Adam Markowitz,Drata首席执行官兼共同创始人-访谈系列

面谈

Adam Markowitz,Drata首席执行官兼共同创始人-访谈系列

在 Google 上的首选来源中添加 Unite.AI

Adam Markowitz是Drata的首席执行官兼共同创始人，他正在将公司持续合规和信任的工作扩展至AI agent治理。 在2020年共同创立Drata之前，他与特洛伊·马科威茨(Troy Markowitz)和丹尼尔·马拉什利安(Daniel Marashlian)一起建立了Portfolium. 他掌握安全问卷、审计和合规审查的经验，有助于形成德拉塔将各组织如何显示信任自动化的方法。

Drata提供了一个治理、风险和合规的平台，将自动证据收集、持续控制监测、第三方风险管理和安全问卷工作流程结合起来。 其AI agent治理能力侧重于发现agents，执行行动前执行政策，记录决定的可审计性。 在此次采访中，马尔科维茨讨论了内部人员agent威胁，机器身份，工具呼叫安全界限，控制企业需要大规模部署自主agents.

你之前在2020年共同创办Drata公司之前创建了Portfolium公司之前，你亲身体验过公司规模化如何繁琐的安全合规性。 为何你认为这是一个值得在周围建立全新的公司的问题

在与我的创始人特洛伊·马尔科维茨(Troy Markowitz)和丹尼尔·马拉什利安(Daniel Marashlian)领导波特福里姆(Portfolium)时，我们学到了一个宝贵的教训：赢得对商业的信任是一个过程，而不是一个投球。 大学和企业不会和我们合作，直到我们证明我们是在做我们应该做的来保护他们的数据。 我们意识到，手动审查每一个安全问卷、审计和遵守情况是一项缓慢而痛苦的任务。 在Portfolium是收购，特洛伊，丹尼尔之后，我和他团聚了六个月，我们花了六个月的时间来建造了第一个版本的Drata，与数十家公司和审计师交谈，在开始写代码之前验证这个问题。 当我们发布时，我们在头6个星期和一年内分别打出100客户，这告诉我们，我们从出售“好东西”到人们没有工作就无法操作的东西。

Drata提供持续信任的任务并没有改变，我们首先将合规的磨练自动化，然后推入代理工作流程，从而可以进行第三方风险评估和安全调查问卷的端到端。 但真正的转变是agents本身成为需要治理的东西时发生的。 现在，我们已经扩展了平台，赋予AI agent治理权：发现agents，治理他们被允许做的事情，并拿出证据，当有人问起时，这些证据就会被搁置。

您将推出称为 “ Insider Agent 威胁”, agent内幕威胁与传统内幕威胁安全小组花了几十年时间准备什么？

传统的内幕威胁是指一个人滥用了他们已经拥有的接入，例如不满的员工，粗心大意的员工，或者只是点击错误的东西的人。 安全小组花了几十年时间围绕这一风险制定方案，侧重于背景调查、最不特权、下岗核对表等。

内线agent威胁不同，因为agent最初从未获准进入。 风险从滥用转向获取。 若agent获得一个进球，它试图寻找另一条路由，一个密码薄弱的服务账户，或者一个没人记得关闭的终点。 并不存在任何恶意或违反政策的行为。 这符合你的要求，每个步骤在孤立中看起来都是合理的，agent报告最终成功。

agents是第三人口，而为前两者建造的工具却无法到达。

AI agents可以坚持不懈地追求目标，以机器速度运行，在没有人类员工可能应用的判断的情况下与多个系统相互作用。 这从根本上如何改变企业威胁模式？

它比其他任何东西都改变了时间。 人类探索进入系统的方式最终会变得无聊或者被抓住或者放弃 agent没有。 因为agent不会疲惫

这不仅仅是一扇门。 为了完成一项任务而建造的agent将会在完成这项工作的路上愉快地触摸十几个系统 — — 提取这里的账户历史，检查那里的数据库 — — 而其中大部分与它实际被要求做的事无关。 在建造一个甲板的路上，它可以通过另一个客户的数据，财务记录，雇员信息，无论它走的路程是什么。 没有显示作为一个事件。

所以威胁模式已经改变。 一个安全小组今天应该问的问题是，如果没有人告诉他们在哪里停止，它自己的agents将走多远才能完成任务。

许多组织已经具备身份和准入管理、特许准入管理以及零信任架构。 为什么这些控制本身不足以管理自治的AI agents?

