did. But I'll never forget it, you know, selling into universities, trying to get a repeatable motion that wasn't just founder-led sales motion and understanding during these long sales cycles and the various stages of them, one being the security review process.

[00:17:04] Adam Markowitz:

Portfolium, as I said, was a product that helps students prove their skills with evidence. It was a fundamental, you know, core belief in the whole philosophy of the company: earn trust by proving you deserve it. Don't take my word for it. Don't take a bullet point on my resume as the evidence. I'll provide you the actual evidence, right? And so none of us— I mean, myself and the other co-founders— like, we'll never forget when we were selling into the the Cal State University system, the largest 4-year public system in the country, game-changing opportunity on the table to bring in millions of students into this network, or almost a million students, and very long sales cycle. And it was the CIO at the tail end of it who rightfully challenged us and was asking for assurance, evidence of our security posture. These tools can help our students prove their skills. Can you prove your security posture to us? I mean, in those exact words in a meeting.

[00:17:54] Adam Markowitz:

Yeah, because the short answer was no, and that wasn't okay for us. Obviously, it wasn't okay for them either, but it wasn't okay for us knowing, again, full well this is what our whole mission and vision is for, for Portfolium. We have to walk the walk here. We can't just say take our word for it. That goes against everything we, we believe. And so we experienced that problem and then building solutions. One, making sure we have the proper compliance posture so we could prove that we were going to do the right thing by the student data. And then being able to prove that, like, any day of the year.

[00:18:31] Adam Markowitz:

And so we started building tools in-house at Portfolium to help us do that out of necessity, again, because it was core to what we believe. It was going to be core to how we sell into universities and basically prove that we were going to do the things we said we were going to do and should be doing to protect their student data because they were handing over sensitive student data to launch these portfolios for their students. So that, that was obviously one of those light bulb moments that wasn't a light bulb moment in the moment. It was after the fact, after the company was acquired, where now we saw how this large public company at the time was maintaining their own security compliance posture, and it was very manual. We had built tools out of necessity to streamline and automate it. And so that's you know, a year after the acquisition where we kind of picked our heads up and said, you know, this is, this is the same core problem around trust, earning trust or proving you deserve it, obviously in a different space. So that's not just edtech and it's something that every company, especially in a cloud era, needed to prove. So that was, that was the impetus, lived the problem ourselves, had a solution.

[00:19:44] Adam Markowitz:

And it rang true to, again, I'm just core belief system. So it it wasn't, was more of a mission-oriented kind of startup company.

[00:19:51] Omer Khan:

After the acquisition, it was about a year and a half before you founded Drata. You sort of you explained, know, experiencing the pain firsthand and knowing that there was a solution for this. But I don't know anybody who goes through SOC 2 compliance and says, oh, let me do that again. And let me do that as a full-time thing. So what was the, what drove you to say this is the problem that I really want to go and spend the you next, know, 5, 10 years on?

[00:20:29] Adam Markowitz:

Yeah, I mean, the problem, the underlying problem was trust. Like how is trust going to be earned quickly and then maintained continuously? And so it made sense that in our case, a university or other companies' cases, any large enterprise that they're trying to sell their software to, they need— they're taking on risk when they have any vendor that they rely on, that they're sharing data with, which is most vendors these days. And so they needed some minimum bar of assurance, not to say like, hey, you have your SOC 2 report and it's a clean report and therefore you're trustworthy. Not having one, that does actually tell us something. So that's what I mean. It became— we witnessed firsthand it becoming this minimum bar of assurance. And from there, it was only going to get more and more stringent, and rightfully so, because there's more and more data breaches. They were happening more frequently and more costly.

[00:21:23] Adam Markowitz:

And cloud proliferation. I mean, we went from like having 100 vendors at a portfolio to, you know, we had almost 100 on day one at Droda, right? So the, the risk landscape was changing pretty quick. And at the end of the day, we went through our first SOC 2 audit, or just hearing the word audit, it was almost like a, that sounds scary, but it's like, wait, this is just the part where we prove we're doing the things we said we were doing. That's synonymous in our mind with how trust is earned. It's in your actions, not what you say, it's what you do. And so The idea then that that was only being done at a single point in time, like once a year, also didn't feel right. It's like there's tools, we built tools to continuously monitor these very things. So we would sell to a university, it's like, here's your SOC 2, here's your other thing, here's your other thing.

