Since this 'Drata' thing is intended to keep employees/contractor computers in check with policy requirements, runs as (equivalent of) root, and auto-updates, I assume it must be:
* completely open source
* have gone through security audits with public reports, and a favorable outcome
* have reproducable and verifiable builds, and those are the only ones distributed, and the end user can easily verify that their binary copy is an official build?
Right?
Because if not, aren't you just adding another attack vector onto all your employee/contractor laptops when you use 'Drata' to check a policy box on your SOC2 application?
* completely open source
* have gone through security audits with public reports, and a favorable outcome
* have reproducable and verifiable builds, and those are the only ones distributed, and the end user can easily verify that their binary copy is an official build?
Right?
Because if not, aren't you just adding another attack vector onto all your employee/contractor laptops when you use 'Drata' to check a policy box on your SOC2 application?
[edit: formatting bullet list]