{"slug":"drata-8cj7nc","companyName":"Drata","domain":"drata.com","url":"https://drata.com","headline":"Drata blocks automated clients at the door while serving real browsers, forcing assistants to drive a browser instead of reading the site directly.","compositeScore":41,"humanScore":56,"agentScore":26,"doorGap":30,"humanMeasured":4,"agentMeasured":5,"percentile":null,"humanPercentile":null,"agentPercentile":null,"isPartial":false,"depth":"free","siteClass":"unknown","scannerVersion":12,"scannedAt":"2026-09-08T14:11:51.441Z","unlocked":false,"mission":{"steps":[{"url":"https://drata.com","outcome":"blocked","purpose":"reach the site at all"},{"url":"https://drata.com/robots.txt","outcome":"ok","purpose":"find out whether machines are welcome"},{"url":"https://drata.com","outcome":"ok","purpose":"ask whether the door opens for requests carrying the AI crawlers' names"},{"url":"https://drata.com/llms.txt","outcome":"ok","purpose":"read the site's own guide for language models"},{"url":"https://drata.com","outcome":"blocked","purpose":"find out what pages exist"},{"url":"https://drata.com/.well-known/security.txt","outcome":"missing","purpose":"find a contact route for machines"},{"url":"https://drata.com","outcome":"missing","purpose":"find a published agent interface"},{"url":"https://drata.com/.well-known/ai-plugin.json","outcome":"missing","purpose":"find an agent plugin manifest"},{"url":"https://drata.com","outcome":"missing","purpose":"find out whether verified agents are recognised"},{"url":"https://drata.com","outcome":"missing","purpose":"read the homepage as data rather than as a page"},{"url":"https://drata.com","outcome":"missing","purpose":"find a machine readable API spec"},{"url":"https://drata.com","outcome":"missing","purpose":"read the developer documentation"},{"url":"https://drata.com/pricing","outcome":"blocked","purpose":"read the prices without running JavaScript"},{"url":"https://drata.com/demo","outcome":"ok","purpose":"walk the way a visitor would, to a signup form or a product"}],"verdict":"The site refused automated access at drata.com, so the agent could not reach the site at all."},"observations":null,"dimensions":[{"key":"machine_discoverability","audience":"agent","score":43,"summary":"Robots.txt names 10 AI crawlers and allows them, a real browser is served the page normally, no sitemap, no schema.org markup, llms.txt is published, a declared intent for assistants, a key page turns the honest client away while serving a.","evidence":{"locked":true,"count":4}},{"key":"programmatic_onboarding","audience":"agent","score":10,"summary":"No API documentation is linked from the homepage in raw HTML or rendered page. No OpenAPI spec exists at any of the 5 standard paths checked. The signup form itself is reachable by browser but offers no programmatic alternative for.","evidence":{"locked":true,"count":3}},{"key":"pricing_legibility","audience":"agent","score":null,"summary":"Could not verify: this scan did not reach the pages that would show it.","evidence":{"locked":true,"count":1}},{"key":"agent_aware_instrumentation","audience":"agent","score":20,"summary":"Robots.txt names 10 AI crawlers explicitly and allows them, showing awareness of agent traffic. No MCP manifest exists at any of the 3 standard paths checked. No Web Bot Auth signals are published.","evidence":{"locked":true,"count":4}},{"key":"machine_fetchable_trust","audience":"agent","score":15,"summary":"No security.txt file exists at /.well-known/security.txt. The homepage refuses automated clients outright with HTTP 403, blocking the most basic trust signal: the ability to fetch and read the site's own published policies.","evidence":{"locked":true,"count":2}},{"key":"commercial_rails","audience":"agent","score":40,"summary":"A self-serve signup form is reachable 2 steps from the homepage at drata.com/demo. The form asks for 18 fields with 10 required, and does not ask for payment information.","evidence":{"locked":true,"count":2}},{"key":"steps_to_first_value","audience":"human","score":80,"summary":"The primary call to action 'Get Started' leads to a signup form in 2 steps from the homepage. The form is rendered and functional in a real browser.","evidence":{"locked":true,"count":1}},{"key":"required_fields","audience":"human","score":25,"summary":"The signup form