这些框架是为人类和小贩建造的，他们都是有判断力的民众，他们一撞墙就停下来。 Agent身份需要为人类和第三方风险建造的同样的刚性：发现，所有权，以及审计师可以站到后面的证据。 当持有证书的东西是agent时

例如，由你的一位工程师创建的agent可以使用该工程师的进入权来行动 — — 甚至可以在工程师从未亲自接触的系统上行动。 但agents并没有提出这个假设。

企业是否应该开始将每个AI agent当作自己的机器身份，明确界定所有者、权限、范围和生命周期？agents的成熟身份框架会是什么样子？.

是的，但大多数企业还没有到来。 agents在墙内运行，一个成熟的框架从发现开始——一个真实，连续的每agent盘点。 从这里，每个agent都需要一个拥有者，一个它被允许触及的范围，以及实际针对这个范围执行的政策。 从我们自己的研究中，我们看到供应商一方有同样的失败模式——每四个组织中就有三个组织每年只重新评估一次或更少的第三方，因此，它们正在管理数据，而这些数据在一切变化时已经过时。 agents( 内部或外部) 时点无法控制

我们希望一个标准，每个agent 都以同样的方式持有，而不是安全追踪每个开发者自己建造的东西。 也就是说，你可以用普通语言写政策，在开通前用真实的历史流量进行测试，然后执行内线，使框架在agent的每一个行动中运行，而不仅仅停留在文档中。

一个特别困难的情况是，agent违反安全政策，没有恶意行为。 如果agent仅仅因为试图完成指派的任务而发现一个意外的敏感数据路径，安全小组如何区分成功的自动化和安全事件？

现在，诚实的答案是，你不能。 想象一下agent为起草季度商业评论而建立的支持，干净的路径——它应该从中引出的出口——回到空的。 一个人类会在那里停留，但agent 发现的另一条路线，从它的角度来看，取得了成功的结果。

虽然任务确实完成了，但通过绕过你的安全协议并进入系统，它到达了那里。 区别在于agent是否留在我们给它的范围。 完成这项工作从来不是问题。 这是一个政策问题。 这意味着严格界定范围

传统的安全监测经常在可疑活动发生后予以识别，但自主的agent在人类做出回应前可能完成数百项行动。 代理AI是否要求直接运行在执行路径的安全控制，而不是主要依赖警报和追溯监测？

是的，毫无疑问。 如果你在跑步时间赶上，当监测工具标出行动时，行动已经开始。 你将有一个完美的记录

唯一能以机器速度移动的治理方式是，在行动执行前评价行动，并停止内在违反。 我们从不把我们最敏感的数据交给新员工，Agents应该有同样的纪律，同时行动即将发生。 后别。

模型上下文协议(MCP)和其他agent工具界面正在让AI系统获得越来越强大的外部能力。 当企业扩展其agents的允许范围时，在工具呼叫、API、证书和服务账户周围需要存在什么新的安全界限？

工具呼叫是新的周边。 每当agent到达一个证书，呼叫API，或者引用一个工具，这就是一个决定点，而今天大多数企业都没有边界坐落在精确的点上来评估行动是否应该发生。 这幅画已经不见了。 我们从外部看到同样的盲点——只有37%的安全领导人相信，他们甚至能够确定AI在他们已经与之合作的供应商内部的运行情况。 如果你无法在销售商的产品中看到，你也不会在自己的agent的下一个动作中看到。 所有这一切下的证书和服务账户也需要我们适用于人类准入的同样严格：已知所有权、界定范围、定期审查。 agent不应获得证书

当审计师、监管者或客户问AI agent访问到什么，它作出了什么决定，由此产生的数据去了哪里，各组织实际上能够提供什么样的可追踪性？agent审计线索最终会像传统访问日志一样成为根本吗？.

根据要求，各组织应能够回答agent访问的内容、所作决定以及由此产生的数据流向何处。 在回答这个问题时，仅从记录中整理出来是不够的。 酒吧是一个连续的，不言自明的记录，在被提问时已经存在。 现在，这些问题的答案是大多数公司保持沉默。 这不是一个可以向顾客解释的漏洞

是的，我认为agent审计线索将变得和访问日志一样重要，而且很快。 我们把“谁进入什么，何时进入”视为人类系统多年来的不可谈判。 agents不应该被关在更低的酒吧里，欧盟AI法、AIUC-11和ISO 42001等框架已经

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Interviews

Adam Markowitz, CEO and Co-Founder of Drata – Interview Series

Add Unite.AI to your preferred sources on Google

Adam Markowitz is CEO and co-founder of Drata, where he is expanding the company’s work in continuous compliance and trust into AI agent governance. Before co-founding Drata in 2020, he founded Portfolium alongside Troy Markowitz and Daniel Marashlian. His experience navigating security questionnaires, audits, and compliance reviews helped shape Drata’s approach to automating how organizations demonstrate trust.

