IRM Navigator™ Research
IRM Navigator™ Vendor Compass
Vendor placements across the four IRM market segments — GRC, ERM, ORM, and TRM. The 2025–2026 research series produced 77 placements across 37 technology and services providers, evaluated on Solution Coverage and Level of Integration. With the 2026 restatement, services capability is evaluated within the four segments; the final 2025 Risk Management Consulting placements are preserved in the services archive below.
The Three Placement Tiers
Integrator
Vendors that unify broad segment functionality with strong IRM integration. Best fit for organizations at the Extended stage of IRM maturity, where cross-domain evidence and consistent enterprise decision routines are required.
Accelerator
Vendors with broad or deep segment capabilities that help enterprises move from Coordinated to Embedded maturity. They offer strong coverage and integration potential but may require configuration or partner ecosystems for full IRM enablement.
Pace Setter
Vendors offering targeted capabilities, often aligned to mid-market needs or specific enterprise use cases. They can accelerate discrete outcomes and serve as stepping stones toward more comprehensive platforms.
Placements at a Glance — Technology Vendors
| Vendor | Segments | GRC2025 | ERM2025 | ORM2025 | TRM2026 |
|---|---|---|---|---|---|
| Archer ★☆ | 4 | I | I | A | I |
| IBM OpenPages | 4 | A | A | I | A |
| LogicGate | 4 | P | P | A | P |
| MetricStream | 4 | A | A | A | A |
| Riskonnect ★☆ | 4 | I | A | I | I |
| ServiceNow ★☆ | 4 | A | A | A | I |
| Corporater | 3 | A | A | · | P |
| Diligent ★ | 3 | A | I | · | P |
| LogicManager | 3 | · | A | A | P |
| Mitratech | 3 | · | A | I | A |
| NAVEX | 3 | A | · | A | P |
| Optro | 3 | I | A | · | A |
| SAI360 | 3 | A | · | A | P |
| Fusion Risk Management | 2 | · | · | P | A |
| OneTrust ☆ | 2 | I | · | · | A |
| Onspring | 2 | P | · | · | P |
| Origami Risk | 2 | P | · | P | · |
| ProcessUnity | 2 | P | · | P | · |
| Resolver | 2 | P | P | · | · |
| Safe Security | 2 | · | · | A | P |
| Workiva | 2 | A | P | · | · |
| CyberSaint | 1 | · | · | · | P |
| Hyperproof | 1 | · | · | A | · |
| Microsoft | 1 | · | · | · | A |
| Ncontracts | 1 | · | P | · | · |
| Sphera | 1 | · | · | P | · |
| Wolters Kluwer | 1 | · | · | A | · |
Placements by Segment
Governance, Risk and Compliance
Integrators: Archer, OneTrust, Optro, and Riskonnect.
Accelerators: Corporater, Diligent, IBM OpenPages, MetricStream, NAVEX, SAI360, ServiceNow, and Workiva.
Pace Setters: LogicGate, Onspring, Origami Risk, ProcessUnity, and Resolver.
Enterprise Risk Management
Integrators: Archer and Diligent.
Accelerators: Corporater, IBM OpenPages, LogicManager, MetricStream, Mitratech, Optro, Riskonnect, and ServiceNow.
Pace Setters: LogicGate, Ncontracts, Resolver, and Workiva.
Operational Risk Management
Integrators: IBM OpenPages, Mitratech, and Riskonnect.
Accelerators: Archer, Hyperproof, LogicGate, LogicManager, MetricStream, NAVEX, Safe Security, SAI360, ServiceNow, and Wolters Kluwer.
Pace Setters: Fusion Risk Management, Origami Risk, ProcessUnity, and Sphera.
Technology Risk Management
Integrators: Archer, Riskonnect, and ServiceNow.
Accelerators: Fusion Risk Management, IBM OpenPages, MetricStream, Microsoft, Mitratech, OneTrust, and Optro.
Pace Setters: Corporater, CyberSaint, Diligent, LogicGate, LogicManager, NAVEX, Onspring, Safe Security, and SAI360.
Services Providers
With the 2026 four-segment restatement, Risk Management Consulting (RMC) is retired as a live Vendor Compass segment. Professional services capability is now evaluated within the four segments whose outcomes it delivers — GRC, ERM, ORM, and TRM — rather than in a separate consulting report. Services providers join the four-segment Vendor Compass evaluation universe in the 2026–2027 research cycle.
2026–2027 IRM50 Services Market Leaders
The 2026–2027 IRM50 names a Services Market Leader for each of the two PRAC objective pairs:
Archive: 2025 Risk Management Consulting Vendor Compass (final edition, v1.3)
Integrators: Deloitte, EY, KPMG, and PwC.
Accelerators: dss+, FTI Consulting, and Protiviti.
Pace Setters: Grant Thornton, J.S. Held, and RSM.
EY and KPMG held the 2025-2026 IRM50 Market Leader designation (prior cohort, single cross-domain tier). The 2026-2027 designations above supersede that model with segment- and objective-pair-scoped leadership.
Cross-Segment Coverage
Breadth of placement is itself a signal of integration capability. Four segments is the maximum attainable for any technology vendor. Riskonnect holds the strongest profile, placing as an Integrator in three of its four segments. Archer places as an Integrator in three segments and an Accelerator in the fourth. ServiceNow places as an Integrator in TRM and an Accelerator across GRC, ERM, and ORM.
Archer, IBM OpenPages, LogicGate, MetricStream, Riskonnect, and ServiceNow
Corporater, Diligent, LogicManager, Mitratech, NAVEX, Optro, and SAI360
Fusion Risk Management, OneTrust, Onspring, Origami Risk, ProcessUnity, Resolver, Safe Security, and Workiva
CyberSaint, Hyperproof, Microsoft, Ncontracts, Sphera, and Wolters Kluwer
Source and scope. Placements are drawn from the 2025–2026 IRM Navigator™ Vendor Compass series: GRC (v1.1), ERM (v1.0), ORM (v1.1), TRM (v1.0), and the final RMC edition (v1.3), whose placements are preserved in the services archive above. The 2026-2027 IRM50 Market Leader designations — Archer (GRC), Diligent (ERM), Riskonnect (ORM), ServiceNow (TRM), PwC (Assurance and Compliance), and Accenture (Performance and Resilience) — reflect the 2026 IRM Navigator™ Viewpoint Report. The prior 2025-2026 cohort (Archer, EY, KPMG, OneTrust, Riskonnect, and ServiceNow) was named in the 2025 Viewpoint Report under a single cross-domain tier. Placement reflects Wheelhouse Advisors' independent research as of each report's publication date. Vendor self-reporting alone does not qualify as placement evidence. Absence from a segment indicates the vendor was not evaluated for that segment in the current research cycle.