contains 18 total fields, of which 10 are marked required: First Name, Last Name, Company Name, Work Email, and Number of Employees appear twice in the field list.","evidence":{"locked":true,"count":1}},{"key":"verification_walls","audience":"human","score":65,"summary":"No verification requirement appears on the signup page itself. The form collects email and name but does not show email confirmation, phone verification, or identity checks as blocking steps.","evidence":{"locked":true,"count":1}},{"key":"error_recovery","audience":"human","score":54,"summary":"10 of 24 form inputs carry validation rules, meaning 42 percent of fields have constraints. No inline error containers or live regions were detected on the form, so error feedback mechanism could not be verified.","evidence":{"locked":true,"count":1}}],"issues":[{"rank":1,"title":"/, /pricing turn the honest automated client away while serving a real browser, so the search crawlers that would cite the page are turned away by a rule about the client.","dimensionKey":"machine_discoverability","evidence":{"locked":true,"count":1},"fix":null},{"rank":2,"title":"No API documentation or OpenAPI specification is published, blocking programmatic onboarding for agents and integrations.","dimensionKey":"programmatic_onboarding","evidence":{"locked":true,"count":3},"fix":null},{"rank":3,"title":"No security.txt file is published, leaving no machine-readable security contact or policy for agents and researchers to discover.","dimensionKey":"machine_fetchable_trust","evidence":{"locked":true,"count":3},"fix":null}],"fixArtifacts":{"locked":true,"count":4,"summaries":[{"id":"bot_wall_guidance:notes","kind":"bot_wall_guidance","title":"Let verified assistants through","path":"notes","effort":{"minutes":60,"role":"developer"},"outcome":{"dimension":"machine_discoverability","external":["Assistant shopping and search crawlers reach the product, pricing and policy pages a buyer asks about."]}},{"id":"organization_jsonld:homepage","kind":"organization_jsonld","title":"Organization structured data","path":"homepage","effort":{"minutes":15,"role":"developer"},"outcome":{"dimension":"machine_discoverability","external":["Search and assistant crawlers read the company entity from the homepage rather than inferring it."]}},{"id":"interfaces_note:notes","kind":"interfaces_note","title":"Machine interfaces: where you stand","path":"notes","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"agent_aware_instrumentation","external":["The developer surface is built in an order where every published pointer answers."]}},{"id":"security_txt:well-known-security-txt","kind":"security_txt","title":"security.txt","path":"/.well-known/security.txt","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"machine_fetchable_trust","external":["Researchers and automated scanners find a disclosure address instead of guessing one."]}}]},"feedback":{"endpoint":"/api/feedback","mcpTool":"rate_fix","targets":[{"type":"report","key":"report"},{"type":"dimension","dimensionKey":"machine_discoverability","key":"dimension:machine_discoverability"},{"type":"dimension","dimensionKey":"programmatic_onboarding","key":"dimension:programmatic_onboarding"},{"type":"dimension","dimensionKey":"pricing_legibility","key":"dimension:pricing_legibility"},{"type":"dimension","dimensionKey":"agent_aware_instrumentation","key":"dimension:agent_aware_instrumentation"},{"type":"dimension","dimensionKey":"machine_fetchable_trust","key":"dimension:machine_fetchable_trust"},{"type":"dimension","dimensionKey":"commercial_rails","key":"dimension:commercial_rails"},{"type":"dimension","dimensionKey":"steps_to_first_value","key":"dimension:steps_to_first_value"},{"type":"dimension","dimensionKey":"required_fields","key":"dimension:required_fields"},{"type":"dimension","dimensionKey":"verification_walls","key":"dimension:verification_walls"},{"type":"dimension","dimensionKey":"error_recovery","key":"dimension:error_recovery"},{"type":"issue","dimensionKey":"machine_discoverability","checkId":"bot_walls","key":"issue:machine_discoverability:bot_walls"},{"type":"issue","dimensionKey":"programmatic_onboarding","checkId":null,"key":"issue:programmatic_onboarding:-"},{"type":"issue","dimensionKey":"machine_fetchable_trust","checkId":null,"key":"issue:machine_fetchable_trust:-"}]}}