Something unusual is happening in the compliance departments of the world’s most sophisticated technology companies. When they need to prove their security posture to close an enterprise deal, they’re not calling Deloitte. They’re not calling PwC. Increasingly, they’re calling startups that didn’t exist five years ago.
The shift is most visible in the booming market for compliance automation—a category that barely had a name in 2020 and now includes multiple unicorns. Vanta, a San Francisco-based platform that automates security certifications like SOC 2 and ISO 27001, raised $150 million last year at a $4.15 billion valuation and now serves more than 12,000 organizations, including Atlassian and Snowflake. Drata, its San Diego-based rival, hit a $2 billion valuation and counts Notion, OpenAI, and Lemonade among its customers.
SecurityPal, a Craft Ventures-backed startup that pairs AI agents with a 24/7 human analyst operation, has quietly amassed a client list that reads like a who’s who of the companies building the AI economy, processing more than $1.5 billion in enterprise contract value annually. And a growing roster of more specialized players is attacking other bottlenecks in the enterprise trust chain—from vendor risk scoring to real-time compliance monitoring.
The pattern is consistent: the most AI-forward enterprises on the planet are choosing startups over institutions. And the startups are delivering.
The Billion Dollar Bottleneck
At the center of this disruption is a deceptively mundane artifact of enterprise commerce: the security questionnaire. These multi-hundred-question due diligence packets—which enterprise buyers require before signing vendor agreements—have become one of the most visible chokepoints in B2B sales. A single review can stall a deal for four to six weeks. Multiply that across a sales pipeline, and the revenue impact becomes enormous.
A 2026 benchmark report from Secureframe found that compliance teams spend an average of eight hours per week on compliance tasks, including evidence collection, documentation, and questionnaire responses. Nearly a quarter of the 250+ security professionals surveyed said audit preparation was their single biggest operational challenge heading into this year.
For fast-moving SaaS companies, that friction is existential. Enterprise buyers now widely require SOC 2 certification before signing contracts with vendors, and the traditional process of achieving that certification can take six to twelve months with legacy consulting firms.
“Annual audits, slow consulting cycles, big teams flying in on a project basis. That’s not how AI companies operate,” said Pukar Hamal, founder and CEO of SecurityPal, a startup that has built a different model for solving this problem. “They need trust assurance that moves at the speed they move. When the best AI minds in the world vote with their contracts, I’d pay attention to what they’re saying.”
SecurityPal—which has completed over two million security questions, 87% on behalf of Fortune 500 companies—represents one approach: a hybrid model that combines AI agents with round-the-clock human analysts. Its client list includes OpenAI, Figma, Snap, and Fortune 500 enterprises.
Vanta and Drata represent another: software platforms that automate compliance from the inside out, connecting directly to a company’s tech stack to continuously monitor controls and collect audit evidence. Vanta says its AI can automatically draft more than 80% of questionnaire responses, with a 95% acceptance rate. Smaller players like Conveyor, SafeBase, and Workstreet have built products around specific pieces of the puzzle—trust centers, questionnaire automation, and vendor risk exchange networks, respectively.
What unites them is the conviction that the legacy model is structurally broken.
The Incentive Problem
The Big Four—Deloitte, PwC, EY, and KPMG—have long dominated enterprise compliance and audit, backed by decades of institutional trust, global relationships, and balance sheets measured in billions. But the startup founders challenging them tend to land on the same diagnosis: the incumbents’ business model is fundamentally misaligned with what modern enterprises need.
“The Big Four make money when compliance is slow and complicated,” Hamal said. “Every hour of friction is billable. SecurityPal makes money when compliance is fast. Our incentives are completely inverted—and that changes everything about how we build product, how we staff our team, how we measure success.”
It’s a pointed critique, but one that resonates across the category. Vanta’s origin story follows a similar logic: founder Christina Cacioppo started the company in 2018 after realizing that compliance automation could drastically reduce the cost and timeline of enterprise certifications. Drata launched during the pandemic and had 100 customers within its first 45 days. The pull was immediate because the pain was immediate.
The numbers tell the story of how fast the market has moved. The global GRC (governance, risk, and compliance) software market is projected to reach $32.8 billion by 2033, with cloud-based platforms featuring automated compliance monitoring emerging as the primary growth catalysts. Vanta’s estimated annual recurring revenue hit $220 million by mid-2025, up from $152 million at the end of 2024. These are infrastructure, not simply niche tools.
