Renee Murphy

Let’s be clear. Putting agentic AI into GRC platforms is not a feature upgrade. It changes the wiring of your control environment. If AI is summarizing reports, fine. The moment it starts scoring risk, closing issues, or triggering workflows, it is inside fiduciary processes. And testing keeps showing the same thing. Under load or clever manipulation, models wobble. That is manageable in marketing copy. It is not manageable in systems that support SOX, audit, and board reporting. Governance systems exist to reduce variance. Probabilistic systems introduce variance. That tension does not go away because the demo looks good.

In risk management, we tend to obsess over black swans. Rare, unpredictable, high impact shocks that arrive without warning and rewrite the narrative overnight. Yet most organizational failures are not born from surprise. They emerge from visible, accelerating threats that were identified, debated, scored, and then quietly deprioritized because mitigation was inconvenient, expensive, or politically uncomfortable. These are gray rhinos. High probability, high impact risks charging directly at the organization. The breakdown is not foresight. It is governance.

In a founder-centric organization, the founder isn’t just the CEO. They’re the mascot, the mythology, the exception to the rules, and the emotional thermostat of the building. Identity, authority, and narrative all get bundled into one human nervous system. That’s efficient. It’s also a little like running a power grid through a single extension cord.

Modern governance runs on digital systems, but law is still written as if humans are the only interpreters, creating a growing gap between policy intent and machine execution. Every time statute is translated into software, invisible interpretation occurs, turning ambiguity into operational reality and shifting policymaking into technical layers outside democratic visibility. Legislation-as-code closes that gap by pairing human-readable law with executable logic that can be tested, audited, and simulated before it governs real people, treating policy as infrastructure rather than static text. Early efforts such as New Zealand’s Better Rules initiative show this transition is already underway, and the real challenge is ensuring computational governance remains transparent enough to preserve public trust while modernizing how societies enforce rules.

For the past decade, many major brands experimented with political voice as a growth strategy. They spoke on social justice, democracy, climate, privacy, labor, and civil rights not as side commentary, but as identity. Consumers were encouraged to see purchases as moral alignment. Then something shifted. Some of those same brands have become quieter, more cautious, or selectively neutral. To consumers, that silence is not invisible. When a brand that once framed itself as values-driven retreats from political expression, the market interprets it as a renegotiation of trust. 

The first paper I wrote as an analyst at Forrester back in 2013 was about mitigating risk in the customer journey. That was also my first exposure to marketing’s alternative vocabulary for risk they call it customer pain points or challenges. I call it risk. Same thing, different outfit.

Synthetic media, popularly known as deepfakes, has evolved from an internet curiosity into a material operational and security risk. Generative AI now enables adversaries to fabricate videos, voices, and imagery that mimic reality with alarming precision. The implications extend beyond misinformation: deepfakes can erode trust, distort markets, and destabilize democratic institutions.