Insights

In his original article, This Week Was (Is) a Vulnpocalypse. 3 Ways GRC Can Help, Ayoub Fandi, co-author of the GRC Engineering Manifesto, examines a wave of cybersecurity vulnerabilities and incidents and what they reveal about the systems organizations rely on. His argument is that GRC teams have a practical role to play in helping security teams respond, particularly through compliance oversight, third-party risk management, and the risk register.

“Who owns this service account?” Every security and compliance leader dreads that question during an audit. Too often, no one has a good answer. It points to an accountability model built for humans with badges, in an environment increasingly run by machines.

From April 2022 to November 2023, according to federal prosecutors, a TD Bank employee in Florida opened fraudulent accounts and issued hundreds of debit cards to co-conspirators. When the bank restricted some of the cards over possible fraud, he unblocked them. About $4.8 million left the United States for Colombia through the accounts and cards. Eighty-six of the accounts used the same commercial address in Miami and carried more than $3 million of that total. He took more than $8,000 in bribes, paid in cash and through a peer-to-peer payment app.

A compliance task can be marked complete while its evidence remains difficult to explain. The change ticket lives in one system, the approval in a message, and a screenshot on someone's laptop. When another person asks what happened, the team has to reconstruct the story.

It's planning season for many risk management and internal audit functions. CROs and CAEs are deciding where to spend their limited resources, what work to prioritize and what they hope to accomplish in the coming year. I have a question for them. Do you see yourselves in the decision and performance support business?

Let’s be clear. Putting agentic AI into GRC platforms is not a feature upgrade. It changes the wiring of your control environment. If AI is summarizing reports, fine. The moment it starts scoring risk, closing issues, or triggering workflows, it is inside fiduciary processes. And testing keeps showing the same thing. Under load or clever manipulation, models wobble. That is manageable in marketing copy. It is not manageable in systems that support SOX, audit, and board reporting. Governance systems exist to reduce variance. Probabilistic systems introduce variance. That tension does not go away because the demo looks good.

For more than two decades, organizations have evaluated governance, risk, and compliance (GRC) technology largely by examining what a platform can do. Risk assessments, policy management, regulatory compliance, third-party risk, internal audit, dashboards, reporting, and workflow automation have become familiar requirements in the procurement process.