I don't know for a fact that it is spyware. For now I just think of it as an "hostile agent".
I object because a) I don't want frustrations at work. I want to focus on the problems I am there to solve (which are quite interesting), b) I don't want a hostile agent from a company selling data to "targeted marketing" in my network, c) I don't want such companies even to know my real name, d) I take security seriously - I hate security theater.
That's what I object to.
Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another.
In the past I've been faced with similar situations where corporate IT required ne to run a "security agent" if I wanted to bring my own device to their network. I ended up bringing a Raspberry Pi which ran their "security agent", but then I did all my work on a laptop that connected through the Pi via NAT.
This was at a high school where I was a teacher. The "agent" did an SSL MITM attack, allowing the school IT to see all my traffic. I'm fine with needing that stuff to keep the kids safe but I objected to the school needing to inspect staff traffic. If they mistrusted me to the level of needing to read my email, what the hell were they doing leaving me in a roomful of children all day?
If you had two spare Pis you could do a three machine shit-sandwich: (1) trusted-pi is all yours and connects to your home network offering strictly controlled minimal internet access to... (2) the security-theatre-pi, running the client's weird spy/monitoring software; and then (3) your personal laptop connects via the security-theatre-pi.
I'd prefer to be direct and up-front with them – it doesn't feel great to have to be duplicitous with people the way I did / suggest you do – but a $50 pi might be able to tick their box and let you get on with the interesting stuff.
That would create a layer of cynicism between me and my work. I don't have that today, and I would rather avoid it.
Feels like the layer of cynicism is already there.
When a new manager I don't know send me an email to install some "agent" from a company I have never heard about, and that company turns out to have terms and conditions from hell (like references to undisclosed terms and conditions they want me to accept) - then I label that thing, in my mind, as a "hostile agent". It's not something that will ever get access to my lan. It's something I don't even want in a VM, because it may know how to escape from a VM.
That's not cynicism. That's risk assessment.
And id need a VDSL Router that supported Vlans as well so that's 4 switch's plus a router.
It sounds like the spyware is non negotiable and I personally wouldn’t have issue with it if the client also provides a laptop on which to run it. The client is free to do whatever the hell they like with their own hardware.
What’s objectionable about situations like this is the client wanting to have their spyware cake and eat it on someone else’s computer. That’s a great deal for them — why pay $5k for a laptop when you can just pay $100 for the spyware license instead?!
I realize the economics aren’t exactly on point, but I tend to view situations like this as them stealing $5000 — my laptop — from me.
So moving forward:
1/ you are “happy to help them reach their compliance goal and move to a Drata controlled environment”
2/ to do so you “will need to isolate them, as a client, to an airgapped environment solely for their work”
3/ which will need “$5k up front and a lead time of a week to order new hardware, or for the client to ship you a preconfigured laptop with configuration X Y and Z.”
Saying yes with principled conditions is always a good route forward. Yes-but instead of no-but.