“These are companies—OpenAI, Figma, Snap—that have the sharpest procurement teams on the planet,” Hamal said. “They are not picking vendors out of habit or because of a golf relationship. They are picking the tool that actually works.”
Humans Plus Machines, Not Machines Minus Humans
One of the more nuanced dynamics in this market is how the winning companies balance automation with human judgment. Pure software platforms like Vanta and Drata automate evidence collection, control monitoring, and questionnaire drafting—but still require human teams to manage the programs, handle edge cases, and interface with auditors. SecurityPal’s model is more labor-intensive by design, pairing AI agents with more than 150 certified analysts operating 24/7 from what the company calls its Security Operations Command Center in Kathmandu.
“Our agents handle the volume, the repetitive stuff, the 80% that doesn’t require judgment,” Hamal explained. “That frees our human analysts to go deeper on the 20% that actually requires a person.”
The company is explicit that this is not a story of automation replacing people. Headcount in Kathmandu is growing, not shrinking. Hamal describes the transformation as metamorphosis rather than replacement. “A caterpillar doesn’t die when it becomes a butterfly. We’re demonstrating that it’s possible to transform yourself while the clients are watching, and that’s actually the story every professional services company is terrified to have to live through.”
SecurityPal’s geographic bet—running a global trust assurance operation out of Nepal—was initially met with skepticism. Hamal rejects the framing that it’s a cost play, pointing to the country’s deep bench of cybersecurity talent and the structural advantage of time zones: when a customer in San Francisco submits a 300-question security review at 5 p.m., it’s early morning in Kathmandu, and the review is frequently completed before the client’s next workday begins.
“Nepal sends more students per capita to the US than almost any country on Earth,” he said. “We have deeply trained cybersecurity professionals, INTERPOL-verified and certified analysts, people who’ve earned accredited degrees and chose to come home.”
The Moat Question
For all the momentum behind these startups, the obvious question is whether the Big Four will simply build or buy their way back into the market. They have the brand, the relationships, and the capital.
Some argue the threat is overstated—and that the real barrier isn’t technology but the business model.
“The Big Four could hire engineers. They could license AI. But they can’t change their billing model, and they can’t change their incentive structure, which is fundamentally at odds with what customers actually need,” Hamal said. “The most dangerous competitor to the Big Four right now is their own business model. We’re just the beneficiary.”
SecurityPal points to its proprietary dataset—two million annotated security questionnaires accumulated over five years of human-expert review—as a moat that competitors can’t replicate quickly. Drata acquired oak9 to build network effects around trust infrastructure and embed compliance checks directly into development workflows. Vanta has been expanding aggressively into vendor risk management and launched what it calls an “Agentic Trust Platform” that connects compliance, risk, and proof into a single automated system.
The broader cybersecurity startup ecosystem tells a similar story of startups reaching escape velocity before incumbents can respond. Wiz, the cloud security platform founded in 2020, reached $100 million in ARR in just 18 months and was acquired by Google this month for $32 billion. Chainguard, a software supply chain security company founded in 2021, reached a $3.5 billion valuation within four years. Speed of execution, it turns out, is both a product advantage and an entire competitive thesis.
What Comes Next: Trust as Infrastructure
Hamal is already thinking past the current market. As AI agents begin executing commercial transactions autonomously—negotiating contracts, onboarding vendors, making purchasing decisions without human review—the nature of trust assurance will have to change with them.
“The question won’t be ‘can you prove your security before we sign?'” he said. “It’ll be ‘can you prove your security in the same millisecond the agent makes the decision?’ That’s a fundamentally different technical problem.”
This view is echoed broadly across the cybersecurity industry. A recent analysis from GovInfoSecurity warned that agentic AI adoption will outpace its reliability in 2026, with AI agents increasingly provisioning access, moving data, and making decisions on behalf of businesses—often faster than existing security frameworks can evaluate. The implication is that compliance can no longer be episodic; it has to be continuous, embedded, and real-time.
The companies building for that world—whether they’re billion-dollar platforms or bootstrapped operations with command centers on the other side of the planet—are being selected right now.
“What we’re really building is the trust layer that makes enterprise velocity possible,” Hamal said. “Think about what’s happening: every company wants to move at AI speed. But the legacy systems that govern trust, compliance, contracts, vendor relationships—they were built for a world that moved in quarters, not minutes. Someone has to bridge that gap.”
The Big Four, for now, are watching from the other side of it.
