The B2B Podcast Index
Index
All categories
MarketingSalesSaaSFinanceHROpsLeadershipCustomer SuccessAI & DataProductStartups & FoundersRevOpsEngineering & DevTools
MethodologySubmit
Best of:MarketingSalesSaaSFinanceHROpsLeadershipCustomer SuccessAI & DataProductStartups & FoundersRevOpsEngineering & DevTools
An independent project byFame
SearchBest episodesGuestsInsightsMethodologySubmit a podcast
Index/Engineering & DevTools/The Human Side of Cybersecurity
The Human Side of Cybersecurity artwork

The Human Side of Cybersecurity with Adam Markowitz, Founder of Drata

The Human Side of Cybersecurity · 2026-05-19 · 36 min

0:00--:--

Key moments - from our scoring

Substance score

42 / 100

Five dimensions, 20 points each

Insight Density9 / 20
Originality7 / 20
Guest Caliber13 / 20
Specificity & Evidence8 / 20
Conversational Craft5 / 20

Adam Markowitz, founder of Drata, traces his unconventional journey from aerospace and NASA to founding Portfolium - a portfolio-based credentialing platform for students - before pivoting to GRC automation. The core through-line across both ventures is trust: how it's earned and maintained between parties. After Portfolium's acquisition in 2019, Markowitz recognized the broader market pain he'd solved internally - manual, questionnaire-driven compliance processes that created bottlenecks in third-party risk assessment. Drata emerged from this insight, automating continuous security control monitoring to replace point-in-time assessments. The discussion covers his philosophy that GRC teams are business enablers, not cost centers; the importance of connecting compliance efforts to revenue impact via trust centers; and how AI will make trust an even more critical differentiator as barriers to product development lower. For B2B operators, security leaders, and GRC teams, this episode offers concrete perspective on moving from checkbox compliance to continuous trust demonstration, backed by someone who's lived the founder scars of premature scaling, solution-seeking-problems, and the tension between bold vision and gut instinct.

Key takeaways

  • →Trust is a foundational business asset and competitive advantage that security/compliance teams should actively demonstrate to customers through continuous evidence rather than point-in-time questionnaires.
  • →Early customer interviews and research are critical to validate that you're solving a genuine pain point rather than building a solution in search of a problem.
  • →GRC and security teams function as business enablers that accelerate sales cycles and revenue when they can quantifiably demonstrate their impact to leadership and customers.
  • →Founder intuition and gut feeling, synthesized from subconscious pattern recognition, should be balanced with humility about inexperience and should guide major decisions when something doesn't feel right.
  • →Company culture should be deliberately tied to specific mission values with clear behavioral expectations rather than generic virtues, and this intentionality attracts better aligned talent.

In this episode

  1. 1From Aerospace to Entrepreneurship: Early Career and First Venture
  2. 2Building Portfolium and the Trust-Based Mission
  3. 3The Jump to GRC and Cybersecurity with Drata
  4. 4Solving the Compliance and Third-Party Risk Management Problem
  5. 5Turning Compliance into a Strategic Business Advantage
  6. 6Hard Lessons Learned and Founder Intuition
  7. 7Building Culture Through Mission-Aligned Values

Mentioned

Adam MarkowitzDrataPortfoliumNASAGDPR

Guests

Adam Markowitz

Topics in this episode

CRM integrationCompliance automationGDPRThird party risk managementGRC (Governance, Risk and Compliance)DrataPortfoliumNASA Space Shuttle ProgramContinuous security monitoringTrust centers

Questions this episode answers

What is Drata's core approach to replacing traditional questionnaire-based third-party risk assessments?

Drata uses continuous monitoring and automation of security controls from the inside out, allowing companies to proactively demonstrate their security posture on an ongoing basis rather than through point-in-time questionnaires and assessments.

How did Adam Markowitz's experience with Portfolium influence his approach to building Drata?

Portfolium taught him the importance of customer research, product-market fit maintenance (not just achievement), and the necessity of stakeholder alignment - all of which informed Drata's focus on solving real vendor pain and ensuring adoption across multiple parties who must trust each other.

What does Adam Markowitz mean when he says GRC teams are business enablers, not cost centers?

He believes security and compliance teams directly accelerate revenue by enabling faster sales cycles and demonstrating trust to prospects; when connected to CRM systems via trust centers, these teams can quantify their revenue impact rather than being viewed purely as overhead.

What hard lessons did Adam Markowitz learn as a first-time founder that he carried into Drata?

Key lessons included the dangers of solution-seeking-a-problem, the difference between vitamins and painkillers, the critical importance of early customer outreach, and learning to trust his gut when something doesn't feel right - balancing big vision with the humility to learn from others' experience.

How are Drata's company values (the 'Drata Rules') different from typical corporate values statements?

Drata's values are mission-specific and deliberately opinionated rather than generic; they include explicit behavioral examples that show how each value manifests in practice, and are called 'rules' rather than 'principles' to signal their non-negotiable importance to the company's culture.

