Drata

Adam Markowitz spent seven years at Portfolium, his edtech startup, learning what product-market fit wasn't. He'd built a nice-to-have—a portfolio platform for students and educators—and it showed in every sales conversation. Closing the first five university customers took years of grinding. The real catalyst came from an unexpected source: a CIO at one of those early customers who challenged Adam's security posture, asking pointed questions about compliance and trust. That conversation planted a seed. Years later, when Adam left Portfolium (which sold for $43 million), he began talking to dozens of companies across different industries. The pattern was unmistakable. Every conversation revealed the same pain: compliance was blocking deals. Companies couldn't close enterprise contracts without SOC 2 certification, yet the process was manual, expensive, and opaque. Unlike the edtech world where he'd spent seven years convincing people they needed his product, here prospects were desperate for a solution. Compliance wasn't a nice-to-have—it was a painkiller.

Before writing a single line of code, Adam validated relentlessly. He spoke with dozens of companies and auditors, mapping their workflows and pain points until the initial product scope became obvious through market demand rather than speculation. When he decided to build Drata, he didn't go alone. He reassembled the proven team from Portfolium—the same co-founders, engineers, and go-to-market leaders who'd worked together for seven years. That institutional muscle memory would prove invaluable in compressing execution time across every phase. But Adam made one unconventional choice: Drata refused to accept paying customers until the founding team had used the product to get their own SOC 2 compliant. This wasn't just philosophy—it was credibility insurance. By dogfooding their own tool under real-world conditions, they could speak with authority about what worked and what broke. They'd be their first reference customer, proving the product delivered before asking anyone else to bet on it.

The floodgates opened with surprising force. Once Drata was ready to sell, 100 customers signed in six weeks. By the end of year one, they'd hit 1,000 customers—a velocity that would have been unimaginable in the edtech days. But organic demand wasn't the only engine. Adam pursued a deliberate partnership strategy with AWS, one rooted in "give before you take." Rather than rushing to extract value from the partnership, Drata brought thousands of first-time customers to AWS Marketplace before asking for anything in return. The strategy worked. Within two years, Drata became a top 5 global ISV on AWS Marketplace, building a distribution moat through partner alignment. The Auditor Alliance—Drata's program to work with audit firms—followed the same philosophy: keep partners independent rather than competing with them. Two-thirds of Drata's pipeline now flows through partner channels, a testament to the distribution power of genuine partnership.

The transition from hundreds to thousands of customers surfaced new problems. What broke at 1,000 customers forced the team to rethink operations and product architecture. But the core insight held: compliance was a blocker, not a luxury. That clarity meant sales could be aggressive and intentional—another deliberate design choice. An aggressive sales culture wasn't accidental; it was built to match the market urgency they were seeing. Drata's differentiation came from understanding the full ecosystem. While competitors treated compliance as a point solution, Drata positioned itself as a trust management platform that brought together companies, auditors, and regulators into a cohesive workflow.

Seven years after Portfolium's exit, Drata has become a category leader. The platform serves 8,000+ customers across 60 countries with a team of 600+ employees. The company has raised over $300 million in funding and achieved $100 million ARR before its fourth birthday. The trajectory reflects what true product-market fit looks like: not incremental growth, but viral adoption driven by genuine customer desperation. With compliance becoming embedded in every deal and regulations tightening globally, Drata's position as the trust infrastructure layer positions it for continued expansion into adjacent compliance challenges.