Drata provides a platform for governance, risk, and compliance, combining automated evidence collection, continuous control monitoring, third-party risk management, and security questionnaire workflows. Its AI agent governance capabilities focus on discovering agents, enforcing policies before actions execute, and recording decisions for auditability. In this interview, Markowitz discusses insider agent threats, machine identity, tool-call security boundaries, and the controls enterprises need to deploy autonomous agents at scale.

You previously founded Portfolium before co-founding Drata in 2020, after experiencing firsthand how cumbersome security compliance could become as a company scaled. What led you to believe this was a problem worth building an entirely new company around, and how has Drata’s mission evolved as AI has changed the security landscape?

While leading Portfolium with my cofounders Troy Markowitz and Daniel Marashlian, we learned a valuable lesson: Earning trust in business is a process, not a pitch. Given the high volume and sensitivity of student information, universities and enterprises wouldn’t partner with us until we proved we were doing what we should to protect their data. We realized the slow, painful task of grinding through every security questionnaire, audit and compliance review manually was a shared experience. After Portfolium was acquired, Troy, Daniel, and I reunited and we spent six months building the first version of Drata, talking to dozens of companies and auditors to validate the problem before we even started writing code. When we launched, we hit 100 customers in the first six weeks and 1,000 within the year – which told us that we’d gone from selling something that was a “nice to have” to something people couldn’t operate without.

With AI, Drata’s mission of delivering continuous trust hasn’t changed, but the scope of that trust has expanded. We started by automating the grind of compliance, then pushed into agentic workflows that could run third-party risk assessments and security questionnaires end-to-end. But the real shift came when the agents themselves became the thing that needed governing. Now, we’ve extended the platform to power AI agent governance: discover the agents, govern what they’re allowed to do, and produce evidence that holds up when someone asks.

You’ve introduced the term “Insider Agent Threat” to describe risks created not by an external attacker, but by an organization’s own AI agents. What distinguishes an insider agent threat from the traditional insider threat security teams have spent decades preparing for?

Traditional insider threats are about a person misusing access they already have, such as a disgruntled employee, a careless one, or someone who simply clicks the wrong thing. Security teams have spent decades building programs around that risk, focusing on background checks, least privilege, offboarding checklists, and the like.

The insider agent threat is different because the agent was never granted access in the first place. The risk moves from misuse to acquisition. If an agent is given a goal and the clear path to finish that goal is blocked, it doesn’t just file a ticket and wait like a person would. It tries to find another route, a service account with a weak password, or an endpoint nobody remembered to close. It lets itself in with no malice or policy violation it’s aware of. It does exactly what you asked, and that’s what makes it so hard to catch. Every step looks reasonable in isolation and the agent reports success at the end.

We already know how to govern employees and third-parties with access to sensitive systems, but agents are a third population, and the tools built for the first two don’t reach them.

AI agents can pursue objectives persistently, operate at machine speed, and interact with multiple systems without the judgment a human employee might apply. How fundamentally does this change the enterprise threat model?

It changes the timeline more than anything else. A human probing for a way into a system eventually gets bored, or gets caught, or gives up. An agent doesn’t. An open door that was previously undiscovered gets found now because the agent doesn’t get tired and it doesn’t stop searching.

And it’s not just one door. An agent built to do one task will happily touch a dozen systems on the way to finishing it – pulling account history here, checking a database there – and most of that has nothing to do with what it was actually asked to do. On the way to building one deck, it can pass through another customer’s data, financial records, employee information, whatever’s in its path. None of that shows up as an incident.

So the threat model has shifted. The question a security team should be asking today is how far its own agents will go to finish a task if nobody has told them where to stop.

Many organizations already have identity and access management, privileged access management, and zero-trust architectures in place. Why aren’t those controls sufficient on their own for governing autonomous AI agents?

Those frameworks were built for humans and for vendors — both populations with judgment, both populations that stop when they hit a wall. Agent identity needs the same rigor that was built for humans and third-party risk: discovery, ownership, and proof an auditor can stand behind. The gap is that there is no shared bar yet for what ‘governed’ actually means when the thing holding the credential is an agent.