What our scoring noted

Our reviewer’s read on each dimension, with quotes from the episode.

Insight Density

9 / 20

There are a handful of non-trivial ideas buried in the episode - particularly around converting point-in-time questionnaires to continuous monitoring and connecting trust centers to CRM to surface revenue attribution - but they are surrounded by large stretches of origin-story narrative, platitudes about trust, and light philosophical musings that a B2B operator would gain little from.

when we connect these trust centers where our customers are proactively disseminating information on a continuous basis, they connect it to their CRM and they're able to actually, it's not us anymore, it's our customer, our, the ciso showing just how much revenue is being influenced by their security team
with agents that are able to do so much of this manual work, the job of a GRC practitioner is already changing from doing the work to automating the work to having agents do the work. Um, and they're now more orchestrators

Originality

7 / 20

The core thesis - compliance as a business enabler and trust as a competitive advantage - is a well-worn vendor narrative by now, and the episode leans on it heavily without offering a genuinely contrarian or first-principles angle. The 'trust graph' and continuous monitoring framing adds some texture but is Drata's own marketing language rather than fresh intellectual contribution.

outside of time, trust is one of our most precious assets in life. It's a, a prerequisite for success in any relationship, personal, professional
we say these GRC teams, security teams, they're not cost centers, they are business enablers

Guest Caliber

13 / 20

Adam Markowitz is a legitimate serial founder who built and exited Portfolium and then scaled Drata to thousands of customers with millions of controls monitored - he has genuinely done the thing at scale. The score is held back because the interview does not extract the depth of practitioner knowledge his background would justify.

Portfolium, which is a mouthful to say, but, uh, it's kind of like a LinkedIn for college students centered around these portfolios for students and recent grads
company got acquired in 2019 after a long path of product market fit

Specificity & Evidence

8 / 20

A few named anchors appear - Jonathan Jaffe at Lemonade as an early customer, Vitaly moving from Netflix to Anthropic, Portfolium's 2019 acquisition, GDPR as a timing marker - but there are no revenue figures, growth rates, retention numbers, or case-study-level detail, and most claims about business impact are asserted rather than evidenced.

I was on the phone with one of them yesterday, Jonathan Jaffe at Lemonade
Vitalik, he's now at Anthropic

Conversational Craft

5 / 20

The host is openly a longtime business partner and friend of the guest, resulting in near-constant validation, no meaningful pushback on any claim, and a string of open-ended biography prompts. Questions like the 'billboard question' and 'eulogize the living' shout-out segment are classic soft-format filler that extract zero operator-relevant substance.

I love it, ladies and gentlemen. That is why culture matters
give us a little window into, um, what you read, what you listen to, what you subscribe to

Conversation analysis

Computed from the transcript - who did the talking, and the words that came up most.

Share of words spoken

  • Adam Markowitzguest70%
  • Dan Deskohost30%

Most-used words

trust52important17love13five13customer12prove11customers11first11along10point10agents10data9team9product8different8values8

Episode notes

In this episode, Dan Desko sits down with Adam Markowitz, Co-Founder of Drata, to discuss the evolution of trust in cybersecurity and how it has become a core driver of business performance. Adam shares his journey from working on the NASA Space Shuttle program to building Portfolium and eventually founding Drata, and how those experiences shaped his perspective on proving trust, not just claiming it. The conversation explores how traditional approaches to security and compliance created friction through manual audits and point-in-time assessments, and how that experience led to a new way of thinking about continuous assurance. The discussion also covers the challenge of driving adoption for new ideas, the balance between innovation and practicality, and why many organizations struggle to move away from systems they know are broken. Adam also shares insights on the role of AI, how it is lowering the barrier to building new products, and why trust will become one of the most important factors in determining which companies succeed. If you enjoyed this episode, please leave review, it helps more people find the show! Want first access to future interviews? ⁠

Full transcript

36 min

Transcribed and scored by The B2B Podcast Index.

Adam Markowitz: Foreign.

Dan Desko: Thank you for being here with me today. Um, founder of Drata. Love to talk, uh, about your story, our story. Um, it's been great working with you for the past five years or so, um, and watching what you've done at Drata. So I'm so excited and thankful that you, uh, joined me here today for the human side of cyber. And I'm excited to tell your story.

Adam Markowitz: Oh, thanks for having me. Crazy. Five years. Time flies, man.

Dan Desko: Time. Time does fly. Time does fly, that is for sure. But, uh, uh, maybe a draw to speed, some would say.

Adam Markowitz: I would think time dilation, for sure.

Dan Desko: Yeah, absolutely. Um, well, hey, so for some of the listeners and the folks out there, I like to start off maybe, um, give us a little bit about your, your journey. I think you have a really unique and interesting journey and you know, uh, from where you've been to your idea for Drata and how you sort of transformed along the way. Um, why don't you give us a quick background?

