It is based on osquery and we are happy to share any information including our third party security validation of the agent with prospects/customers.

Source: I am the Drata CISO