RegScale CISO: Dale Hoak

What the company sells

RegScale sells a Continuous Controls Monitoring platform that connects live cloud telemetry, security tools and CI/CD pipelines to federal and commercial compliance frameworks. RegScale says its platform gives organizations the speed to see, understand, and react in real time.

RegScale says companies spend months compiling static artifacts while configuration drift and unpatched CVEs expose production systems between audits. RegScale says it connects to live security telemetry 24/7/365 and validates controls continuously against technical reality. RegScale says automated API ingestion pulls evidence continuously, so engineering never pauses development before or during an audit. RegScale stores security packages natively in NIST OSCAL code. RegScale says that when infrastructure changes in GitOps, its System Security Plan updates itself in real time. RegScale delivers Compliance as Code directly into a CI/CD pipeline via native CLI and GitHub Actions. RegScale says regulatory violations fail pull requests before code reaches production.

RegScale says one platform unites continuous monitoring, tool orchestration, and customer-facing trust. RegScale describes its core Continuous Controls Monitoring operating system as housing the multi-framework crosswalk, RegML regulatory AI, a dynamic risk ledger and a native NIST OSCAL dynamic SSP engine. RegScale says continuous monitoring runs across 250+ frameworks, supported out of the box. RegScale describes an automated integration backbone that connects 100+ enterprise cloud environments, cybersecurity scanners, identity providers, and CI/CD pipelines. RegScale runs automated scheduled pulls from CrowdStrike, Tenable, Wiz, Qualys, and more. RegScale Trust Center is a live, customer-facing security portal with automated NDA gating and self-service compliance artifacts. Every RegScale deployment contains six deterministic software engines. RegScale says its universal crosswalk automatically maps real-time telemetry across 250+ frameworks.

For federal programs, RegScale says its compliance management system automates the generation of Plans of Action and Milestones, System Security Plans, Security Assessment Plans, and Security Assessment Reports, all according to OSCAL standards, besides one-click artifact generation for FedRAMP. RegScale says its security team used its own CCM platform to achieve FedRAMP High authorization 3-4x faster than average. RegScale validates Key Security Indicators as compliance as code, running deterministic checks against live infrastructure and returning pass/fail results in real time. OSCAL Hub is an open-source platform that simplifies how Authorizing Officials review packages and how organizations submit them. RegScale says it achieved ISO 27001:2022 in under 30 days using its own platform, and that it earned CMMC Level 2 with its own platform.

RegScale addresses third-party risk management through its Continuous Controls Monitoring platform, enabling organizations to assess, monitor, and mitigate risks associated with vendors and partners. RegScale says organizations can automate collection of vendor and partner onboarding questionnaires and use AI to score vendor submissions. RegScale consolidates risk data from all third-party vendors into a single platform. RegScale provides automated risk scoring for third parties. RegScale enables continuous monitoring of third-party risks by integrating with external data feeds and systems. RegScale offers a questionnaire system, procurement system integrations, and assessment capabilities to flow down requirements to vendors. RegScale integrates with DevSecOps workflows, security tools, and GRC systems for managing third-party risks.

A government R&D organization implemented RegScale and streamlined issue management and workflows across tens of thousands of systems within weeks. A private equity firm chose RegScale to improve the cybersecurity posture of its portfolio companies through automation and real-time oversight of security and risk. RegScale describes its continuous controls monitoring platform as including governance, risk management, and compliance alongside threat categories, delivered with multi-tenancy. A major diversified healthcare company of retail pharmacies, health insurance, and virtual care services was struggling with fragmented compliance operations. RegScale provided a centralized platform that unified the compliance operations of that healthcare company into a single pane of glass. The healthcare company gained the ability to map common controls across SOC 1, SOC 2, SOX, and HITRUST with RegScale. The platform's compliance and risk modules were deployed in a scalable on-premises configuration for one healthcare deployment.

Tovuti consolidated its SOC 2 and FedRAMP System Security Plans into a single source of truth with RegScale. A large American government services company needed to maintain and share up-to-date control sets across its three core teams. RegScale provided a centralized platform with a customizable control library, controlled security plan sharing, and a Unified Compliance Framework (UCF) integration for control mapping.

