The RiskTech Journal
The RiskTech Journal is your premier source for insights on cutting-edge risk management technologies. We deliver expert analysis, industry trends, and practical solutions to help professionals stay ahead in an ever-changing risk landscape. Join us to explore the innovations shaping the future of risk management.
Subscribe for notifications when new RiskTech Journal articles and research updates are published.
The Reason We Do Not Need Another AI Risk Framework
Every few weeks, another framework for AI-era risk management arrives. Some come from standards bodies, some from consulting firms, and a growing number from commentators inviting the profession to build one together. Each opens with the same claim: no proven guide exists for the AI era, so here is a fresh set of principles to fill the void.
The claim is wrong, and the error is expensive. Risk, compliance, and governance leaders are not short of frameworks. They are surrounded by them. What the profession actually lacks goes by a different name, and the distinction is the reason Wheelhouse Advisors chose its vocabulary with such care.
The Warning to GRC Vendors Buried in NIST's New Guidance
On June 30, NIST released Special Publication 800-18r2, its first full revision of federal system planning guidance in two decades. The headline change consolidates three plans, the system security plan, the system privacy plan, and the cybersecurity supply chain risk management plan, into a single integrated construct NIST now calls "system plans," each mapped to the steps of the Risk Management Framework. The more consequential change sits a few paragraphs down. NIST wants those plans machine readable, fed by automated data collection through GRC, SOAR, and SIEM platforms, and rendered in dashboards that support near real time risk decisions. The stated goal is to reduce reliance on static, point-in-time documentation.
Cyber Regret at the Gartner Security & Risk Management Summit: From Risk Dysfunction to Risk Agency
The Gartner Security and Risk Management Summit is running this week at National Harbor in Washington, DC, and the theme is "Smarter, Faster, Stronger... Together." Almost every session points in one direction, which is speed. The opening keynote called the next eighteen months a compressed decision cycle where the cost of waiting keeps rising. The Day 1 sessions covered how to secure AI agents before they act on their own, how to scale AI in cybersecurity while proving a return, and where security skills and tools will be by 2030. The message to the CISOs in the room is simple. Move faster, especially on AI.
One session says the opposite, and it is the one to watch. Gartner has a name for it now, cyber regret. The research describes a reckoning building in boardrooms over the cybersecurity money spent in recent years.
The NC State ERM Summit Just Proved the COSO Survey Right
Last week, more than 110 enterprise risk management practitioners gathered at NC State's Poole College for the 2026 ERM Roundtable Summit. The case studies they shared were compelling. The programs they described were mature, relationship-driven, and genuinely effective at connecting risk functions across large, complex organizations. They also illustrated, with striking precision, exactly why the COSO/Crowe survey published earlier this year found that only 7 percent of ERM programs are seen as strategic partners by the business.
That is not a criticism of the practitioners. It is a diagnosis of where most ERM programs sit on the maturity curve, and what the next investment must accomplish to move beyond it.
Why Your ERM Program Cannot Get a Seat at the Strategy Table
Every chief risk officer reading this knows the conversation. The CEO asks what the top three strategic risks are this quarter. The answer comes from a quarterly risk register refresh and a heat map. The CEO nods, thanks the CRO, and moves on. Nothing changes.
The new COSO/Crowe practitioner guide, From Guidance to Action: Exploring Practical Enterprise Risk Management, just put a number on how widespread this pattern is. Ninety-three percent of enterprise risk management programs are stuck on the wrong side of the strategy conversation, and the reason is not what most risk leaders have been told.
What ServiceNow Just Announced Is Bigger Than a Security Story
ServiceNow announced Autonomous Security and Risk on Tuesday morning, integrating its recent acquisitions of Armis and Veza into the ServiceNow AI Platform under what the company calls the AI Control Tower. The press release framed the launch as a way to govern every AI agent, identity, and connected asset across the enterprise. I am writing from Knowledge ’26 in Las Vegas, where the announcement landed in the opening keynote and where the architectural ambition behind it has been on display all week.
The first-wave coverage is reading the announcement as a security story. The Armis acquisition closed two weeks ago, the Veza integration extends identity controls to the AI agents now operating inside enterprises, and a new generation of what ServiceNow calls AI specialists handles vulnerability remediation and security operations end to end. Those elements are real, and the security framing is not wrong. It is incomplete. What ServiceNow has actually announced is the first complete commercial architecture for governing the autonomous enterprise. We have been writing about the emergence of this category, autonomous integrated risk management (IRM), in The RiskTech Journal (RTJ) since October 2024.
