This week, I revealed the Purchaser’s Information: Governance, Danger, And Compliance Platforms, 2026, summarizing how happy purchasers are with their governance, danger, and compliance (GRC) platforms. The report is predicated on buyer reference knowledge from the The Forrester Wave™: Governance, Danger, And Compliance Platforms, Q2 2026. Talking to clients in evaluative analysis processes is my favourite a part of doing Forrester Waves, because it helps us to get particular insights into what’s working properly within the business and what isn’t. This weblog outlines my very own 4 key takeaways from these discussions and analysis:
- Prospects are dismayed with present AI capabilities, however that’s enhancing quickly. On the time of the Wave analysis, many AI capabilities provided little past enterprise AI instruments like Copilot and Claude. Buyer suggestions on using AI inside GRC instruments could be summarized neatly with the Shakespearean quote, “a plague on all of their homes,” putting using AI because the lowest ranked platform function for our reference clients. Since then, AI capabilities are quickly enhancing as suppliers launch brokers that may execute components of danger assessments, audits, and controls testing. Despite these enhancements, belief within the high quality of what AI produces stays patchy. Danger leaders should carry their groups on facet to comprehend AI’s advantages, as they’re a skeptical bunch by nature. Present your groups that AI options can speed up their work, whereas human evaluation and oversight stay important for mitigating AI hallucinations and different high quality points.
- AI options pricing is messy, making it troublesome to evaluate its worth for cash. AI pricing in GRC was inconsistent, with distributors providing a spaghetti mess of various approaches. Prospects cited pricing readability as the first purpose holding them again from utilizing AI capabilities. Pricing complexity of AI — corresponding to whether or not or not it’s included, individually priced, or consumption-based — made it a wrestle to evaluate whether or not the outcomes delivered matched the sticker value. As frontier AI labs shift to token-based pricing, GRC suppliers’ AI supply prices have surged. One CEO available in the market shared that their AI prices had elevated 10x in a single day due to this shift, inflicting heartburn for his or her CFO. Danger leaders ought to interact with GRC suppliers who provide consumption-based pricing to validate the AI value administration practices distributors are utilizing, which is able to allow them to maintain AI token utilization payments low and according to their AI utilization.
- Tech leaders and CISOs need CCM yesterday. There’s at present a big hole between buyer wishes for steady controls monitoring (CCM) and what GRC platforms can present. Wave reference clients needed this functionality however noticed no clear path to realize it. For CISOs and tech danger professionals I’ve spoken with not too long ago, CCM is quickly changing into a non-negotiable requirement because the burden of handbook assessments turns into too troublesome to justify. Many purchasers have concluded that GRC platforms are unable to ship this: They’re trying into constructing their very own answer or on the lookout for specialist CCM suppliers to plug this hole. Suppliers want to concentrate or danger shedding enterprise with tech and cyber leaders if they will’t meet the second. Tech and safety leaders ought to press GRC suppliers to ship CCM, or construct it themselves utilizing specialist CCM options or various knowledge analytics know-how.
- “Going to gold” is used to keep away from costly customization. A minority of wave reference clients talked about they’re “going to gold,” implementing their GRC platform out of the field as carefully as attainable. A small variety of buyer references have both made “going to gold” a guideline of their present deployment, or are refactoring their present implementation to return to the fundamentals. Prospects are adopting this strategy to keep away from expensive over-customization that delays implementation and simplify upgrades and entry to new performance all through the platform’s lifetime, which could be made troublesome or not possible to realize by bespoke capabilities. Undertake “going for gold” as a guideline for sooner implementation, less complicated upgrades, and entry to new functionalities.
As all the time, Wave reference clients are a useful a part of the method and produce levity and actuality to the method, which helps us immensely in getting a pulse for what’s going beneath the floor. Forrester clients wishing to debate the GRC market or collection of suppliers based mostly on these findings can schedule a steering session or inquiry with me.
