IRM Navigator™ Research
The 2026–2027 IRM50
The IRM50 is Wheelhouse Advisors' annual index of the 50 most influential technology and services providers shaping integrated risk management. The 2026–2027 edition names a Technology Market Leader for each of the four IRM segments and a Services Market Leader for each of the two PRAC objective pairs, and it arrives at the year agentic execution shipped: the distance between vendors that demonstrate agentic execution and vendors that announce it became the most consequential gap in the index.
The Six 2026–2027 IRM50 Market Leaders
The 2025 edition recognized a single tier of Market Leaders for cross-domain excellence. The 2026 edition replaces that structure with a leadership model matched to how the market actually resolves: a named Market Leader for each of the four IRM segments — GRC, ERM, ORM, and TRM — and a Services Market Leader for each of two PRAC objective pairs — Assurance and Compliance, and Performance and Resilience. No firm holds more than one leadership role in 2026; the six designations resolve across six distinct providers.
Archer ★
Technology Market LeaderThe top-positioned Integrator on the GRC Vendor Compass, with two decades of platform maturity, extensibility, and enterprise controls depth. Under Cinven ownership, the Evolv program is modernizing the platform around AI-assisted workflows with human-in-the-loop design.
Diligent ★
Technology Market LeaderThe top-positioned Integrator on the ERM Vendor Compass, pairing board governance heritage with the strongest independently corroborated agentic evidence in the cohort: Third-Party Risk Intel generally available in March 2026, and the highest possible score on the AI and AI agents criterion in the Q2 2026 Forrester GRC Wave.
Riskonnect ★
Technology Market LeaderThe top-positioned Integrator on the ORM Vendor Compass, purpose-built for integrated risk across operational risk, claims, and continuity on a unified data model. Its Intelligent Risk Framework, shipped February 2026, brings agentic capability to resilience workflows.
ServiceNow ★
Technology Market LeaderThe top-positioned Integrator on the TRM Vendor Compass and the one segment leader shipping generally available risk agents: the AI Control Tower, autonomous security and risk capability in production at named enterprise customers, and the June 2026 Accenture alliance.
PwC ★
Services Market LeaderThe Services Market Leader for the Assurance and Compliance objective pair, and the highest-coverage services Integrator in the Vendor Compass analysis: the profession's deepest assurance franchise paired with a deep, internally developed agentic delivery investment.
Accenture ★
Services Market LeaderThe Services Market Leader for the Performance and Resilience objective pair: risk embedded in operating-model redesign, delivered through the market's largest platform implementation ecosystem, increasingly executed through AI-enabled risk operations under Risk by Design.
All 50 Constituents
| # | Vendor | Headquarters | Primary Descriptor | Ownership (July 2026) |
|---|---|---|---|---|
| 1 | 6clicks | Melbourne, Australia | GenAI policy & control automation | Founder-led; VC-backed |
| 2 | Accenture ★ | Dublin, Ireland | Global technology & consulting services | Public (NYSE: ACN) |
| 3 | Aravo | San Francisco, CA (USA) | Third-party risk management SaaS | Independent (no controlling investor) |
| 4 | Archer ★ | Overland Park, KS (USA) | Enterprise IRM suite | Cinven |
| 5 | Corporater | Stavanger, Norway | Strategy-linked ERM | Founder-controlled (Tor Inge Vasshus) |
| 6 | CyberSaint | Boston, MA (USA) | Cyber-risk automation | VC-backed (Riverside Acceleration lead) |
| 7 | Deloitte | London, UK | Global professional services | Partner-owned |
| 8 | Diligent ★ | New York, NY (USA) | Board governance & risk | Insight Partners; Clearlake and Blackstone minority |
| 9 | Drata | San Diego, CA (USA) | Continuous compliance | VC-backed (ICONIQ Growth lead) |