[00:22:13] Adam Markowitz:

And here's a questionnaire that we're going to send you. And every university had their own unique questionnaire, sometimes 300, 400 line questionnaire about asking us security questions. Again, just take our word for it. These answers, like we, we're monitoring the very things that you're asking about continuously, you know, that the trust that could be gained here and maintained, it could be so much stronger. Um, and so that was all the writing was on the wall for, hey, this is where the puck is going. It's something that's, you know, again, outside of time, I think trust is one of our most precious assets. This is what we want to spend. Yeah.

[00:22:48] Adam Markowitz:

Our time waking up every morning and being excited to go solve. And then just talking to other companies, I said we picked our heads up out of edtech. I mean, every company we talked to was experiencing this problem. Big companies, small companies, the earliest stage companies all of a sudden needing to have certain compliance requirements when they're just trying to find product market fit. I mean, it was across the board. Those younger companies just didn't have the experience or resources to do it and was going to slow them down to do it the old-fashioned way. The large companies couldn't keep throwing headcount at something that could be automated. So it wasn't a strategic use of their security team's time to be checking boxes and pushing paper.

[00:23:28] Adam Markowitz:

And so, you know, the hardest part was just saying, okay, this problem is massive, which is great. How do we slice the lowest hanging fruit for product market fit and then evolve from there, iterate from there? And that happened very, very quickly for Drana.

[00:23:47] Omer Khan:

So how did you do that? Because you've lived the pain yourself, you've experienced that, but you still spent some time really trying to deeply understand the problem and figure out where you were going to focus your time, right?

[00:24:00] Adam Markowitz:

Yeah, the first magic part of it was getting the band back together. So same co-founders, same early engineering team, even same early go-to-market team. One, there's a lot of muscle memory of having worked together for 6, 7 years, a lot of trust built up, a lot of resilience, especially coming out of edtech. Sometimes I say like we went from selling a vitamin in edtech, like a nice-to-have, to a painkiller, a need-to-have in SaaS. And so the appreciation from day one and the perspective to know how, how special that was, it was there from the beginning. And that definitely fed our execution loop. So, um, the first step is getting the team back together, not just muscle memory having worked together, but muscle memory having built something like this ourselves in-house, like I said. But lessons learned from the past, you know, cool, I experienced the whole problem of wanting to stand out in my job interviews.

[00:24:56] Adam Markowitz:

That wasn't enough. And so even though we experienced the problem of security assurance, like, we need to validate this. And so we spoke with dozens and dozens of companies that we were friendly with, some that we weren't, we just got connected to, to unpack this problem, make sure, validate it basically. And, you know, every day coming back together as a group and sharing notes across these calls and seeing such obvious patterns. I mean, this is before, you know, Claude or ChatGPT, but you just look at our Google Doc and see it's the same exact words that we're hearing across these conversations. And so got very, very quick granular with where we could cut off the smallest slice to bring something to market and add value and then go from there. And so we literally said on day one, we're going to take an automation-first approach to the C in GRC. So GRC is governance, risk, and It's compliance.

[00:25:47] Adam Markowitz:

a space that's been around for decades. But the lowest-hanging fruit problem that we could solve from our muscle memory and all the conversations was that C. We could automate the compliance piece and then use that as an opportunity to unlock the bigger opportunity around trust. I mean, that that was, was the one-liner automation-first approach to the C and GRC, unlock the bigger opportunity around trust. But we also have the perspective and appreciation of coming off of 6, 7 years in edtech to know that one-liner is great. Sounds good, but it's never going to go. It never goes the way you think it's going to go. And so we were prepared and resilient for the rapid iteration and learning.

[00:26:25] Adam Markowitz:

Would have to happen if we were really going to do this and win.

[00:26:29] Omer Khan:

Is it true that you used Drata or the first version of that product to get yourselves SOC 2 compliant before you sold to your first customer?