Adam Markowitz: Sure, I'll try to make it quick. Um, but it's a unique one. My, uh, see, my formal education, early career was all in aerospace. So that in itself I think is unique. Uh, worked on the tail end of the NASA space shuttle program until the fleet was retired in what, 2010, 2011.ish. Um, and then, uh, uh, you know, landed that job actually through a unique way. I brought a portfolio of work samples into a job interview to prove my skills beyond a bullet pointed resume. And that idea alone was kind of impetus for learning to code way back when. And, uh, building a company that was called Portfolium, which is a mouthful to say, but, uh, it's kind of like a LinkedIn for college students centered around these portfolios for students and recent grads to do what I did, prove their skills beyond bullet points on a resume. Actual tangible evidence work samples.

Dan Desko: Absolutely.

Adam Markowitz: Uh, the concept, very similar actually to what we do at Gerada, was you could say you have a skill, you could say you have leadership capabilities and whatnot. Can you prove it? Can you prove it with evidence? Um, best way to earn trust is to prove you deserve it. That was the saying. Uh, and that, uh, experience was something that wouldn't change for anything. We built a company. Um, company got acquired in 2019 after a long path of product market fit and working, uh, with a lot of university customers and onboarding their students into this network and needing to assure them we're going to do right by their students data. Um, and the idea of helping students earn trust by proving they deserved it, uh, applied directly to us when the university customer said, can you prove to us you're going to do right by this data? Uh, um, and so the thought of saying no, just take our word for it, obviously wasn't an option given our belief around trust. And so got really good over the years of doing a lot of automation internally to help maintain that trust and prove we were doing the right things when it came to security. Um, and when the company was acquired, that was when we picked our heads up at, for the first time and saw the bigger problem that we had already solved for ourselves, um, across the entire landscape. And that's where the idea for Drotix started.

Dan Desko: And it's funny you mentioned the product market fit, you know, challenge. Um, I think that's where our paths first crossed. Right. I was a, a partner at an accounting firm and you were still in stealth and uh, another Troy, not your brother, brought us together. Uh, right. And it, that was the reason we kind of got brought together. You were kind of looking for that or just seeking some, uh, opinions on the product market fit. And um, I think that that's how we got introduced. And I remember those days where you were asking the right questions like, hey, as a CPA firm, as an auditor, like, how would you perceive getting evidence out of a tool like this? Right. And, um,

Adam Markowitz: it was so important. I mean, and thank you, uh, for all of the feedback way back when, because those were the earliest days and that was a really important question that, uh, I think said a lot and still says a lot about our approach. We had solved the problem for ourselves, but that didn't mean we knew exactly what to do and how to do it. Yeah, there were stakeholders that, uh, we had to make sure were aligned with what we were doing. Otherwise it wasn't going to work.

Dan Desko: It would never work. Yeah, absolutely. It could be. No, and still is one of the greatest ideas ever. But you're right, it would not work if all the stakeholders wouldn't buy in.

Adam Markowitz: Right? Um, exactly. It's the irony of it, right? It's like, here's something to help build to maintain trust. If that's not, if one of those parts isn't even willing to entertain the concept, then good luck. Right?

Dan Desko: Yeah. Yeah. Well, look, I, I think that's just from a person to person standpoint, I think that's what helped me, um, really understand the type of person you are and your approach to things. Did, did your experience, um, uh, from before, like going through some of the product market fit challenges help you in the Drought of days or in the early days?

Adam Markowitz: Yes, absolutely. Um, in kind of the most obvious ways of like doing way more customer, potential customer kind of interviews and research and deep dives, um, but also just more like philosophically in terms of understanding how important it was, that it's not some binary thing that uh, once you have it, you have yet to maintain it. And I guess a founder, CEO, that's one of the most important things, um, to maniacally focus on getting it and then maintaining it. Um, because everything else doesn't work if you don't have it. Um, and then there was the appreciation perspective for it that maybe without that prior experience we wouldn't have had or wouldn't have had to the same degree that we did here. Not that then fed the execution kind of flywheel, that appreciation perspective.

Dan Desko: And I wanted to ask you, Adam, about, um, making the jump from Portfolium to uh, GRC in cyber. Right. Like, what gave you the idea, how did you make the jump? Was that tough for you to really just move away from something that you've been locked into for the past six, seven, eight years?

Adam Markowitz: Yeah. the heart of it, like the problem that we were solving, um, because at both companies we were solving a problem around trust. How trust is earned and then maintained, whether it was between, in the prior life between a student or recent grad and their future employer, and this new world between really any two parties, like any companies that have to do business with one another. Um, and that just comes from a personal belief in the importance of trust and how foundational, how fundamental it is. I've been known to say from time to time that outside of time, trust is one of our most precious assets in life. It's a, a prerequisite for success in any relationship, personal, professional. And so that concept alone has fueled the mission for both of both companies. Um, again, very different spaces, different ways of solving these problems. But, um, underneath both, that is at the heart of it. Um, I don't think it'll like, trust will never not be important, no matter what's happening in the world. Whatever technology is available or becomes available, it kind of only further proves how important trust is. Um, and we, again, we ran head first into that problem ourselves from a security assurance lens of trust. I'll never forget the CIO of the large public four year university system saying, we're about to sign this contract with you. You're going to help our students prove their skills to employers, but we need you to prove your security posture to us first. Um, and it was Such a moment of just intense realization like this is another use case specific to our core belief and we have to walk the walk here. Um, and so again feeling that pain, doing it all manually, um, with a lean team, um, at a time when GDPR had just come online.

