oak9

The firm's core business revolves around securing Infrastructure as Code (IaC), the process of managing infrastructure through code rather than manual processes. This market addresses a critical pain point for modern businesses: the need to develop and deploy applications at high speed without creating security vulnerabilities. oak9's clients are primarily developers, DevOps engineers, and security professionals at enterprises, particularly in sectors like financial services and healthcare. The business model is subscription-based, offering different pricing tiers, including a free community edition, a professional plan for growing teams, and an enterprise-level solution.

The oak9 platform is designed to integrate directly into the software development lifecycle, from the IDE and code repositories to CI/CD pipelines. It analyzes IaC, such as Terraform, to identify security design gaps before the code is deployed. A key feature is its use of pre-built, customizable Security as Code (SaC) blueprints, which support over 20 compliance standards like HIPAA, PCI, SOC2, and ISO 27001. The platform provides automated remediation suggestions, presenting a side-by-side comparison of vulnerable and compliant code to educate developers and allow for one-click fixes. This "shift left" approach aims to bridge the divide between development and security teams by embedding security checks early and continuously. The platform also monitors deployed cloud environments for drift from the intended secure design. In May 2024, oak9 was acquired by Drata, a compliance automation platform.