| 10 | dss+ | Geneva, Switzerland | OT-safety consulting | Inflexion; Gyrus Capital minority |
| 11 | EcoOnline | Tonsberg, Norway | ESG-EHS cloud | Apax Partners |
| 12 | Empowered Systems | London, UK | Low-code GRC builder | Founder-owned |
| 13 | ETQ (Octave) | Burlington, MA (USA) | Quality & reliability management | Octave Intelligence plc (Nasdaq: OCTV) |
| 14 | Everbridge | Burlington, MA (USA) | Critical-event management | Thoma Bravo |
| 15 | EY | London, UK | Global professional services | Partner-owned |
| 16 | FTI Consulting | Washington, DC (USA) | Forensic cyber & ESG | Public (NYSE: FCN) |
| 17 | Fusion Risk Management | Rolling Meadows, IL (USA) | Resilience platform | Great Hill Partners |
| 18 | Grant Thornton | Chicago, IL (USA) | ERM & ESG advisory | New Mountain Capital (Advisors); audit partner-owned |
| 19 | Hyperproof | Bellevue, WA (USA) | Compliance-ops SaaS | VC-backed (Riverwood, Toba Capital) |
| 20 | IBM OpenPages | Armonk, NY (USA) | Full-stack GRC | IBM (NYSE: IBM) |
| 21 | Ideagen | Nottingham, UK | Quality & audit GRC | Hg |
| 22 | J.S. Held | Jericho, NY (USA) | Loss & litigation consulting | Kelso & Company |
| 23 | KPMG | Amstelveen, Netherlands | Digital-twin operational risk | Partner-owned |
| 24 | Kroll Resolver | Toronto, Canada | IRM analytics cloud | Stone Point and Further Global (via Kroll) |
| 25 | LogicGate | Chicago, IL (USA) | Risk Cloud platform | VC-backed (PSG, Greenspring co-leads) |
| 26 | LogicManager | Boston, MA (USA) | Taxonomy-rich ERM | Founder-owned |
| 27 | MetricStream | Palo Alto, CA (USA) | Cloud GRC suites | Undisclosed investor group |
| 28 | Microsoft | Redmond, WA (USA) | Data-fabric enabler | Public (Nasdaq: MSFT) |
| 29 | Mitratech | Austin, TX (USA) | Legal & TPRM suite | Ontario Teachers’ Pension Plan |
| 30 | NAVEX | Lake Oswego, OR (USA) | Compliance & ESG | Goldman Sachs Alternatives (lead); Blackstone and BC Partners minority |
| 31 | Ncontracts | Brentwood, TN (USA) | FSI GRC/ERM | Hg |
| 32 | OneTrust | Atlanta, GA (USA) | Privacy & AI governance | Founder-controlled; Insight and Coatue minority |
| 33 | Optro (formerly AuditBoard) | Los Angeles, CA (USA) | Audit, SOX, risk & TPRM | Hg |
| 34 | Origami Risk | Chicago, IL (USA) | Insurance ERM SaaS | Founder-led; Spectrum Equity minority |
| 35 | ProcessUnity | Concord, MA (USA) | TPRM + continuous controls monitoring | Marlin Equity; Long Ridge minority |
| 36 | Protecht | Sydney, Australia | Cross-domain ERM/ORM platform | PSG Equity |
| 37 | Protiviti | Menlo Park & San Ramon, CA (USA) | Internal audit, ERM, TRM, GRC | Robert Half (NYSE: RHI) |
| 38 | PwC ★ | London, UK | Global professional services | Partner-owned |
| 39 | Riskonnect ★ | Atlanta, GA (USA) | Enterprise IRM | TA Associates; Thoma Bravo minority |
| 40 | RiskRecon | Salt Lake City, UT (USA) | External cyber-ratings | Mastercard (NYSE: MA) |
| 41 | RSM | London, UK | Mid-market professional services | Partner-owned |
| 42 | Safe Security | Palo Alto, CA (USA) | Autonomous cyber-TPRM | VC-backed (Avataar Ventures lead) |
| 43 | SAI360 | Chicago, IL (USA) | GRC SaaS | Symphony Technology Group |
| 44 | SecurityScorecard | New York, NY (USA) | Cyber-ratings | VC-backed (Riverwood); Moody’s minority |
| 45 | ServiceNow ★ | Santa Clara, CA (USA) | Now Platform IRM | Public (NYSE: NOW) |
| 46 | Sphera | Chicago, IL (USA) | Process-safety twin | Blackstone; Neuberger Berman minority |
| 47 | Vanta | San Francisco, CA (USA) | Agentic trust platform | Founder-led; VC-backed |
| 48 | Wolters Kluwer (Enablon + TeamMate) | Alphen aan den Rijn, NL / Paris, FR | ESG/EHS + audit suite | Public (Euronext: WKL) |
| 49 | Workiva | Ames, IA (USA) | Reporting & ESG | Public (NYSE: WK) |
| 50 | ZenGRC | San Francisco, CA (USA) | Cyber & compliance | Francisco Partners (lead investor) |
2026 Composition Changes (vs. 2025 IRM50)
Removed (3)
MEGA International. Acquired by Bizzdesign; HOPEX repositioned as an enterprise architecture asset, no longer a distinct IRM offering.
