It sounds like the spyware is non negotiable and I personally wouldn’t have issue with it if the client also provides a laptop on which to run it. The client is free to do whatever the hell they like with their own hardware.
What’s objectionable about situations like this is the client wanting to have their spyware cake and eat it on someone else’s computer. That’s a great deal for them — why pay $5k for a laptop when you can just pay $100 for the spyware license instead?!
I realize the economics aren’t exactly on point, but I tend to view situations like this as them stealing $5000 — my laptop — from me.
So moving forward:
1/ you are “happy to help them reach their compliance goal and move to a Drata controlled environment”
2/ to do so you “will need to isolate them, as a client, to an airgapped environment solely for their work”
3/ which will need “$5k up front and a lead time of a week to order new hardware, or for the client to ship you a preconfigured laptop with configuration X Y and Z.”
Saying yes with principled conditions is always a good route forward. Yes-but instead of no-but.