# Drata: 30 point Door Gap
- Site: drata.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: unknown
- Report: https://www.seconddoor.io/r/drata-8cj7nc
- Scanner version: 12
Drata blocks automated clients at the door while serving real browsers, forcing assistants to drive a browser instead of reading the site directly.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 56/100 |
| Agents | 26/100 |
| Composite | 41/100 |
| Door Gap | 30 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The site refused automated access at drata.com, so the agent could not reach the site at all.
- blocked reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- blocked find out what pages exist
- missing find a contact route for machines
- missing find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- missing read the homepage as data rather than as a page
- missing find a machine readable API spec
- missing read the developer documentation
- blocked read the prices without running JavaScript
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **/, /pricing turn the honest automated client away while serving a real browser, so the search crawlers that would cite the page are turned away by a rule about the client.** (machine_discoverability)
2. **No API documentation or OpenAPI specification is published, blocking programmatic onboarding for agents and integrations.** (programmatic_onboarding)
3. **No security.txt file is published, leaving no machine-readable security contact or policy for agents and researchers to discover.** (machine_fetchable_trust)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/drata-8cj7nc
## Files generated from this scan
- **Let verified assistants through** at `notes`, 1 hour, developer. Verify: The next scan opens the homepage and the key pages in a real browser and under the search crawler names, and every one is served.
- **Organization structured data** at `homepage`, 15 minutes, developer. Verify: The next scan reads Organization and WebSite nodes in the homepage JSON-LD and the structured data check passes.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/drata-8cj7nc
## The agent door
- **machine_discoverability** 43/100. Robots.txt names 10 AI crawlers and allows them, a real browser is served the page normally, no sitemap, no schema.org markup, llms.txt is published, a declared intent for assistants, a key page turns the honest client away while serving a.
- **programmatic_onboarding** 10/100. No API documentation is linked from the homepage in raw HTML or rendered page. No OpenAPI spec exists at any of the 5 standard paths checked. The signup form itself is reachable by browser but offers no programmatic alternative for.
- **pricing_legibility** null/100. Could not verify: this scan did not reach the pages that would show it.
- **agent_aware_instrumentation** 20/100. Robots.txt names 10 AI crawlers explicitly and allows them, showing awareness of agent traffic. No MCP manifest exists at any of the 3 standard paths checked. No Web Bot Auth signals are published.
- **machine_fetchable_trust** 15/100. No security.txt file exists at /.well-known/security.txt. The homepage refuses automated clients outright with HTTP 403, blocking the most basic trust signal: the ability to fetch and read the site's own published policies.
- **commercial_rails** 40/100. A self-serve signup form is reachable 2 steps from the homepage at drata.com/demo. The form asks for 18 fields with 10 required, and does not ask for payment information.
## The human door
- **steps_to_first_value** 80/100. The primary call to action 'Get Started' leads to a signup form in 2 steps from the homepage. The form is rendered and functional in a real browser.
- **required_fields** 25/100. The signup form contains 18 total fields, of which 10 are marked required: First Name, Last Name, Company Name, Work Email, and Number of Employees appear twice in the field list.
- **verification_walls** 65/100. No verification requirement appears on the signup page itself. The form collects email and name but does not show email confirmation, phone verification, or identity checks as blocking steps.
- **error_recovery** 54/100. 10 of 24 form inputs carry validation rules, meaning 42 percent of fields have constraints. No inline error containers or live regions were detected on the form, so error feedback mechanism could not be verified.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp