The RiskTech Journal
The RiskTech Journal is your premier source for insights on cutting-edge risk management technologies. We deliver expert analysis, industry trends, and practical solutions to help professionals stay ahead in an ever-changing risk landscape. Join us to explore the innovations shaping the future of risk management.
The Agent Sprawl Problem Is an IRM Problem
FICO’s chief information officer told The Wall Street Journal this week that his company’s 3,500 employees are creating dozens of new AI agents every single day. DaVita’s employees have created more than 10,000. GitLab’s CIO says their existing governance guardrails are “holding the line” — which is another way of saying the pressure is real and building. The Wall Street Journal is calling this “AI agent sprawl.” Risk professionals should recognize it by a different name: a governance failure in progress.
The mechanism is not complicated. Platforms like Claude Cowork and open-source orchestration tools have made it trivially easy for nontechnical employees to spin up independent AI agents. That accessibility is, by design, a feature. The problem is that features do not come with governance structures. When every employee at every tier of an organization can create an agent that writes briefs, manages data sets, or executes workflows, the organization does not have an AI strategy. It has an AI population.
The 2026 Convergence: Integrated Risk Management In a New Era
The 2026 global risk survey cycle marks an inflection point in how risk is understood, prioritized, and operationalized by large organizations. For the first time in several years, leading surveys from Aon, Allianz, the World Economic Forum, Protiviti, PwC, Marsh, Zurich, and Eurasia Group are not merely aligned on top risks, they are aligned on why those risks are proving so difficult to manage with legacy approaches.
Cyber remains the top-ranked risk globally. Geopolitical volatility has become a structural operating condition rather than a periodic shock. Artificial intelligence has moved decisively from emerging concern to material enterprise exposure. Third-party dependency is now treated as a first-order risk category. Across these themes, one signal is clear: risk is no longer behaving as a set of discrete domains. It is behaving as an interconnected system of dependencies, amplifiers, and cascading impacts.
This convergence explains why Integrated Risk Management (IRM) is shifting from an architectural aspiration to an execution requirement.