Dan Desko: Yeah.

Adam Markowitz: This multi tenant social network that we had to manually apply all these controls to, um, it's painful. We live the pain and appreciated how important it was to solve it.

Dan Desko: And you basically answered my next question which was, you know, the, what was the friction or the frustration that you experienced that ultimately like helped give you the, the push to start Drata and go down that, that path?

Adam Markowitz: Yeah, I mean that was obviously the biggest part of it. I think the other kind of thing that struck us was while we're feeling this pain, trying to solve it for ourselves, the uh, I just the concept alone of a point in time assessment or questionnaire because every, in their own prior life, every university group had their own questionnaire. Right. Um, and it was against the, this is how trust is being earned. And then also maintain just that there were other ways, there are better ways and it's going to become a bottleneck of all bottlenecks if we don't really solve this. And so there was a lot of motivation to solve it when you were

Dan Desko: seeing the possibility there and moving from a checkbox driven like GRC approach. Um, and it's clear as day to you. And I think, you know, I, I agree uh, wholeheartedly too. I mean around that same time I was executing a lot of uh, third party risk management programs for some large financial institutions, we'll call them. Right. Was very like checkbox paperwork driven exercise. Um, right. It felt like it was more of a case of uh, taking care of the paperwork to appease the examiners more than it was like actually building trust between the companies. Um, oh, did you have doubts along the way? Were there points along the way where you're like, man, I know there's a better way, but I don't know that it'll get adopted at the level that we want. Like, were there some doubts, fears along the way?

Adam Markowitz: Always for sure. Um, it's not like there aren't any. Even still now I think again if I look back on the prior experience, you know, being idealistic, you have this vision, one would disagree. This is the way things should be. And so you could go all in on that and then adoption just isn't there. And so I learned that the hard way in the prior life and so take it with me. And it was Something here where it's like, yes, no one's going to disagree, there's a better way and it should be this way. But. And so I didn't focus so much on, I mean it was just put it on the whiteboard, it sits there. How do we get there? How do we get the adoption curve to a place where, yes, we kind of know where the puck's going, we're not so far ahead of it that we completely miss the boat here. Um, and a good example of that would be the questionnaire based third party risk out of assessments that every company that we spoke to was doing and frustrated by. And everyone agreed this wasn't the best. Lazy, just put it like the best way to truly build trust. Um, but it had to be done. That's at least the thought everyone had. Yes, of course there's a better way. Uh, so our thought there was, look, if we're taking an automation first approach to the C and grc, as we said, um, by continuously monitoring security controls from the inside out for our customers, if we do that better than anyone in the world, this is the thought process, um, then we can get to a place over time where we get, whether it's a large fi or just enterprises in general comfortable with another way of gaining trust. And it happened so organically. It was validating along the way where larger customers would come to us and start asking us to build questionnaire functionality, which we did. Um, they were asking questions about the very controls that we're continuously monitoring from the inside out for their very vendors. Um, that couldn't have happened unless we solve that first pain for those vendors really well. And a lot of them to where we could just kind of lead the horse a bit of like, you know, I know you don't have to send this questionnaire when this data is available continuously and they're willing to provide it to you for that assurance.

Dan Desko: Exactly. Um, you know, you mentioned the C and GRC and obviously in the early days, um, for sure, like that was a big selling point. Organizations, um, being able to implement Drata and at least take care of some of the compliance measures. Um, is the thought that those organizations are turning compliance into a strategic advantage really at that point? I love talking about how like if you can actually demonstrate it, like you said, prove it. Like to me, if you're going into battle as a B2B org and you have three competitors and they can't demonstrate trust like these others can, that vaults them ahead in any sort of conversation. Right. Um, were you seeing that in the early days. Are you still seeing that now? Like, what's your take there?