RegScale says it was built by risk and compliance veterans who got fed up with GRC busywork that is entirely manual, after the fact, and reactive. RegScale says its AI-powered system plugs into ITIL and DevSecOps workflows. Travis Howerton is Co-Founder and CEO of RegScale.^{[1][6][7][8][10][11][12][13]}

Categories

• Compliance automation (primary category)
• GRC and integrated risk platforms
• Third-party risk and security ratings
• Compare RegScale with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

Not established from our sources

Ownership

Not established from our sources

CISO on record

Dale Hoak, Chief Information Security Officer (appointment announced on July 8, 2025)

Website

regscale.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• RegScale Trust Center^[2]

  A live, customer-facing security portal.

  RegScale Trust Center offers automated NDA gating and self-service compliance artifacts. RegScale Trust Center is powered by live telemetry data.

• OSCAL Hub^[2][6][14]

  An open-source platform for package review and submission.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of RegScale's categories, then alphabetical. A list from the record, never a ranking.

• On compliance automation, RegScale competes with Apptega, Copla, Hyperproof, Scytale, Vanta, Drata, Scrut Automation, Secureframe, Sprinto, Thoropass and 17 more.

• On grc and integrated risk platforms, RegScale competes with Anecdotes, Cynomi, MetricStream, Onspring, Archer, LogicGate, Optro, ServiceNow, Apptega, Copla and 6 more.

• On third-party risk and security ratings, RegScale competes with Bitsight, Black Kite, iCOUNTER, Panorays, Prevalent, RiskRecon, SecurityScorecard, UpGuard, Whistic, Anecdotes and 28 more.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

• G2 · 3.8 out of 5 · 3 reviews^[5]seen November 3, 2026

Recent news

Dated company events from the last twelve months, each in one sentence of ours with its source. Newest first.

• June 11, 2026

  RegScale announced it achieved ISO 27001 certification in under 30 days using its own continuous controls monitoring platform. Business Wire^[3]

• May 14, 2026

  RegScale announced an oversubscribed Series B of more than $30 million, alongside growing Fortune 500 and federal adoption. Business Wire^[4]

• December 16, 2025

  RegScale launched the OSCAL Hub, an open-source platform for OSCAL security compliance documents, and announced it is donating the source code to the OSCAL Foundation. Business Wire^[14]

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]regscale.comRegScale · regscale.com · undated page, accessed October 7, 2026 · Tier A: the company, a regulator or a filing
2. [2]RegScale | Continuous Controls Monitoring Platform for Cyber ResilienceRegScale · undated page, accessed October 31, 2026 · Tier A: the company, a regulator or a filing
3. [3]RegScale Achieves ISO 27001 Certification in Under 30 Days Using Its Own Continuous Controls Monitoring PlatformBusiness Wire · published June 11, 2026 · Tier A: the company, a regulator or a filing
4. [4]RegScale Emerges as Category Leader in AI-Driven Continuous Controls Monitoring, Tripling Revenue as CISOs Abandon Manual GRCBusiness Wire · published May 14, 2026 · Tier A: the company, a regulator or a filing
5. [5]RegScale Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 31, 2026 · Tier C
6. [6]Accelerate FedRAMP Certification & Compliance with RegScaleRegScale · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
7. [7]Faster, Easier Third-Party Risk Management with AI and AutomationRegScale · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
8. [8]R&D Org Scales Security and Compliance across 75,000 SystemsRegScale · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
9. [9]Private Equity Firm Automates Security and Risk ManagementRegScale · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
10. [10]Healthcare Company Centralizes Compliance & Eliminates Manual Tracking | RegScale Customer SuccessRegScale · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
11. [11]Tovuti LMS SOC 2 & FedRAMP Compliance Case Study | RegScaleRegScale · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
12. [12]Government Services Provider Centralizes Control Management | RegScale Customer SuccessRegScale · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
13. [13]RegScale About Us | Taking the Complexity Out of ComplianceRegScale · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
14. [14]RegScale Donates Open-Source OSCAL Hub to the OSCAL Foundation to Accelerate the Automation of Security Compliance Across Public and Private SectorsBusiness Wire · published December 16, 2025 · Tier A: the company, a regulator or a filing

Last verified October 7, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded October 7, 2026, expanded November 3, 2026 from the references above.

Work for RegScale? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.