[00:26:42] Adam Markowitz:

Yeah, it was, uh, so we had again those dozens of conversations. Out of those dozens of conversations, there was at least 12, there was a dozen that were stayed very close to us, not just sharing the problems with them as we spent 6 months basically building in 2020. So the second half of 2020, we spent just building that first version from scratch, obviously. And they stayed close enough to where they were our first paying customers when we launched. But as torturous as it was, we held the line at the door, so to speak. Like we said, look, we're ready to launch this thing. Obviously, you're watching us, we're demoing it, but we're not going to We have to be our own first customer. One, we were looking at in those 6 months, we watched dozens, I'm not exaggerating, dozens of companies pop up in this category because we weren't the only ones.

[00:27:33] Adam Markowitz:

it's Obviously, a— when there's the hair on fire problem out there, companies are going to form to solve it. And so we were like, well, this is one of our first opportunities to walk the walk. Again, that stung. I'll never forget again that CIO conversation. Do you have— can you prove your security to posture us? So like, this was a moment where to launch a product and have it in the hands of our customers without us having our own SOC 2 report or having used our own product to do it, like, that just seemed obviously wrong, like fundamentally, philosophically wrong. And so we did. We used Drata, we got our own SOC 2 report in hand, and then opened up essentially the floodgates. And we didn't realize just how massive the hair on fire problem was and how lightning in a bottle quick the product market fit would be there.

[00:28:20] Adam Markowitz:

Again, we had those dozen lined up. They were our first paying customers, but we brought— I mean, that quickly grew to 100 within a month and a half, 1,000 within the first year. And so it was, it was off to the races and then iterating very quickly right in front of the customer who was guiding us and guiding our roadmap. And it hasn't slowed down for 5 years.

[00:28:42] Omer Khan:

How did you, how did you differentiate? I mean, it's, yeah, you said it's a hair on fire problem. Great. But you also have certainly a lot of competition around you. How did you differentiate Drata? Um, and, and how easy or hard was it to sell? Were people like, you know, buying the first solution or was it, there was something special about Drata that, that made it stand out?

[00:29:08] Adam Markowitz:

Yeah, I think there's lots of ways to differentiate. Um, obviously within the product is where most of us, myself included, it's the first place my mind goes. But also just the execution, how we bring it to market, how we sell, how we onboard, how we implement, and all of it, um, is an opportunity to differentiate. And I think we, across every dimension, you know, we're differentiated. From a product standpoint, we didn't focus on checking a box for SOC 2. Again, that's where we started, but because we had that bigger vision from the beginning of wanting to work with larger companies and unlocking the bigger opportunity on trust, it wasn't just about how quickly can I help a startup get SOC 2 compliant. Obviously, if we do it well, it should be very quick, but that's not going to be our core message. That's not going to be what we hang our hat on.

[00:29:52] Adam Markowitz:

Uh, it's, we're going to deliver the most automation, but also we're going to scale with you. Um, So when you need more than SOC 2, which is going to happen when you're successful, we're right there with you. And so that affected how we built the product, of course, right? So not just paint by numbers, as long as you stay within the lines and take everything off the shelf, you're going to get automation. It's— you're going to get automation even when you actually bring in a CISO and a security team and you have your own experience here. Because we were working with larger companies pretty early. Who already had, you know, this isn't their first rodeo, this isn't their first SOC 2, let alone other frameworks. And so that changes the way you build the product for sure. And that helped us because companies were kind of graduating out of these point solutions that just helped them check a box.

[00:30:38] Adam Markowitz:

How we, you know, onboard, you know, the whole training mechanism, how we helped companies, again, these earlier stage companies who had never done this before, like the, you know, our product leader came from Intuit, was working on TurboTax Live and And the joke initially was, if you can make doing your taxes somewhat enjoyable, like, you can make compliance fun. Um, but it was even a step beyond that because most people at least know what taxes are, right? And so this was like companies and early-stage startup founders don't— didn't even know what SOC 2 was. They just knew it was a barrier. So here's a tool that's going to help us automate as much of this process as we possibly can. I don't even really know what it is. So I'm not just learning new software, I'm learning the whole concept itself. Again, goes into how we built the products, how we built the onboarding and training and all of that, um, and then how we brought it to market. Uh, we started our partner program really early, deliberately, um, with great leadership there.