Adam Markowitz: Yes, I think it'll always be the case. I think how it manifests has evolved. I mean back at our printer prior life and as we started doing this and internal monitoring and automation, we absolutely use it to our advantage. Um, because if you can go in proactively and demonstrate some of these things as you're trying to build trust with a prospective customer and your competitor isn't, you know, obviously that's going to impact your win rate, which is great. So m. We lived that and that's probably like the, the earliest manifestation of it. Um, then as we did again more continuous monitoring, we were able to showcase that on a continuous basis, which give another advantage. I could do the point time assessments and get the certifications of the attestations, which is super important. But if I could in between show just how effective our controls are operating, um, that's an advantage in itself. But all of this stems from the belief that trust is fundamental prerequisite for success in that relationship and that soapbox. And we say these GRC teams, security teams, they're not cost centers, they are business enablers. They actually accelerate growth. Um, and it just sounds like a vendor saying something because it fits their, their narrative. But we've been able to prove it over the years. And these are some of the other kind of inflection points that we've seen. When we connect these trust centers where our customers are proactively disseminating information on a continuous basis, they connect it to their CRM and they're able to actually, it's not us anymore, it's our customer, our, the ciso showing just how much revenue is being influenced by their security team and how much faster these security views and sales cycles are when they go through their trust center versus not like basically proving that soapbox statement that we're actually a business enabler, we're not a cost center. Um, and I think we're about to see another inflection point with AI in this case. Um, because if the barrier to building a company, a product and agents is no longer the expertise and software development, it's no longer, you know, infrastructure. It's, it's, I mean barriers go on. We're going to see just a wave of uh, of new, new companies. And so that's not the bottom like, what is the bottom like? And I think it's still going to be trust. I can build an agent in a weekend, I can solve a ton of pain for a potential Customer. But is it going to have this trust of maybe some incumbent in that space? Probably not. So I think that to be another inflection point.

Dan Desko: I totally agree and there's a lot that we, uh, can unpack there perhaps. But I want to go back to a second, you know, um, to your comments around, uh, the compliance teams becoming enabler. I don't believe it's a line of smoke and I don't think we should ever feel bad for believing that. Right. And you, you, you become what you believe you are. And I'm, I'm a firm believer in like people's thoughts and how they think about themselves, how they talk about themselves. Um, they usually will turn out that way whether it's good or bad. Right?

Adam Markowitz: Yeah.

Dan Desko: And if people believe that that's all smoke and mirrors, then they manifest a GRC program of smoke and mirrors. Um, I've seen great people, uh, lead great GRC programs that have the belief that like they are a business enabler and when they believe it and they do it, they become a business enabler. Um, and I, I've seen it happen with great people.

Adam Markowitz: Yeah. And it's, it's super rewarding when you know, the customer has that belief and we give them the tools to help improve it. Uh, because then it's uh, it's more validating for them. We've had CISO say, finally I can go into a board meeting or executive leadership team meeting and with one click show just how much of an impact we're having. Uh, yeah. Versus just talking about it or saying it and believing it to be true.

Dan Desko: Um, well, we're obviously talking about a lot of the good things. I want to ask you about a scar or hard lesson that you may have encountered along the way and I'm sure there's plenty that you could reference. Um, I would love to hear. Give me a hard lesson learned in your entrepreneurial journey and um, what it taught you.

Adam Markowitz: There are so many, um, yeah, it's like I think we're, I am the, the outcome of a lot of scars built up over time that have shaped kind of how I operate and still, still making fun of mistakes that ah, I just want to learn from so that I don't repeat them. Um, the ones that come top of mind live entire life long path of product market fit. It didn't have to be that long. Uh, it was that long because I wasn't doing certain things or I was convincing myself it wasn't important. Um, yeah, early customer outreach and research site. We talked about, you Know a uh, solution in search of a problem. A lot, a lot of that happened. Um, even at the end of the day there was a uh, realization over you know, the difference between a vitamin and painkiller and be as obvious to me as a, when I was a first time founder, like the difference, um, but now feel it and there's appreciation for it. Other scars are probably around um, not, not appreciating how important was um, the first, the first go around, um, how deliberate you could be about it and how much of an impact that would have on execution regardless of the company, the mission that's faced. Plenty of lessons learned there. Um, um, and more, the older I get, the more cynical I get. You know the uh, the times where I've made the biggest mistakes is when I really didn't trust my gut. And I don't know how many founders I talk to that uh, say similar things where it's like there is such a balance between this big vision, big bold vision, a big swing because that's what entrepreneurs do. Um, and then the humility of I've never done this before or I haven't seen this before and others have and so I'm going to lean entirely on them and let go of some of my own intuition and gut. It's like that's a, it's a superpower that I think founders have, you know, nowadays but like seeing so much across what's happening in a company or even in the industry and your gut is synthesizing that every single day in a way that I think is a lot of times subconscious. And so if you don't, if you're doing something and it doesn't feel right in your gut, like that's when I have made some of the biggest mistakes. Now they're back.

Dan Desko: Um, let me pick on the culture aspect for a moment if you will, because I think, you know, I'm a big believer in, in culture and uh, uh, tell me, tell me what about the culture at Drata are you most proud of and what would uh, love to hear like give us a little insight into the, in the culture of, of your firm and what you wanted it to be and look like and how well you think you've executed on that, that vision?

Adam Markowitz: Yeah, I think it starts uh, it started living at zero with the DNA of the founders and defining values that were specific to our mission. Right. Um, being really deliberate about that because any, any founding team could sit down and kind of write some values on a whiteboard and everyone feels good about them because the Virtuous things. Um, but how does that, like, how would that whiteboard look different for the company, you know, in the next room over? That's solving a different problem, a different space. It all looked the same at the end of the day. Yeah, I called bs.

Dan Desko: Um, and so trust, integrity, you know, uh, yeah, like.

