Senior Director

Drata adds native support for AIUC-1, the insurance-backed agent standard. Drata, the compliance automation company, announced on July 16, 2026, that its platform now natively supports AIUC-1, a certification standard written specifically for AI agents. The support arrives through the Drata Agentic Trust Management Platform, where the standard's requirements are mapped to Drata's own control framework so that customers can scope, implement, and gather evidence against AIUC-1 inside the compliance program they already run. Drata built the mapping with AIUC, the company behind the standard, and says the support is generally available now. AIUC-1 comes from the Artificial Intelligence Underwriting Company, a San Francisco startup founded in 2024 that describes its business as certifying and insuring AI agents. The standard covers six areas, namely data and privacy, security, safety, reliability, accountability, and society, and it pairs an audited certificate with liability insurance that AIUC says can cover up to $50 million in losses from agent-specific failures. AIUC and Drata describe AIUC-1 as the first standard of its kind, and it draws on existing frameworks such as the NIST AI Risk Management Framework, the EU AI Act, and MITRE's ATLAS to produce requirements an accredited auditor can test against. The significance for GAIG readers runs past the integration itself to what it signals, which is that agent assurance is starting to come with a price tag attached. By wiring an insurance-backed agent standard into a mainstream compliance platform, Drata is betting that enterprises will soon expect an AI agent to arrive with a certificate the way a software vendor arrives with a SOC 2 report. "AIUC-1 is designed to strengthen AI security significantly without overburdening security and GRC teams. By integrating AIUC-1 into Drata, we're taking a big step towards reducing the work required to earn and maintain certification while keeping the bar consistent and high." Rajiv Dattani, Co-founder of AIUC Conditions driving this change. * AI agents are moving from pilots into production, and enterprise buyers want to adopt them while lacking a repeatable way to confirm that a given agent is safe and reliably governed. * Security reviews and procurement stall when a buyer cannot validate an agent, which turns third-party AI evaluation into an ad hoc process that slows deals on both sides of the table. * Broad governance frameworks such as ISO 42001 and the NIST AI Risk Management Framework describe good practice at a high level, and they leave out the agent-specific technical testing that buyers increasingly ask for. * Agent-specific failure modes, including data leakage, prompt injection, jailbreaks, and hallucinations, have no common yardstick, so different teams evaluate the same risks in different ways. * Compliance teams are handed new AI requirements without added headcount, which leaves many of them building programs by hand in spreadsheets because their GRC tools do not support the standard. * The Artificial Intelligence Underwriting Company built AIUC-1 with a consortium of roughly 150 large-enterprise security and risk leaders, which gave the standard early buy-in from the people who sign off on AI purchases. * Insurers have begun underwriting agent-specific risk, and a certificate that opens the door to coverage gives a standard a commercial weight that a framework on its own does not carry. | Organization | Role in AIUC-1 | | AIUC (Artificial Intelligence Underwriting Company) | Author of the standard, which runs the audits and underwrites the insurance tied to certification | | Drata | Compliance automation platform that maps AIUC-1 to its control framework and collects evidence against it continuously | What AI Compliance looked like before this. Until recently, a company that wanted assurance about an AI agent had little to point to. The recognized frameworks were written for management systems and broad risk practice, so ISO 42001 and the NIST AI Risk Management Framework could tell an organization how to govern AI in general terms without saying whether a specific agent resisted a prompt injection or leaked data under pressure. A buyer asking a vendor to prove an agent was safe got a policy document instead of a test result. Compliance teams filled the gap by hand. They took a new AI requirement, built a program for it in spreadsheets, and gathered evidence from scattered systems, because the GRC platforms they already ran had no native support for anything agent-specific. Third-party AI risk was judged case by case, with each reviewer applying personal criteria to the same failure modes. The cost of that improvisation landed on deals. An AI company trying to sell into an enterprise would reach security review and stall, because the buyer had no standard way to confirm the agent was governed and no way to price the risk of being wrong. Assurance existed as an argument rather than as a certificate anyone could check. What it looks like now. AIUC-1 turns that argument into an audit. The standard breaks agent risk into six domains and, within each, sets requirements that an accredited auditor can test using technical evaluations and red-teaming, which produces a certificate a buyer can rely on instead of a promise a buyer has to take on faith. UiPath, for one, went through more than two thousand technical evaluations to earn the certification earlier in 2026. Drata's contribution is to make the standard something a company can run continuously rather than once. With AIUC-1 mapped to its control framework, Drata offers pre-built requirements, controls, and policy templates, and it ties them to continuous monitoring so the evidence stays current as an agent changes. The platform also routes AI-specific risks