Drata debuts agentic Third-Party Risk Management to replace checkbox scoring with evidence-backed, defensible vendor risk decisions. Drata's standalone Third-Party Risk Management solution automates vendor review end-to-end, cutting assessment time to minutes and expanding coverage across the entire vendor portfolio. Sep 17, 2026 Prev Next 1 of 43,735 Drata, the leading Agentic Trust Management Platform, announced its Third-Party Risk Management (TPRM) product is now available for the first time as an independent solution. Built around an agentic assessment engine, Drata TPRM is designed to replace static, point-in-time vendor scoring with continuous, evidence-backed risk decisions that hold up to scrutiny at any scale. Resolving the Visibility Gap Companies rely on third-party technology more than ever to scale - and AI accelerates that reliance exponentially. Yet most GRC programs struggle to thoroughly assess each vendor. According to the Drata State of GRC in the Age of AI Report, 75% of GRC leaders say the pace of AI adoption is outpacing their teams' ability to properly vet third parties. Thorough, manual vendor reviews consume hundreds of hours, stealing critical time and attention away from the security team. As a result, in-depth reviews are often reserved for just the 10-20% most critical vendors, leaving up to 90% of the average company's third-party portfolio assessed with far less rigor, accumulating unmeasured risk. Even worse, findings from an upcoming Drata report shows 76% of organizations re-assess their third-party partners and vendors no more often than once a year. With TPRM, Drata delivers: * Defensible decisions, at every stage. Every result - inherent and residual assessment - comes with the reasoning and evidence behind it, so when an auditor asks why, there's something specific to point to, not a black box score. * Consistent judgment, every vendor. Consistent standards are applied by the agent to vendor #1 and vendor #1,000, across the vendor lifecycle - removing the judgment drift that comes from different reviewers, or the same reviewer on a different day. * Hundreds of hours saved. The agent does the reading, mapping, and measuring first, so the reviewer's time goes to confirming a finished result instead of manually assessing information for every vendor in the portfolio. Priyanka Chaudhary, Head of GRC at Brex, shares: "Drata's TPRM Agent allows us to level up our security risk management program across the board by reducing manual work and letting us focus on the risks that matter." Allan Silva, Senior GRC Lead, adds it's made the team "a lot more productive while also improving the quality of our reviews." The Drata Difference Historically, third-party risk solutions reduce vendor risk to binary logic - yes/no questions to business owners or a checkbox for a questionnaire answer. This approach trades away the context needed for a holistic view into a vendor's risk profile. What sets Drata apart: * Natural-language judgment: Instead of forcing inherent risk into a dropdown or checklist, Drata's agent applies the customer's own natural-language standards, weighing multiple factors together in context, the way a practitioner actually assesses a vendor. * Evidence-backed, defensible results: Every assessment comes with the reasoning and evidence behind it, providing specific material to point to when a decision is questioned. * Validated residual risk vs. open-ended guesswork: Where other tools generate questionnaire answers with no baseline to check for accuracy, Drata's agent assesses all vendor evidence and questionnaire responses against customer-defined standards and returns evidence citations, assessment results, and a calculated risk score. * Consistent judgment at scale: The same rigor applies to vendor #1 and vendor #1,000, removing the drift that comes from different reviewers, or the same reviewer on a different day. * Infinite vendors: Drata doesn't price Agentic TPRM by vendor count. Every vendor gets a free inherent risk assessment, so customers can score their entire portfolio without limits, paying only when a vendor needs a full security review. "The pace of AI adoption today means organizations must abandon the antiquated notion of periodic check-ins, and quickly implement continuous judgment applied at scale," said Adam Markowitz, Cofounder and CEO of Drata. "Facing a colossal tech stack with insufficient hours or headcount for rigorous vetting, we built agentic TPRM to remove these trade-offs, giving every vendor the same depth of scrutiny without sacrificing rigor or accuracy."

Pine AI partners with Drata to advance SOC 2 readiness. Pine AI is working with Drata to advance SOC 2 readiness, organize security controls and evidence, and prepare for independent review. Pine AI has partnered with Drata to advance its SOC 2 readiness program. The engagement brings a platform for organizing audit evidence, monitoring controls, and managing policies to the security work behind Pine's AI assistants. When you ask Pine to resolve a billing issue, follow up with a service provider, or coordinate work for your business, you are trusting it with information and permission to act on your behalf. Its work with Drata supports a practical goal: making the processes behind that trust more consistent, documented, and ready for independent review. Why security matters for an assistant that takes action. Pine helps people get work done through calls, emails, and follow-ups. Each task creates decisions about information: what is needed, who should have access, which service needs to receive it, and what should be retained afterward. Take a request to resolve a bill. Identifying the issue, communicating with a provider, and recording the outcome are distinct steps. Each needs a clear purpose and appropriate boundaries around the information involved. These questions matter to individuals using Pine AI and teams exploring Pine for Business. As its assistants take on more work, its approach to access, documentation, and oversight needs to develop alongside them. Why Pine chose Drata. Drata's SOC 2 platform helps teams collect evidence, monitor controls, manage policies, and collaborate with auditors. It brings those activities into a shared workspace so a compliance program can be maintained over time. For Pine, the value is connecting security responsibilities to records that can be reviewed. An access policy, for example, needs an owner, a review process, and evidence that the reviews happened. Organizing those pieces together makes it easier to see what is in place and what still needs attention. Drata supports that preparation. The SOC 2 examination itself is performed by an independent auditor. Building trust with Drata. Its first steps toward SOC 2 readiness. Its team began Drata onboarding in August 2026, with account management support and enrollment in its Compliance Accelerator Program. Since then, Pine has: * Completed initial onboarding inputs: submitted its onboarding questionnaire and connected relevant third-party accounts to support readiness work. * Started kickoff and audit coordination: begun working through initial guidance and auditor selection for its first SOC 2 examination. The next phase focuses on clarifying the audit scope, reviewing controls and supporting evidence, addressing gaps, and preparing for the independent examination. Pine will share further milestones as the program progresses. What SOC 2 means for Pine's users. SOC 2 is an examination of a service organization's controls against the applicable AICPA Trust Services Criteria. Those criteria address security, availability, processing integrity, confidentiality, and privacy, with the examination covering the categories relevant to its scope. For Pine, the readiness process means assigning responsibility, documenting how controls work, and assembling evidence for independent review. For people considering an assistant for personal or business tasks, the aim is greater clarity about how the organization behind that assistant manages its responsibilities. The data governance principles guiding its work. Its security page describes Pine's commitment to data minimization and purpose limitation. Its readiness work builds on the practical questions those principles raise: * What information does the task require? A communication preference and a sensitive identifier serve different purposes. That difference should guide decisions about access, exposure, and retention. * Who needs access, and why? Access should support a defined role or task, with clear boundaries for people, systems, and service providers. * Who is responsible for checking the process? Policy ownership, access reviews, vendor oversight, and incident response need accountable owners and records of follow-through. * Can users understand the explanation? People should be able to understand what an assistant needs to do a job and how their information is handled. The compliance program gives Pine a structured way to examine these questions as Pine grows. Building trust through ongoing work. Its goal is to make Pine an assistant people feel comfortable relying on for meaningful tasks. That requires useful capabilities, careful information handling, and regular review of the practices behind the product. Working with Drata gives its team a more organized path toward independent assurance. Pine look forward to sharing what comes next. For security questions or to report a potential vulnerability, contact [email protected]. Visit Security at Pine for its responsible disclosure process. About Pine AI. Pine AI helps people and businesses delegate everyday work, including calls, emails, and follow-ups. Learn more at 19pine.ai or explore Pine for Business.