Adam Markowitz: And so the thought is, okay, obviously these should make you feel good, but they should be very specific to what we're trying to do as a company and the mission that we're. We're on. Um, and that should look unique to us personally. Let's celebrate that. Let's take pride in that. Let's not mince words. Let's be really deliberate. Anytime we try to, you know, sand a sharp, ah, edge down. Why would we do that? No, no, we want to be opinionated and have those sharp edges and, and be really proactive with when it comes to talent acquisition and performance management for existing folks. But if I'm about to start a job at a company, I'm going to know that culture. I want to believe that that's true. That's the things that are recognized, rewarded, and, um, so we took it as far as to let just define the values and explain why they're important to our mission, but then the actual behaviors that we expect that embody those values. Um, because someone can see the word trust as a value. Okay, that means something to me or something to you. How does that actually show up in behavior? Let's give examples. And so, um, we call it the draw rules. And then, uh, there was even talk, there was talking in the company of like, maybe we should just call them principles. No, no, we should call them rules. Let's not get another. We're not going to stand this edge. This is important. Uh, rules. Like the word is deliberate. Uh, but yeah, that, that I am proud of. Um, and it hasn't made any, like, certain things have been harder. Um, it narrows the scope of maybe the talent pool that wants to operate in that kind of environment. But that's. Ultimately, that's a good thing. Depends. For obvious reasons.

Dan Desko: Um, um, and I also love what you said about trusting your gut. I. In fact, I pulled up an old article. There's a, um, the psychologist I follow, I like to read her. Her article. She works with a lot of founders and entrepreneurs. But, um, I remembered, like, when you said trust your gut, she wrote an article on trusting your gut. And, uh, you know the, the one line. Princeton, our instincts and biological. Our instincts are biological and primitive. Princeton studies show that we make our first Impression of not just appearance, but make traits in one tenth of a second. Um, so you know, that's, that's really interesting. Right? Like um, this whole idea, notion of trusting your gut. Some find it kind of funny or fanciful, but I, I'm a true believer in that as well. There's also like some tie in there, uh, too draw it in what you guys are trying to do. Like that helps people trust their gut when you can present actual evidence. Um, when they go to the trust center, right within the first like 10th of a second, you're presented with a very, um, you know, detailed look into an organization's inside. Right. Um, and it really helps people trust their gut much better, right?

Adam Markowitz: Oh yeah, yeah. I mean it's, it's a proactive showcasing of the things that ah, you're likely going to care about and what we're able to do with that. The company of the Drata, um, when you have thousands of them, you have a network, a graph of sorts. Right? Like we are all, almost all of us are either a customer and or vendor of the other company. So we're all kind of connected on this graph. And when we know by looking at the data in aggregate what someone cares about when they go to a trust center for one use case or another, um, even in different parts of the world, um, where someone's eyes go because literally where they're clicking, um, this is all data that then makes these trust centers, the customer of the trust center that much more proactive in what they showcase, how they showcase it, to get to a place of trust as fast as possible. Trust and speed are the name of the game. How do we. I used to say trust is, uh, consistency over time. And I might have heard that From Jeff Weiner LinkedIn A long, long time ago. Um, but it was like, how do we short circuit that? We don't have a lot of time. We need to bring in this new AI vendor, this new product, this new tool. Um, and the longer we wait, the longer it takes us to bring it in, we start losing a lot of our advantage of what we're going to use that tool for now. It's a bottleneck. Trust is a bottleneck. And so how do we short circuit that consistency over time and get to a place of trust much faster to enable the business to grow? Um, these are huge, huge problems. And that's why we get so excited talking about it and waking up every day trying to solve it because it's that important.

Dan Desko: It totally is. And I totally agree. M. I've got to ask you, I want to know, Adam, from your vantage point, uh, what's your take on the call from our quality assurance and in SOC reporting, upholding the quality standards the audit firms follow. Obviously, there's been a lot happening in this, in this part of the world. Um, and I think we've seen trust broken and the importance of trust has been on full display lately. Right. Never you, never more than right now. Um, would love your kind of take on that grander, uh, theme.

Adam Markowitz: Can't, uh, be any more on the nose. Right? We are in the business of trust. Um, you and I, five years ago, when Rod was still just, ah, stealth mode concept, um, talked about this. I think it's one of those soapbox moments, maybe a moment of indication to some degree. Uh, but since the very beginning, we have said one way to be customer zero. We have to walk the walk. This is important no matter what our company is. That's the whole point. Um, but our company is, or our customers are leveraging draw to earn and maintain trust. If we aren't walking the walk and using our own product to do that, then something's wrong. Like we're missing the mark. Um, and when it came to how we work with the very audit firms and auditors that are going to be using the data in your audit to come to this place of certification and audits, um, those convers. There's a reason why we, you and I met when we did, before we even launched, because it was that important for us to draw that line. And we had our declaration of independence, as we called it. Um, yeah, I was talking to investors in the earliest round saying, like, how does this work and is draw doing audits? And I had to be. I realized very quickly how. Just how emphatic I had to be about where that line was, why we drew it there, and why we were never going to budge. Even if there was opportunities to do so, we would never do it. Um, and we never did. And that literally is how we define trust. Like doing the things you say you're going to do. Um, and so it didn't matter if others were. We weren't going to. And, um, that wasn't easy. But that's the whole point. Like, one of our values, integrity doesn't. Doing the right thing is easy when the whole world's watching and doing the right thing, when no one's watching and no one might ever know. That's real integrity. Um, and so these are all things. This is why, again, all these interconnected why culture those values were so important and do that on day zero. Um, because there's moments where quarters can be cut and that's when you meet your values and say, we're not going to.

