In just a few years, Drata has grown to more than 700 employees, all while its IT team has held steady as a team of five. As adoption of SaaS and AI tools became more decentralized across the company, their team needed a way to keep pace with employees signing up for new tools on their own, without slowing the business down or ballooning their headcount.
On top of the manual chasing, gaps in visibility of employee-adopted apps meant the IT team didn't always know which apps existed, who owned them, or whether they'd been vetted.
“Before Nudge, we were missing a lot of tools that people were signing up for," explains Gordon Nhieu, Senior IT Manager at Drata. "And, it was a hassle messaging people throughout the company—like, hey, what are you using this for? What data do you plan to put in here? Has this been approved by legal, security, and all that stuff? That was just extremely painful."
The IT team wanted a platform that was easy to use for both IT and for the end users being asked questions about the tools they were using. Nudge Security's ability to automatically reach out to employees, rather than requiring the IT team to track people down manually, is one of the first things that stood out.
Since adopting Nudge Security in November 2024, Drata's IT team has used it to close the visibility gaps left by their old tool, automate employee follow-up through Slack nudges, track OAuth grants and AI/MCP usage, and speed up both offboarding and security incident response, all without adding headcount.
Gordon found that nudges were very effective at scale. "One of the things that I really like about Nudge is that we can set up workflows to “nudge” users and ask “hey, why did you sign up for this tool?”, or “could you use this approved app instead?” That lowers the burden on our team a lot."
"One of the ways we use Nudge is to detect who was the first user for a shadow IT tool. There’s a really great timeline for that, which is amazing to see, because a lot of times you're chasing ghosts when you're trying to figure out who's using what. Nudge doesn't make you chase ghosts, you already found the ghost."
Drata found 20% more tools in use across their org with Nudge Security than with their previous shadow IT tool, and the app inventory indicates who first introduced the tool so they can easily engage the right user to get more context on why it’s needed and how it’s used. That same visibility extends to unsanctioned cloud infrastructure, like employees spinning up their own GCP or AWS accounts outside IT's purview.
As a fully remote company, Gordon worried that automated Slack messages would just add to employee fatigue. Instead, Drata's employees responded to nudges at a much higher rate than he expected.
That response rate turned governance into a two-way conversation instead of a one-sided chase, no more manual follow-up emails or Slack DMs from Drata's IT team just to get a straight answer.
"We got a pretty good response rate to nudges, around 60 to 70 percent," says Gordon. "It reduced a lot of manual work for our team to follow up with people, and it made it a lot easier for us to understand why we have a tool and how it's being used."
With an AI-first culture internally, Drata has centralized most AI usage around a couple of sanctioned tools while still giving employees room to experiment with others.
Gordon relies on Nudge Security's AI dashboards to see which departments and tools have the highest AI usage, and to track every MCP connection employees are making across the company.
Nudge Security also automatically classifies every SaaS tool it finds based on its AI functionality, saving Gordon from having to research and classify each app himself.
"I've been using the AI dashboard in Nudge a lot to see what departments are playing around with the most AI tools, which tools have the highest amount of usage in the company, and being able to see all the MCP grants that people are making, making sure people are using the MCPs we're allowing within the company."
Previous tools used by Drata's IT team left gaps in visibility, making it difficult to ensure all access was revoked when employees left the organization.
Additionally, not every application Drata uses supports SCIM provisioning, which means offboarding still requires some manual cleanup. Nudge Security gives the IT team a clear list of exactly which accounts need to be deprovisioned for a departing employee.
"Offboarding is another key use case," says Gordon. "It’s important to have the full list of tools people are using when they leave so we can make sure we revoke all access. Not every tool provides SCIM provisioning, so there’s still manual work without a tool like Nudge."
Nudge Security includes an offboarding playbook to walk users through deprovisioning access beyond what can be done via SCIM or an SSO tool. The playbook automates changing passwords for accounts using username/password authentication, revoking OAuth grants, transitioning ownership for apps where the departing employee is the technical contact, and a long tail of other commonly overlooked tasks.
While IT is the primary owner of Nudge Security at Drata, the security team also relies on it during incident response and vendor breach investigations.
When a security incident impacts an application that Drata uses or one in their supply chain, Nudge sends an alert which the security team gets so they can immediately begin triage and response operations.
"Nudge helps other teams like security because they can see who's using what apps and what grants people have given," says Gordon. "You don't have to go digging through Google Workspace logs to see what's what—you get full visibility, you can triage it really quickly, and you can revoke the OAuth grant right within Nudge, which is pretty impressive."
By replacing manual shadow IT investigations with automated discovery and Slack-based employee nudges, Drata’s 5-person IT team gained the visibility and automation needed to govern SaaS and AI sprawl as they grew to 700+ employees, without slowing the business down or adding headcount.
With Nudge Security, the team uncovered 20%+ more apps than their previous tool, consistently drove 60–70% response rates to nudges, and built a reliable view of OAuth grants and AI/MCP usage. The result is a scalable governance program that keeps experimentation moving fast while ensuring IT and security can quickly assess risk, strengthen security posture, and respond quickly when issues arise.
"We built automations to help scale our processes as we went from around 200 employees to over 700. That's how we were able to keep a very lean IT headcount-to-employee ratio for the company."