[00:31:32] Adam Markowitz:

Um, but that became a key differentiator as well. Um, today, fast forward 5 years, a third of our pipeline is sourced through a partner, through a channel. Um, another third is, is influence. So two-thirds overall sourced or touched by partners, which is obviously a moat in itself.

[00:31:54] Omer Khan:

Where did the— when you open, you said you open the floodgates and you acquired, know, 100,000 customers very quickly. Where did they come from? Was it through the partner channel?

[00:32:06] Adam Markowitz:

Yeah, it's been a combination of inbound, so marketing, outbound sales, and partner. From the beginning. Those percentages have changed over the years across different segments as well, right? We have startup segment, our commercial segment, and our enterprise segment. So it varies across those and by region, right? And different regions around the world, different partners are gonna be responsible for sourcing more of that pipeline. But when I say floodgates, my mind, I mean, as soon as we launched our website, so for those first 12 customers, we didn't even have a public website. It was inbound immediately. And so in those 6 months of developing, because we got the band back together, that had all this experience from the edtech company, we had even from like an operational standpoint, like think just go-to-market ops, rev ops, I mean, we had our inbound lead routing and round robin kind of routing mechanisms already set up to the point where I thought we might be over-engineering it because we were kind of you know, biased coming off of this longer journey in edtech. Hey, we don't have the startup mindset here at Drata, but it served us very well, especially in that first year.

[00:33:16] Adam Markowitz:

I don't think we would have been able to— nothing slipped through the cracks. We touched all 1,000 of those prospects that turned into customers. And it was, you know, essentially hand over fist bringing them on board, getting them successful, showcasing that to the world. So we got the flywheel going and I think they're, again, I always talk about the appreciation, right? We, we had hundreds of customers, hundreds of universities as customers at Portfolium, but it took years and years and years to get there. Like I said, those first 5 were the hardest. When we brought on 1,000 customers at Drawd in our first year, the value in the feedback that we were getting and how maniacally we were about organizing it and prioritizing it in terms of that feedback loop in the product, That I attribute so much of that early success to, and the appreciation, like, you know, 1,000 customers, I mean, you can't even get how much value is in that feedback. That's also part of, like, the SMB versus enterprise SaaS, you know, value prop.

[00:34:19] Omer Khan:

So, what broke when you suddenly have 1,000 customers, like, almost overnight?

[00:34:26] Adam Markowitz:

It's like, what didn't break? Everything breaks. That's been, you know, what it's— we're talking about resilience and how every startup, every— you need it because you have a process or you build something that works for such a short window of time and then it sometimes it doesn't even just bend before it breaks, it just snaps. It could be anything, an org structure, some flow that you've built for, like I said, even the inbound lead routing. I mean, we had to switch from round robin to territories to multi-segment, multi-region, like within such a short amount of time. Um, one of our early revenue leaders came from from a, came a large public company, um, but was there for the whole ride. And it's a company that we all looked up to and admired. Um, but even they said like, look, at least at that company we got to lay the track down before running the train down. Here we, you're laying the track as fast as you can, building the plane while flying.

[00:35:24] Adam Markowitz:

I mean, all the all the sayings are true. So at the end of the day, it's making sure that people and the culture of the company understand, like, growth is change. Change is uncomfortable. This is going to be a very uncomfortable place to, to work with. That's what makes it great. So let's not be frustrated by that. Let's not let that wear us down. Let's embrace it.

[00:35:44] Adam Markowitz:

Deliberately uncomfortable is what we, we would say.

[00:35:48] Omer Khan:

One of the, the things I thought you did, which is pretty smart, was to to build relationships with auditors. You know, Drata could have been a threat to them, but you spent time building these relationships and eventually they became your partners selling the product. Tell me about like what that actually involved. Like how did you go about trying to find these people, recruit them? And get them selling the product.