Dan Desko: I love it, ladies and gentlemen. That is why culture matters. Right? And values matter. Um, you know, the, the health, the longevity, the beliefs that people have, um, in an organization, it's, it's a real thing. Um, I love that so much. Couple, uh, more things as we are starting to wrap up. Uh, this one's kind of a doozy, but I, I'll take your high level thoughts. Um, where's, where's AI going to take GRC in the next couple of years? Like what are, what are some, you know, big things that you're betting on that you feel will happen in the GRC space because of the adoption and the great tools that we have at our disposals now?

Adam Markowitz: Uh, yeah, I mean even two years is hard. Um, I'm not even say five years. No one knows. Um, but uh, I mean, I think we're already starting to see it. Um, we brought automation to a space that had a lot of manual, task driven, task oriented kind of workflows. Um, there's a reason why that was widely adopted, which is fantastic. Now, um, with agents that are able to do so much of this manual work, the job of a GRC practitioner is already changing from doing the work to automating the work to having agents do the work. Um, and they're now more orchestrators where they could set the policy, set the expectation and then let the agents do it. And only surface things where human oversight is necessary. And you can start to see just where that goes over time. Um, our view is even more nuanced just because of, over the last five years building this trust graph, this data graph that has the ability for us to launch our own agents that our customers can use right off the shelf that leverage that data in a way where the agents are able to do things that in a higher either accuracy, velocity, trustworthiness, um, at the end of the day, um, and that's great. We want to meet the customer where they are. Uh, they could use their own agents, they could pull ours off the shelf. But we become this, this layer, uh, we call it the trust wrapper, the trust layer between your companies. Um, so, I mean, it's having an amazing time. I was talking to the team last week at Blake. He told me when we started five years ago that we get this place five years in with thousands of customers and millions of patrols being continuously monitored from the inside out. At the same time, this new magical technology becomes so accessible to leverage that data in a way to deliver value off the charts for our customers. I would have called you crazy. I would have been like, you can't script it that perfectly. And here we are. It's just such an exciting time.

Dan Desko: Oh, it is crazy. I mean, it is crazy to think, you know, just five short years ago

Adam Markowitz: where we are now.

Dan Desko: Um, it feels like a lifetime of change has happened. It's wild stuff. Um, so some closing thoughts and perspectives I'd love to hear. Give us a little window into, um, what you read, what you listen to, what you subscribe to. Would love to hear. Like, are there any books or mental models or things that have been outwardly, like, very helpful to you along the way? Um, or any resource or mentor besides your newsletter? Yeah, besides my great newsletter.

Adam Markowitz: Thank you on LinkedIn. It's great. Um, congrats to you. It's amazing how much you all have done and also such a short amount of time. Uh, it's really been great to be on the sidelines or a partner along the way. But, um, just, um, I now have, uh, kind of a daily wrangling, uh, thanks to some agents that aggregate stuff on it. Again, it's, it's so amazing what you can have. Just learning readily available in a text from my agents or a slack from agents. So I feel like I get a lot from a lot of different places. Um, there's definitely been stuff over the years though, that's more like fundamental, uh, yeah. You know, books like the Speed of Trust. So I can't put a finer point on our whole philosophy and why we exist. I'm a big fan here in San Diego, so. Jocko Willink and team ownership is a signed copy on my shelf. Uh, yeah.

Dan Desko: And, uh, that's super.

Adam Markowitz: Yeah. Yeah. Um, Five Dysfunctions is something that, like, I, I cringe as I say it because it's just so spot on accurate.

Dan Desko: It's so good.

Adam Markowitz: Yeah, it's, it's, it's great.

Dan Desko: Well, the Patrick Lencioni, you know, whole five Dysfunctions, it's all about building trust. I mean, the whole, the whole thing, man.

Adam Markowitz: Um, oh, yes. And just the realization that it's never perfect. No team, no company, nothing. Um, yeah, strive for it. And that's great. You, um, always will. But, uh, yeah, what is.

Dan Desko: His books are great too, because they're all sort of these stories, you know, business fables, if you will. But, um, that, that's what helps me stay engaged in, in those Books.