Why Risk Technology Is More Exposed to the Systems of Record Shift Than Other Software Categories
Between December 2025 and February 2026, venture commentary converged on an architectural argument: traditional systems of record are losing primacy as agentic AI takes over execution, and value is migrating from the systems that record state to the systems that capture reasoning. Sarah Wang at Andreessen Horowitz, Jamin Ball at Clouded Judgement, and Jaya Gupta and Ashu Garg at Foundation Capital each made a version of the case in pieces published within two weeks of one another.
The venture commentary drew its examples from sales, support, and finance. Those domains can tolerate lossy decision capture. Risk technology cannot. Audit, compliance, and assurance are not optional use cases bolted onto risk platforms. They are the reason the platforms exist, and each of them requires the ability to answer why something was allowed to happen.
The IRM50 AI Disruption Risk Index measures vendor-level exposure across fifty IRM and GRC platforms. The gap between tier one and tier five is not incremental. It is the difference between absorbing the shift and being absorbed by it.
WEF Claims AI Governance is a Growth Strategy
The recent World Economic Forum argument that “effective AI governance” is now a growth strategy is directionally correct, and also incomplete in a way that will matter for buyers in 2026. The claim is correct because governance reduces friction, clarifies accountability, and increases repeatability as AI moves from pilots to enterprise scale. The claim is incomplete because many organizations are calling the entire operating model “AI governance,” when the value is realized only when governance is translated into management execution.
GRC Without Visionaries: What the 2025 Gartner® Magic Quadrant™ Reveals About the Future of Risk
The release of the “2025 Gartner® Magic Quadrant™ for Governance, Risk and Compliance (GRC) Tools, Assurance Leaders” marks an important turning point in the evolution of enterprise risk technology. For the first time in nearly two decades of coverage, Gartner has explicitly defined the GRC category around assurance leaders rather than enterprise risk or governance audiences.
Equally significant is the visual structure of the 2025 quadrant, which contains an entirely empty Visionaries section. While some may interpret this as a sign of stagnation, it more accurately reflects a market that has entered its integration phase. The GRC segment has reached functional maturity and operational stability, creating the foundation upon which the next generation of Integrated Risk Management (IRM) and Autonomous IRM capabilities will develop.
Here, we analyze the implications of the 2025 Magic Quadrant through the lens of the IRM Navigator™ Model and the recent IRM Navigator™ Vendor Compass for Governance, Risk and Compliance (GRC) - 2025 Edition. Our research concludes that the absence of Visionaries does not indicate a failure of innovation, but rather the outcome of successful specialization. GRC has become the operational core of enterprise assurance, while IRM now defines the broader architecture of enterprise confidence and decision intelligence.
Palo Alto Networks CEO Warns of AI Agent Risks
On CNBC yesterday, Palo Alto Networks CEO Nikesh Arora issued one of the most direct warnings yet about the risks of enterprise AI agents. He noted that in the near future, “there’s gonna be more agents than humans running around trying to help you manage your enterprise.” If true, that represents not only an IT transformation, but a fundamental shift in the risk surface of every large organization.
The Coming Wave: Why AI-Fueled Cyber Crime Demands a New Layer of Risk Management
In June 2024, a ransomware attack on Synnovis—an NHS diagnostics provider—led to thousands of canceled surgeries, long-term patient harm, and yet barely registered in the headlines. A year later, an attack on Marks & Spencer, which temporarily left Percy Pig sweets and Colin the Caterpillar cakes off supermarket shelves, wiped £600 million off the company’s market cap and triggered nationwide panic.
This juxtaposition, as Misha Glenny eloquently observes in his Financial Times Weekend article, reveals something uncomfortable about both society’s perception of cyber risk and our structural ability to respond to it. But it also points to a larger and more pressing reality: AI is about to turn every cyber threat vector into a force multiplier—and the defensive tools most organizations rely on are no longer fit for purpose.
As AI matures into autonomous, agentic forms, we’re not just dealing with more attacks—we’re dealing with smarter, faster, and more scalable ones. The solution isn’t just better cybersecurity. It’s Integrated Risk Management (IRM)—and it must evolve as rapidly as the threat landscape.