[00:36:22] Adam Markowitz:

And well, just to be clear, so the auditors actually don't sell the product, and that's pretty important because from day one, those dozens and dozens of conversations, those were with obviously companies that could be customers of ours, but it was also with the audit firms that they were already using or trying to use because I wanted to, you know, they're a key stakeholder here. You know, I drew the line, the parallel between our old life. We had the students, the employers, but also the university administrators, and they were obviously a key part of this. And they were the ones doing the assessing of learning outcomes on these portfolios. And so here, the auditors are coming in and assessing, I mean, two completely different spaces, but you can start to see there's a lot of parallels, ironically. And so the feedback from those conversations was also really consistent. One, these audit firms are needing to do more, conduct more audits than ever before. It's a services business.

[00:37:09] Adam Markowitz:

So the scaling of that is very headcount driven. So if there was a way for them to conduct audits faster, without losing integrity, actually increasing the integrity because you've got continuous monitoring happening where obviously if you don't have that, then it's a lot of just point-in-time kind of checks. Then it's a win-win across the board. And we wanted to make it very clear from the beginning that we don't view ourselves as a threat. In fact, we never want to be considered an auditor or audit services firm. Ourselves. The independence of these audits and certifications or SOC 2 reports is what gives them the weight that they should carry. You know, this is a— it's not us, Drata, the, the vendor that's validating it.

[00:37:56] Adam Markowitz:

It's, it's independent third party. And so again, ideally in a perfect world, we're able to bring our customers who don't have an audit firm just yet to these various auditors, help them conduct the audit faster with a very high var for integrity on them. And again, everyone wins. So that's the approach we've taken. It's been like a, you know, I call it the Declaration of Independence in terms of like, we want to be independent from these auditors. The auditors should be independent. And so again, I think that served us well. That itself became differentiating because the market, not every player in the space took that approach.

[00:38:34] Adam Markowitz:

It was, you know, I think it's more philosophical and strategic in our view of keeping it independent. But there are great— we call it the Auditor Alliance Program, where any of our customers can use any audit firm they want. We're never— like, we're agnostic. We would never tell them not to use a certain audit firm. Obviously, there are certain audit firms that are going to be very just, you know, very experienced in using Drata to conduct audits. And so, those over time become, you know, even more streamlined. But that's, you know, we never We never force a customer to use any specific auditor.

[00:39:09] Omer Khan:

AWS also turned out to be a great channel for you. Tell me about that.

[00:39:16] Adam Markowitz:

Yeah, it's a special one for sure. We, within a, I think less than a 2-year stretch, became a top 5 global ISV on AWS Marketplace in terms of transaction volume, which was a big deal. Again, hats off to our partnership team, to our whole go-to-market team who embraced this partner-first approach. Which, you know, it can be different for folks if they're not used to that. With AWS, we took a, like with any, you know, very small to very large partner, you know, it's what can we do for you for a very long time before it's what's in it for us. That was a good piece of advice. We had that from our prior experience. Our partnerships leader had that from their experience.

[00:40:00] Adam Markowitz:

So it was a no-brainer, but I talked to other founders like, how do you go partner with AWS? Like, well, it's day one, it's not what's in it for us, Drata, it's here's what we're going to be able to do for you. And we will do that for like a while before we expect anything in return. And so, in this case, we were bringing customers to the AWS Marketplace that had never transacted on Marketplace, never heard of Marketplace, and we were bringing volume. And so, that got us on the radar to where we could obviously then get value in return. And so within, again, those first couple of years, there was thousands of transactions that we brought to Marketplace. And there was benefit for our customers to transact in Marketplace as well. And up until that point, you know, working with the partnership team at AWS, know, you most of the companies that were transacting on Marketplace were larger enterprises that had committed spend. And here we were bringing companies that had no committed spend, they had never even heard of Marketplace.

[00:40:59] Adam Markowitz:

So, there was additional value in even introducing the concept of marketplace to them. And so again, that, that really helped us differentiate, um, not just again the product, but how we brought it to market. And so it's, it's still a great, great partnership we have there.