Adam Markowitz: But, uh, yep, Tumblr makes it, you

Dan Desko: know, kind of wrap things up here. I would love to, um, ask you two more questions. One is, uh, it's my billboard question. So I've had a lot of CISOs on the program and have asked advice from CISO to ciso. What would you put on the billboard? But maybe from more of a entrepreneurial standpoint, founder standpoint, you know, if you. If you had to throw, you know, a great saying out there, um, the folks, uh, that were in your seat five years ago, what would you say?

Adam Markowitz: It's funny this. You just said billboard. Um, we. We have our. Our slogan. To me, I'll answer two different ways. As a company, it's like win with trust.

Dan Desko: It's.

Adam Markowitz: There's three words, and I think it says so much, um, that I won't cheer you up about if I was the founder to founder someone in my shoes five years ago, as you've said, um, yet comfortable being uncomfortable. Um, that's probably the best advice you could give.

Dan Desko: Yeah, yeah, yeah, that rings true. That rings true.

Adam Markowitz: I still tell them, win with trust, because no matter what you're pursuing. Um, yeah, absolutely. A good motto to. To live by. Um, but, yeah, for your own personal mental sanity, I think, uh, getting comfortable, being comfortable is really important. Awesome.

Dan Desko: So cool. Um, well, last but not least, I always love to, uh, ask my guests here to show some gratitude, um, and, you know, eulogize the living, so to speak. Uh, you give me someone, a mentor, a friend, um, your brother, whoever it might be, um, that you would love to shout out, and who knows, maybe future future guests on the show. But, yeah, who would you pay it forward to?

Adam Markowitz: There's so, like, that's. Holy cow. Um, yeah, I mean, even those early sticks, yourself, the other Troy. Both Troy. All the Troys in my life. The, uh, our earliest customers. I mean, there's still customers to this day. I was on the phone with one of them yesterday, Jonathan Jaffe at Lemonade. Um, early impressed customers a good chance on us. Um, and. And still learning and getting feedback. Um, you know, all the CSOs within SVCI, which also took a chance on us, um, putting their money where their mouth is and then being so brutal, which is exactly what I wanted, being brutally honest. Feedback along the way. Um, and then folks I've met, even in the last, like, 12, 18 months, like, uh, Vitaly, when he was at Netflix, Vitalik, he's now at Anthropic, and, um, just incredible. Just experience to let me pick their brain. Everyone I'VE learned from. There's this incessant like just if we have 30 minutes in the calendar, I just pick their. I just like question after question almost like a rapid fire and I, I apologize along the way and probably just. This is great. Um, uh, so yeah, thank you to all of them for letting me ask them a million freaking questions over the years. Um, and so many more that um, not mentioning and go back.

Dan Desko: Yeah, no that, that's wonderful. Um, a lot of great people in, in that mix and um, trust is not earned alone. Right? Trust is definitely uh, a ah, team sport. Like what? Especially when you're building something ah, at scale. Um, is it is ah, 100% a team sport and you guys have done a great job. We've been thrilled to be uh, friends um, and personally have been thankful for our friendship and partnership. It's meant the world. So um, thank you for all the support. Really appreciate you being here, sharing a little bit about your story. I think it's uh, super fascinating and um, I think people are going to be really interested in listening. So really appreciate you uh, Adam and uh, looking forward to uh, the next time we catch up.

Adam Markowitz: Likewise grateful for the friendship, the partnership and the last five years and looking forward to the next bug.

Related episodes across the Index

Other episodes covering the same guests and topics, from across The B2B Podcast Index.

  • From NASA to nine-figure ARR: Adam Markowitz on building Drata, trust and timing in SaaSThe SaaS Revolution Show · features Adam Markowitz68 / 100
  • Why Attribution Models Ignore Missed CallsMarketing Analytics with Fexingo · on CRM integration79 / 100
  • Three interviews: system fragility, operational clarity, and Identity for AI agents - Todd Thiemann, Robin Macfarlane, Kyle Sandy - ESW #471Enterprise Security Weekly · on Third party risk management78 / 100
  • Why Procurement Has Become a Critical Line of Defence Against Cyber RiskPondering Procurement · on Third party risk management78 / 100
  • The Progressive Firm Pod Podcast S2E5: Rolling out tech without rattling clientsAccountingWEB · on Compliance automation76 / 100
  • Building Industry Cred by Saying Yes to Every Opportunity with Domenick D'AndreaModern Financial Advisor · on CRM integration75 / 100

More from The Human Side of Cybersecurity

All episodes →
  • The Human Side of Cybersecurity with Luca Desko | A Special Episode with Dan's Son21 / 100
  • The Human Side of Cybersecurity with Adam Gunnett, VP of BI & Strategy at Busy Beaver63 / 100
  • The Human Side of Cybersecurity with Dawn Cappelli, Head of OT CERT at Dragos78 / 100
  • The Human Side of Cybersecurity with Jamie Giroux, CISO at Platinum Equity59 / 100
  • The Human Side of Cybersecurity with Jon Garza, CISO at PSA BDP68 / 100
Explore the best B2B Engineering & DevTools podcasts →
All The Human Side of Cybersecurity episodes →