Introduction
From control evidence to financial exposure.
Connect X-Analytics to Drata, and this agent turns your control results into an informed framework profile and a prioritized list of actions, each with the exposure it buys down.
Bob Vescio, Chief Innovation Officer of X-Analytics, walks through the NIST CSF Informed by Drata agent in the X-Analytics AI Toolbox.
What it does
The NIST CSF Informed by Drata agent is an AI agent in the X-Analytics AI Toolbox that reads your Drata Control Framework results, uses them to inform your NIST CSF 2.0 or CIS CSC 8.1 profile, and returns your cyber risk exposure in financial terms with a prioritized list of actions.
The result is a direct line from the control evidence you already produce to the financial exposure it represents and the actions that reduce it.
It runs on a Drata connection, which you set up once (our setup guide walks through the four steps). Because Drata confirms control implementation rather than measuring control performance, it informs your control effectiveness up to a defined ceiling, and the agent is clear about where that line sits.
How it works
- Select your workspace. The agent asks which Drata workspace to read. Teams often keep several, separated by business unit or audit scope. You pick the one that represents the entity your profile measures.
- Watch the alignment run. The agent works through the framework subcontrol by subcontrol, aligning each to the DCFs that speak to it. In the CIS run, 1.1 aligns to DCF 20, 1.2 aligns to DCF 182, and so on through all 18 controls.
- Review, override, and commit. The agent places each informed value beside the one your profile holds today, so you see every delta before anything changes. Override where your own evidence says otherwise, then approve.
One design decision is worth understanding, because it is where compliance evidence and risk measurement meet. Drata answers a precise question continuously and with evidence: is this control implemented. Control effectiveness answers a wider question, accounting for how well a control operates, how consistently it holds, and how much of the attack chain it covers.
| Control implementation status | Control effectiveness | |
|---|---|---|
| Question answered | Is the control in place? | How much risk does the control reduce? |
| Evidence behind it | Continuous monitoring, evidence-backed | Implementation evidence, plus testing results, coverage, and operational history |
| How it reads | Ready or not present | A percentage on a consistent scale |
| What it supports | Audit readiness and control coverage | Financial exposure and prioritized action |
| Where it comes from | Drata | X-Analytics, informed by Drata |
So the agent caps every Drata-informed value at 60%. A ready DCF earns your control substantial credit, and the remaining 40% stays available for the evidence only you hold: your testing results, your coverage across assets, your operational history. Your exposure reflects what the evidence supports, and nothing beyond it.
What you walk away with
- Your exposure in financial terms. Control effectiveness informs annualized loss exposure, so your compliance work and your exposure figure point at the same thing.
- Prioritized actions. Candidate control actions ordered by the exposure each one reduces, which answers the question severity lists leave open: of everything in front of you, which action earns the most.
- A board conversation in business terms. You walk in with the financial benefit of work your team already did, measured against evidence your auditor accepts. When someone challenges a number, you can say which part came from continuous evidence and which came from your own assessment.
- Actions back in Drata. Prioritized risk-reducing actions return to Drata as tasks, so the work that removes the most exposure lands where your team already manages compliance work.
Frequently asked questions
What is the X-Analytics NIST CSF Informed by Drata agent?
It is an AI agent in the X-Analytics AI Toolbox that reads your Drata Control Framework results, uses them to inform your NIST CSF 2.0 or CIS CSC 8.1 profile, and returns your cyber risk exposure in financial terms with a prioritized list of actions.
Does it work for both NIST CSF 2.0 and CIS CSC 8.1?
Yes. Each framework has its own agent, and both read the same Drata connection, so one setup covers either profile.
What do I need to use it?
A Drata connection to X-Analytics, and at least one configured X-Analytics profile.
Why do Drata-informed values cap at 60%?
Because implementation evidence supports part of an effectiveness judgment and your own evidence supports the rest. A ready DCF confirms a control is in place; how well and how consistently it operates is a second question. Capping the informed value keeps your exposure inside what the evidence supports, and leaves room for what you know.
Can I override what Drata informs?
Yes, on any subcontrol, in either direction. Take CIS 18.5: your profile carries 23%, Drata is informing 60%, and your penetration testing last quarter puts the honest answer closer to 43%. You enter 43, and that value informs your profile. Where you run a control beyond what implementation evidence alone can show, you raise it instead.
Does this replace Drata or my existing GRC program?
Both stay in place. Drata remains your continuous control monitoring and evidence system, and your GRC workflows continue as they are. X-Analytics reads the control results you already produce. No rip and replace.
What Drata data does X-Analytics read?
Four read-only permissions: drata_workspaces_list, drata_frameworks_list, drata_controls_list, and drata_controls_get. The agent reads workspace names, framework definitions, and Drata Control Framework results. You set the scope when you create the API key.
Can the agent update my profile without my approval?
Every Drata AI tool in X-Analytics keeps a human in the loop. The agent presents each informed value and its delta, and your profile changes only when you authorize it.
How often should I run it?
Whenever your control posture moves: after a remediation sprint, ahead of a board or audit cycle, or monthly. Drata updates control status continuously, so a fresh run reflects your program as it stands that day.
Watch the full walkthrough
The video above walks through selecting a workspace, reviewing the informed values against your current profile, overriding where your own evidence says otherwise, and committing the result.
Connecting Drata takes four steps, covered in our setup guide. Drata's partner POV covers why the two companies built this together.
Questions about the agent? Reach out to your X-Analytics customer success team at customersuccess@x-analytics.com.