[00:41:15] Omer Khan:

First of all, I love that principle of like just give before you, you take, um, and it, it's it seems so obvious in hindsight, but I guess when you're in the weeds and you're just trying to figure out how do I grow faster, how do I get that next customer, there's a huge sense of urgency. What, why did you feel that? Like, was this an intentional thing that you were like, okay, eventually we want to work with AWS, but if we try to do something today, it's not going to happen. So let's just you know, kind of play the long game, or was it more about as it evolved over time you were like, okay, there's more of an opportunity here?

[00:41:58] Adam Markowitz:

I mean, we want to, we want to work with all the cloud platforms, so we— it's a key integration in how we deliver the value of that compliance automation solution. We obviously, we integrate with your AWS, your Google Cloud, your Azure for continuous monitoring of your cloud controls. And so already it was a a powerful integration. And then just by looking at our customer base and overwhelming majority of them being on AWS, it made sense. And rather than spreading ourselves too thin upfront, we went all in with AWS. And now today we work again with all cloud platforms 5 years in. But again, it was that mindset, the deliberate mindset of rather than spreading ourselves across the board, let's really go all in and give, give, give, give that value before extracting anything out.

[00:42:48] Omer Khan:

I mean, the thing that sort of strikes me here is that you went from basically zero to $100 million in ARR in about 4 years. And yet when we tell the story, everything seems to be about— there wasn't that, like, it wasn't like, okay, day one out of, you know, I don't think we're going to just go aggressive. We're going to go and sell, sell, sell. It was no, let's, make sure we've got SOC 2 compliance for ourselves before we go and sell. Let's go and build partnerships. Let's go and do this. It, when, when you sort of look back at that and the sort of phenomenal growth of the business in, in, in those 4 years, what do you like, what do you think are the big takeaways? Like, why, why do you think you were, um, able to have that level of success so quickly?

[00:43:41] Adam Markowitz:

I should be clear, just because I think sometimes my personality could seem kind of laid back or super by-the-book methodical versus kind of relentless Type A. And there's a good mix. I think there's a very good balance, very mission-driven company. We have our core values. Core values are just words. It's you actually putting those words into action behavior. That's what culture really is. And so we've been super deliberate from the beginning with that, which has set kind of the tone.

[00:44:12] Adam Markowitz:

But there is a good balance with a go-to-market machine that was extremely aggressive and on purpose because the opportunity deserved it. That's our mindset. The market has this problem. We experience this problem. The problem's getting bigger. It's not being solved. We need to go solve it. And so, and I remember that first year especially, I would get calls or Slack messages from different CISO groups saying, you know, your sellers are aggressive, Adam.

[00:44:43] Adam Markowitz:

And I would say, I know, you're welcome. Right. It's like, I know why they were saying it, but I'd much rather, and I would tell them, I'd much rather hear that than the opposite. Because in our view, that's our expression of our appreciation for the opportunity to solve problems. Obviously there's a line there and aggressive can mean different things and it was never done in a malicious, bad intent way. It was always like, we want to help solve this problem. So we are going to, we're going to be following up. We're going to be relentless in this.

[00:45:18] Adam Markowitz:

But I go back to that again, day one, the appreciation for the opportunity that drove this execution mindset and that drove results. Very quickly. And those results give you this perspective again to go, wow, this is a huge opportunity, which drives the execution and just this virtuous cycle that has never stopped. I mean, to this day, we look around and go, that, that, that one-liner is exactly what's happening. That never happens, right? We took an automation-first approach to this CNGRC, and now we're unlocking this bigger opportunity around trust with multiple products that sit on top of a true trust management platform. And these problems We're getting lucky in a lot of ways. Obviously there's the execution is never luck, but the timing of these different things, we didn't know the AI boom was about to happen. That's now driving even more demand for more frameworks, multi-framework compliance, security assurance to prove you proactively, you're doing the right things as you adopt AI.

[00:46:10] Adam Markowitz:

And then from a third-party risk standpoint, all companies, ourselves included, needing to bring in more and more AI vendors that introduce a whole new set of risks and amplify risks that were already there. And so. All the use cases that we are setting out to solve, fundamental to trust, are all getting these tailwinds now with AI. And know, so, you yeah, hopefully it's clear, like, the appreciation's always been there. And so, um, I don't want to give the uh, the wrong, wrong idea that we were you just, know, by the book lean startup and the success just happened. I mean, it took a good mixture of that relentless execution mindset And yes, taking lessons learned from the past to set certain things up from the beginning to give us a clearer path.