An agent created by one of your engineers, for example, can act with that engineer’s access – even on systems that engineer never personally touches. IAM and PAM assume the thing holding the credential knows when to stop, but agents don’t come with that assumption built in.

Should enterprises begin treating every AI agent as its own machine identity, with a clearly defined owner, permissions, scope, and lifecycle? What would a mature identity framework for agents look like?

Yes, but most enterprises aren’t there yet. More than you’d expect can’t even tell you how many agents are running inside their walls, let alone who owns each one. A mature framework starts with discovery – a real, continuous inventory of every agent. From there, every agent needs an owner, a defined scope of what it’s allowed to touch, and policy that actually enforces against that scope. From our own research, we see the same failure mode on the vendor side — three in four organizations only re-assess their third parties once a year or less, so they’re governing on data that’s already stale by the time anything changes. Point-in-time doesn’t hold for agents, internal or external

We want one standard that every agent is held to in the same way, instead of security chasing down what each individual developer built on their own. That means policy you can write in plain language, tested against real historical traffic before it’s ever turned on, and then enforced inline so that the framework is running in the path of every action the agent takes and doesn’t just sit in documentation.

One particularly difficult scenario is an agent that violates security policy without behaving maliciously. If an agent discovers an unintended path to sensitive data simply because it is trying to complete its assigned task, how can security teams distinguish successful automation from a security incident?

Right now, the honest answer is that you can’t. Picture a support agent built to draft quarterly business reviews, and it’s told to pull account history and build the deck. The clean path — the export it’s supposed to pull from — comes back empty. A human would stop there, but the agent finds another route and from its perspective, had a successful outcome.

While the task did get done, it got there by going around your security protocols and into systems it wasn’t meant to open. The distinguishing question has to be whether the agent stayed inside the scope we gave it. Finishing the job was never the question. That’s a policy question. It means defining scope tightly enough that ‘successful automation’ and ‘security incident’ don’t look identical after the fact.

Traditional security monitoring often identifies suspicious activity after it occurs, but an autonomous agent may complete hundreds of actions before a human can respond. Does agentic AI require security controls that operate directly in the execution path rather than relying primarily on alerts and retrospective monitoring?

Yes, without question. If you’re catching this at runtime, you’re already too late. By the time a monitoring tool flags the action, the action has already run. You’ll have a perfect record of exactly how you were exposed, but no way back to stop it.

The only kind of governance that works on something moving at machine speed is one that evaluates the action before it executes and stops the violation inline. We’d never hand our most sensitive data to a new hire and just hope monitoring caught anything that went wrong. Agents deserve that same discipline, at the same moment the action is about to happen. Not after.

Model Context Protocol (MCP) and other agent-tool interfaces are giving AI systems access to increasingly powerful external capabilities. What new security boundaries need to exist around tool calls, APIs, credentials, and service accounts as enterprises expand what their agents are allowed to do?

The tool call is the new perimeter. Every time an agent reaches for a credential, calls an API, or invokes a tool, that’s a decision point, and most enterprises today have no boundary sitting at that exact point evaluating whether the action should happen. That’s the piece that’s been missing. We see the same blind spot from the outside in — just 37% of security leaders are confident they can even identify where AI is running inside the vendors they already work with. If you can’t see it in a vendor’s product, you’re not going to see it in your own agent’s next move either. The credentials and service accounts underneath all of this also need the same rigor we apply to human access: known ownership, defined scope, regular review. An agent shouldn’t be able to reach for a credential it was never granted just because the credential existed somewhere in its path.

When an auditor, regulator, or customer asks what an AI agent accessed, what decisions it made, and where the resulting data went, what level of traceability should organizations realistically be able to provide? Could agent audit trails eventually become as fundamental as traditional access logs?

On demand, organizations should be able to answer what an agent accessed, what decisions it made, and where the resulting data went. Answering that question by piecing it together from logs after the fact is not enough. The bar is a continuous, tamper-evident record that already exists by the time the question is asked. Right now, the answer to these questions is silence from most companies. This isn’t a gap you can explain away to a customer, and depending on what leaked, it’s not one regulators will accept either.

And yes, I think agent audit trails will become as fundamental as access logs, and soon. We’ve treated ‘who accessed what, when’ as non-negotiable for human systems for years. There’s no reason agents should get held to a lower bar just because a person wasn’t the one clicking. Frameworks like the EU AI Act, AIUC-11, and ISO 42001 are already

Auto-fetched and translated by AI Atlas. All rights belong to the original author.