into its risk register, centralizes audit evidence in one workspace, and lets a company publish its assurance status to customers through a trust center. The part that sets this apart from earlier compliance work is money. Because AIUC underwrites the agents it certifies, the certificate is paired with insurance that AIUC says covers up to $50 million for failures such as hallucinations, data leakage, intellectual property infringement, and tool call errors. A certificate that pays out when it turns out to be wrong carries a different kind of weight than one that only attests. Its take. AI Compliance take. What matters here is the underwriter standing behind the framework, more than the framework itself. The field has no shortage of frameworks, and this one changes the incentives because the same company that certifies an agent also has to pay when that agent fails. That alignment gives the audit a reason to be rigorous, and it is worth more than another set of controls on paper. The cautions are the ones that apply to any young standard. AIUC-1 is recent, its ecosystem of auditors and certified vendors is still small, and the claim that it is the first agent standard is a marketing line that sits alongside other agent efforts from bodies such as the Cloud Security Alliance and OWASP. Buyers should ask what a certificate actually covers, how the insurance pays out in practice, and whether the auditors testing against the standard are genuinely independent, because the value of the certificate rests entirely on those answers. Drata putting native support behind an insurance-backed agent standard is a sign that AI compliance is moving from documentation toward tested, financially accountable assurance, the direction GAIG has argued the whole field is heading. Buyers weighing how to prove an agent is safe, and how to demand the same from their vendors, can compare the platforms and standards in the AI Compliance category at GetAIGovernance.net. Follow GetAIGovernance on LinkedIn

Vanta, Drata, Secureframe, and Oneleet: how the fix-first model is different. An honest comparison of Vanta, Drata, Secureframe, and Oneleet. Each is genuinely good at what it does. None of them remediate findings, which is the one real gap Scadable is built to close. Vanta, Drata, Secureframe, and Oneleet are all real, well-built products, each genuinely good at parts of the compliance workflow. Vanta and Drata lead the category on breadth of frameworks and integrations, with large customer bases and mature self-serve motions. Secureframe competes at the same tier. Oneleet is the closest thing to a consolidated platform, combining AI risk review, code scanning, and pentest bundling. What none of the four do, by their own public product descriptions, is fix what they find. They identify a gap and hand it to a human to close. Scadable identifies the gap and closes it. That is not a knock on any of them. It is the honest shape of the category today, and it is worth naming plainly before making the one comparison that actually matters. What is Vanta actually good at? Vanta is the category leader by customer count, citing more than 16,000 customers and a dense wall of named logos across software companies. Its homepage leads with "trust," positions itself as an "Agentic Trust Platform," and backs that up with quantified time-saved metrics like thousands of hours saved annually and a large share of security questionnaires automated. Vanta's real strength is scale: broad framework coverage (SOC 2, ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, FedRAMP, and more), a large integration catalog, and a self-serve-to-enterprise motion that has clearly worked for thousands of companies. If your need is broad, mature, self-serve coverage across many frameworks today, Vanta is a legitimate answer to that need. What is Drata actually good at? Drata sits at near feature parity with Vanta and uses almost identical language to describe itself, down to calling itself an "Agentic Trust Management Platform." It cites more than 8,500 customers and a 4.8 rating on G2, with its own metrics around audit-prep time reduction and hours saved annually. Like Vanta, Drata's strength is breadth: the same wide framework badge wall, a comparable integration footprint, and a product built for teams that want one dashboard covering everything from evidence collection to auditor-facing documentation. Drata's agentic layer automates evidence gathering and the paperwork that goes with it, which is a real and useful thing to automate well. What is Secureframe actually good at? Secureframe competes in the same tier as Vanta and Drata: evidence collection, continuous control monitoring, and audit-readiness workflows aimed at the same buyer. It is a known, credible option in this category for teams evaluating compliance automation platforms, and belongs in the same conversation as the other three. Its specific product depth is closer to Vanta and Drata's shape than to Oneleet's, built around the same evidence-and-monitoring core loop common to this category. What is Oneleet actually good at? Oneleet is the closest structural comparison to how Scadable is built: a single consolidated platform rather than a dashboard stitched to a separate audit process, combining AI-driven risk assessment, a code scanner, and pentest bundling in one place. It has real traction, a 4.9 rating on G2, more than 1,000 teams, and a $33 million Series A per public reporting. Oneleet's own homepage is also the most candid in the category about where its product stops: it describes its AI as reviewing evidence against control requirements and flagging issues. That is an honest, accurate description of what the tool does, and it is worth taking at face value rather than reading past it. Vanta, Drata, Secureframe, and