[00:46:53] Omer Khan:

Let's talk a little bit about AI. Um, going back from when Satya Nadella talked about, who I think is an investor in Drata, right? Um, talked about, you know, AI is going to have SaaS for breakfast or whatever, whatever, whatever he'd you know, said, there's, there's this constant thing going on. How do you, how do you How do you think about AI? Obviously it creates a whole bunch of opportunities for you with this business, but what are the threats for you and how are you thinking about the as, you business know, how do you see it evolving over the next few years?

[00:47:35] Adam Markowitz:

Yeah, what I love about trust is really our core, not just our core value, but our, the reason why our company exists. Like it's timeless. Okay. It's, it's the truly enduring, because no matter what wave of technology or trend or anything, like I will always believe that trust is still going to be foundational, paramount for success. And so, yeah, that's kind of the overarching statement. Now I mentioned some of the tailwinds that we're seeing across 3 different use cases that our products are solving for our customers. And that's just fantastic. Again, it's kind of reinforcing the point that, you know, as these new technology waves emerge, trust just gets that much more important.

[00:48:19] Adam Markowitz:

It's more important than ever before. So in our world, when we're— we have a multi-framework compliance automation solution, it's one of our products. There are new AI-specific frameworks emerging and going to continue to be there right around the next turn that our customers have to comply with, ourselves included. And so that use case becomes even more valuable. Um, to then provide our customers and prospective customers with assurance around that compliance, it's another use case that only becomes more important. And the flip side of assurance is again third-party vendor risk, the very thing that kicked off the, the SOC 2 craze, so to speak. Um, now I needed a new bar of assurance, a new set of risk criteria to evaluate my vendors and prospective vendors against when it comes to AI. Because I've got a set of hundreds of vendors right now that are all rightfully so introducing AI components, copilots, agents.

[00:49:13] Adam Markowitz:

So even though I evaluated them 6 months ago, a year ago, as soon as someone toggles on the, you know, hopefully they have even a toggle to turn on the AI. It's not just by default. There's a whole new set of risk criteria that I need to evaluate them against and continuously do so. And so again, all 3 use cases getting these AI tailwinds. Um, at Troada introducing our own agents for all of those use cases. Um, when we apply AI to a trust graph, which is ultimately what we're building here, um, ironically very similar to like a social graph or the LinkedIn Economic Graph, the value, the insights and patterns that we're able to glean even before AI, but now especially as we apply AI, um, unlocks so much value for each new product that we deliver on top of the platform. So, you know, we introduced our Agentic TPRM solution, third-party vendor risk. Like, this is leveraging all of that data across this graph, across thousands of companies that are transacting with one another to varying degrees of assurance.

[00:50:12] Adam Markowitz:

We're able to bring such differentiated value to each new product that we launch. If I fast forward a few years, like everyone's trying to do, and no one has a crystal ball, but yeah, some kind of headless SaaS that's pure agents. Um, you know, I think that the data and the context within that graph are, are ultimately the moat. But, um, obviously anything can happen.

[00:50:36] Omer Khan:

Uh, we should wrap up. Let's get on to, um, the lightning round. I've got 7 quickfire questions for you. Ready?

[00:50:43] Adam Markowitz:

Yeah.

[00:50:44] Omer Khan:

Okay. Uh, what's one of the best pieces of business advice you've received?

[00:50:48] Adam Markowitz:

I got a piece of advice from someone that said don't take everyone's advice, and that one, of course, that just stuck with me because there time there, especially at Portfolium, where I, you know, I didn't know anything about anything. You never know what you don't know, but I was trying to apply everyone's advice immediately, and I was getting a lot of conflicting advice, so that didn't help. But so, don't take everyone's advice was a good one.

[00:51:11] Omer Khan:

What book would you recommend to our audience and why?