Coupa. Source-to-pay risk rationale thinned as supplier risk became embedded, not led, in an agentic total-spend story.
Novisto. EU sustainability omnibus simplification shrank the mandatory-reporting demand pool for pure-play ESG platforms; healthy company, decayed seat relevance.
Added (3)
Vanta. $300M ARR; Forrester GRC Wave Leader on first inclusion; IDC MarketScape Leader; Agentic Trust Platform positioning.
Accenture. $10B+ security business; ServiceNow agentic services alliance; joins the services Vendor Compass evaluation universe in the 2026-2027 cycle.
Protecht. Broadest genuine four-domain challenger; VISO TRUST agentic-TPRM acquisition; PSG Equity backing.
Renamed (2)
Optro. Formerly AuditBoard; rebrand March 2026, Hg ownership continuity, FairNow acquisition.
ETQ (Octave). Hexagon spin completed; independent public company Octave since May 2026.
New ownership: Archer (Cinven); NAVEX (Goldman Sachs Alternatives-led consortium); Sphera (Neuberger Berman minority; Blackstone majority).
Selection Criteria
Each IRM50 provider is evaluated against eight factors:
- Segment coverage. breadth and depth of generally available solutions across ERM, ORM, TRM, and GRC
- Cross-segment integration. unified platform operation across segments: shared data models, common workflows, consistent risk lifecycle
- Demonstrated AI and agentic execution. shipped, generally available autonomous capability, as distinct from announced intent
- Evidence quality and independent corroboration. dated, verifiable evidence: analyst evaluations, closed transactions, named customer deployments
- Market currency. affirmative recent evidence of active development and delivery across the portfolio
- Customer experience signals. independent user satisfaction and adoption evidence
- Market relevance and momentum. strategic trajectory including M&A, partnerships, analyst recognition, alignment with IRM market direction
- AI disruption exposure. structural exposure to AI-driven displacement as assessed through the AI Disruption Risk Index (ADRI)
One rule governs first-year constituents: a provider entering the index may hold a leadership designation in its entry year only where the designation rests on documented positioning analysis against the same eight factors, and every entry-year designation is then subject to full Vendor Compass evaluation in the following cycle. Accenture's 2026 services designation is made under this rule.
The IRM50 and the Vendor Compass series score on the same two vectors — Coverage and Integration — at two different levels of analysis. The IRM50 measures coverage across the four IRM segments and integration between them; each Vendor Compass measures coverage across the solution areas within one segment and integration among them. Scores from the two instruments are therefore not comparable, and a vendor's position may differ between them by design.
The index carries a companion instrument for its eighth factor: the AI Disruption Risk Index (ADRI) classifies structural exposure to AI-driven displacement across the IRM50 on a six-tier scale, applied consistently to technology and services providers. The report publishes the instrument and its cohort-level findings; vendor-level exposure tracking continues in the IRM50 OnWatch series on The RTJ Bridge.
Source. 2026 IRM Navigator Viewpoint Report, Chapter 7 and Appendix: IRM50 Vendor Index. Ownership stated as of July 26, 2026.