Pine AI partners with Drata to advance SOC 2 readiness. Pine AI is working with Drata to advance SOC 2 readiness, organize security controls and evidence, and prepare for independent review. Last edited on Sep 15, 2026 Pine AI has partnered with Drata to advance its SOC 2 readiness program. The engagement brings a platform for organizing audit evidence, monitoring controls, and managing policies to the security work behind Pine's AI assistants. When you ask Pine to resolve a billing issue, follow up with a service provider, or coordinate work for your business, you are trusting it with information and permission to act on your behalf. Its work with Drata supports a practical goal: making the processes behind that trust more consistent, documented, and ready for independent review. Why security matters for an assistant that takes action. Pine helps people get work done through calls, emails, and follow-ups. Each task creates decisions about information: what is needed, who should have access, which service needs to receive it, and what should be retained afterward. Take a request to resolve a bill. Identifying the issue, communicating with a provider, and recording the outcome are distinct steps. Each needs a clear purpose and appropriate boundaries around the information involved. These questions matter to individuals using Pine AI and teams exploring Pine for Business. As its assistants take on more work, its approach to access, documentation, and oversight needs to develop alongside them. Why 19Pine Pte. Ltd. chose Drata. Drata's SOC 2 platform helps teams collect evidence, monitor controls, manage policies, and collaborate with auditors. It brings those activities into a shared workspace so a compliance program can be maintained over time. For Pine, the value is connecting security responsibilities to records that can be reviewed. An access policy, for example, needs an owner, a review process, and evidence that the reviews happened. Organizing those pieces together makes it easier to see what is in place and what still needs attention. Drata supports that preparation. The SOC 2 examination itself is performed by an independent auditor. Building trust with Drata. Its first steps toward SOC 2 readiness. Its team began Drata onboarding in August 2026, with account management support and enrollment in its Compliance Accelerator Program. Since then, 19Pine Pte. Ltd. has: * Completed initial onboarding inputs: submitted its onboarding questionnaire and connected relevant third-party accounts to support readiness work. * Started kickoff and audit coordination: begun working through initial guidance and auditor selection for its first SOC 2 examination. The next phase focuses on clarifying the audit scope, reviewing controls and supporting evidence, addressing gaps, and preparing for the independent examination. 19Pine Pte. Ltd. will share further milestones as the program progresses. What SOC 2 means for Pine's users. SOC 2 is an examination of a service organization's controls against the applicable AICPA Trust Services Criteria. Those criteria address security, availability, processing integrity, confidentiality, and privacy, with the examination covering the categories relevant to its scope. For Pine, the readiness process means assigning responsibility, documenting how controls work, and assembling evidence for independent review. For people considering an assistant for personal or business tasks, the aim is greater clarity about how the organization behind that assistant manages its responsibilities. The data governance principles guiding its work. Its security page describes Pine's commitment to data minimization and purpose limitation. Its readiness work builds on the practical questions those principles raise: * What information does the task require? A communication preference and a sensitive identifier serve different purposes. That difference should guide decisions about access, exposure, and retention. * Who needs access, and why? Access should support a defined role or task, with clear boundaries for people, systems, and service providers. * Who is responsible for checking the process? Policy ownership, access reviews, vendor oversight, and incident response need accountable owners and records of follow-through. * Can users understand the explanation? People should be able to understand what an assistant needs to do a job and how their information is handled. The compliance program gives 19Pine Pte. Ltd. a structured way to examine these questions as Pine grows. Building trust through ongoing work. Its goal is to make Pine an assistant people feel comfortable relying on for meaningful tasks. That requires useful capabilities, careful information handling, and regular review of the practices behind the product. Working with Drata gives its team a more organized path toward independent assurance. 19Pine Pte. Ltd. look forward to sharing what comes next. For security questions or to report a potential vulnerability, contact [email protected]. Visit Security at Pine for its responsible disclosure process. About Pine AI. Pine AI helps people and businesses delegate everyday work, including calls, emails, and follow-ups. Learn more at 19pine.ai or explore Pine for Business. Calls, negotiations, filling forms and more - Pine takes care of work and life.