[00:51:14] Adam Markowitz:

It's different books at different stages. I'm trying to think of something that applies across all. Courage Is Calling is a good one. I think stoicism is always, you know, resonates with founders. The Hard Thing About Hard Things is kind of like everyone's go-to. I've read that one before, actually during Portfolium. It helps for sure. I like Scott Belsky's The Messy Middle because there's a lot of books about the beginning and the end, but not a lot about the middle.

[00:51:43] Adam Markowitz:

Yeah, and then for all those sports fans out there, I love Relentless, which is the— I think it's Tim Grover, Kobe Bryant's trainer, Michael Jordan and Kobe Bryant's personal trainer, just to get into that mindset, that relentless mindset.

[00:51:58] Omer Khan:

What's one attribute or characteristic in your mind of a successful founder?

[00:52:02] Adam Markowitz:

Resilience.

[00:52:03] Omer Khan:

What's your favorite personal productivity tool or habit?

[00:52:07] Adam Markowitz:

Always trying new technology. You know, building agents now, of course, is whatever everyone's doing, and it's pretty amazing what you can unlock. I think there's other kind of habits, um, that I've tried. Um, I wake up early, I get a lot done, like, personally, um, physically. I jump in the cold um, plunge, work out. I think that helps. It sets the stage for the day, um, you know, starting every day with a challenge, doing something you don't want to do. Again, getting that mindset, that resilience kind of mindset every single day, I think has helped me a lot for sure.

[00:52:45] Omer Khan:

What's a new or crazy business idea you'd love to pursue if you had the time?

[00:52:49] Adam Markowitz:

I don't know. I feel like every creative thought I have goes right into Drata. Yeah, it's hard to even think beyond.

[00:53:00] Omer Khan:

We'll pass on that one. What's an interesting or fun fact about you that most people don't know?

[00:53:06] Adam Markowitz:

Most people don't know I have the aerospace background when I meet them.

[00:53:09] Omer Khan:

They.

[00:53:12] Adam Markowitz:

Also, most people don't see maybe on the surface how competitive I am, cuz I think I hold it pretty well under the surface, but it comes out in, you know, a lot of way. I mean, just obviously once, once we get going, especially when it comes to anything with any activity, any physical activity, anything with a ball. Ball sports. It's good hand-eye coordination.

[00:53:33] Omer Khan:

And finally, what's one of your most important passions outside of your work?

[00:53:38] Adam Markowitz:

Family. Outside of time, trust, and family always comes first. That was actually an interesting thing. I don't know if this is relevant to anybody, any of your listeners, but when we started Drata, myself and the co-founders, we had this, this talk that was interesting around family, like the portfolio. I didn't have wife and kids when we started. I lived in the office, I slept in the office, and obviously it was a successful outcome of that company. And there's a false positive. It's only successful because I did all those things.

[00:54:14] Adam Markowitz:

Whereas when we started Drata, I even told early investors, I said, no matter what, Drata will not be the most important thing in my life. Like, is that okay? Is it going to succeed in spite of that? 'Cause I have kids now. And it was fine. I think some of our earliest investors were like, they would smile when they heard me say that. And they said, the fact that you're even thinking that way is why it will be successful. And that was really cool to hear.

[00:54:37] Omer Khan:

That's your quote. That's the thing you should go with. Love it. Well, listen, thank you for joining me. It's been an absolute pleasure. One of the really interesting things I've seen with your story is that I often talk to founders who are like looking for an idea and they're just looking all over the place. And with you, both the ideas that have been successful for you have been about personal pains, something that you experienced, something that you try to solve. And, you know, maybe it didn't happen immediately.

[00:55:08] Omer Khan:

Maybe it was sort of, you know, a couple of years down the road, but there's definitely something there. And maybe there's going to be a third act. After Drata at some and, and, point, you know, we'll see where that goes. Um, if folks want to check out Drata, they can go to drata.com. And if they want to get in touch with you, what's the best way for them to do that?

[00:55:29] Adam Markowitz:

LinkedIn, probably the most, the easiest.

[00:55:31] Omer Khan:

We'll include a link in in the, the show notes. Um, great. Thanks, man. It's been an absolute pleasure, and, um, I wish you and the team the best of success.

[00:55:39] Adam Markowitz:

Thanks so much, and likewise.

[00:55:41] Omer Khan:

Cheers.