Oneleet at a glance. | / | Genuine strength | Shared limitation | Scadable's approach | | Vanta | Largest customer base and logo density, deepest framework and integration breadth | Ends at a flagged gap list; remediation is manual | Identifies the gap and closes it | | Drata | Near-parity breadth with Vanta, strong G2 rating, mature agentic evidence automation | Automates the paperwork around a finding, not the fix | Writes the fix, not just the report | | Secureframe | Established, credible player in the same evidence-and-monitoring tier | Same category-wide pattern: evidence collection ends at a human handoff | Closes the finding inside the same pipeline that surfaced it | | Oneleet | Consolidated platform combining AI risk review, code scanning, and pentest referral | Own copy states it flags issues rather than fixing them | Reviews, fixes, and files, not just flags | What is the one real difference? Every one of these four platforms, by its own public positioning, ends at a list. Vanta and Drata's product loops are evidence collection, continuous monitoring, and questionnaire automation, all of which conclude with an open item for someone on your team to go close, in a pull request, a config change, or a Jira ticket outside the platform. Oneleet says this about itself directly: its AI reviews evidence against control requirements and flags issues. Flagging is genuinely useful. It is also, by every one of these four vendors' own description of their own product, where the automation stops. Scadable's product loop does not stop there. It identifies what needs to change, whether that is a missing control for SOC 2, a documentation gap under ISO 27001, or an actively exploited component across a device fleet under the Cyber Resilience Act, and then it writes the control, implements the configuration change, and closes the gap. The finding does not sit in a queue waiting for a human to get to it. That is the difference stated as plainly as it can be: they identify and flag, Scadable identifies and fixes. How does Scadable make sure its evidence can be trusted? Separately from the fix-versus-flag distinction, Scadable treats evidence integrity as a standing principle, not a feature. Every document and every approval Scadable generates lives in its own object storage, hashed, versioned, and write-once-read-many locked once finalized. Every document and approval carries a verification link. Nothing in that pipeline is a Google Doc that can be quietly edited after the fact. This matters because the entire value of compliance evidence is that it holds up to scrutiny months or years later, in front of an auditor or a regulator, exactly as it looked the day it was produced. Evidence that can be silently changed after the fact does not earn that trust, so Scadable's system is built so it cannot be. Frequently asked questions. What is the main difference between Scadable and Vanta, Drata, Secureframe, or Oneleet? All four collect evidence, monitor controls, and flag gaps for a human to close. Scadable closes the gap itself, writing the control, implementing the fix, and filing the report, not just producing a list of what is still open. Is Scadable a Vanta alternative? Scadable is a fix-first alternative for teams that want findings closed, not just flagged. If your priority is broad self-serve multi-framework coverage today across a large integration catalog, Vanta may genuinely be the better fit. If your priority is getting findings remediated, that is what Scadable is built around. Is Oneleet a good product? Yes. Oneleet is a well-built, consolidated platform bundling AI risk assessment, code scanning, and pentest referral, with real traction including a G2 rating of 4.9 and over 1,000 teams. Its own homepage copy describes its AI as reviewing evidence against control requirements and flagging issues, which is the same evidence-and-flag pattern shared across this category. Do Vanta, Drata, Secureframe, and Oneleet fix compliance and security findings automatically? No. All four are evidence-collection, monitoring, and questionnaire-automation platforms. Their product loops end with a list of open findings for a human to remediate, in a ticket, a pull request, or a spreadsheet, outside the platform itself. How does Scadable keep evidence trustworthy? Every document and approval Scadable generates lives in hashed, versioned, WORM-locked storage with a verification link. Once a piece of evidence is finalized it cannot be quietly edited, which matters because compliance evidence only has value if it holds up to scrutiny. Should I switch from Vanta or Drata to Scadable? That depends on what you actually need. If broad multi-framework self-serve coverage across a large number of integrations is your priority today, Vanta or Drata may be the right tool. If your findings keep piling up faster than your team can close them, Scadable is built specifically for that gap. Last reviewed: July 12, 2026. Where Scadable fits. Scadable is not trying to out-feature Vanta, Drata, Secureframe, or Oneleet on framework breadth or integration count. Breadth is table stakes at this point, any well-resourced team can build a wide badge wall and a long integrations list, and all four of these platforms already have. The differentiation is what happens after a gap is found: Scadable writes the fix and closes it, and every piece of evidence it produces is hashed, versioned, and verifiable on its own. If what you need today is broad, self-serve, multi-framework coverage across a mature integration catalog, one of the four platforms above may honestly be the right tool for that job. If what you need is for the findings to actually get closed instead of accumulating in a queue, that is what Scadable does. Book a call to see the fix-first model against your own stack.