Fake Drata / Vanta compliance automation subscription payment failed, SOC 2 audit evidence collection suspended, or compliance monitoring and security controls no longer active phishing

Phishing emails impersonating Drata or Vanta claiming the compliance automation subscription payment has failed, SOC 2 audit evidence collection is suspended, compliance monitoring is disabled, or security controls are no longer being tracked — directing them to update billing or restore compliance access through a credential-harvesting portal. A distinct attack category targeting security compliance automation platforms used by SaaS companies to achieve and maintain SOC 2, ISO 27001, and GDPR certifications. Key facts: (1) Drata serves 3,500+ companies ($25,000-100,000+/year enterprise pricing) as the dominant continuous compliance automation platform — Drata continuously monitors a company's cloud infrastructure, identity management, endpoint security, and vendor risk, collecting audit evidence automatically to maintain SOC 2 Type II certification; a 'your Drata subscription has lapsed, SOC 2 audit evidence collection is suspended' email to a Head of Security creates immediate certification risk because evidence collection gaps during a SOC 2 audit period must be explained to the auditor and can delay or invalidate the audit; (2) The 'audit evidence suspended' hook is uniquely high-stakes for companies with active SOC 2 audits: SOC 2 Type II audits observe controls over a defined period (typically 6-12 months); any gap in continuous monitoring during that period creates an audit finding; for companies whose enterprise customers require SOC 2 certification in their vendor MSAs, a gap that delays the audit also delays renewals and new customer signings; (3) Vanta serves 6,000+ companies ($13,000+/year) with particular strength among YC-backed startups completing their first SOC 2 — Vanta's automated integration with AWS, Google Cloud, GitHub, Okta, and other tools means a Vanta subscription lapse simultaneously stops all automated evidence collection from every connected system; (4) Compliance platform credentials expose the complete security posture of the target company: every failing security control, every at-risk vendor, every employee who hasn't completed security training, and the current status of every SOC 2 control — a roadmap for exploiting security gaps; (5) Drata and Vanta are also used for ISO 27001, HIPAA, GDPR, SOC 1, and PCI DSS compliance; enterprise customers in regulated industries (healthcare, finance, government contracting) face contractual and regulatory consequences from compliance program interruptions. Warning signs: sender not drata.com/vanta.com; genuine Drata billing at app.drata.com/settings/billing; Vanta billing at app.vanta.com/account.