The RiskTech Journal

The RiskTech Journal is your premier source for insights on cutting-edge risk management technologies. We deliver expert analysis, industry trends, and practical solutions to help professionals stay ahead in an ever-changing risk landscape. Join us to explore the innovations shaping the future of risk management.

Where Do 33 Providers Land on the 2026-2027 IRM Navigator Vendor Compass for GRC?

Where Do 33 Providers Land on the 2026-2027 IRM Navigator Vendor Compass for GRC?

The 2026-2027 IRM Navigator Vendor Compass for Governance, Risk and Compliance (GRC) is Wheelhouse Advisors' evaluation of the providers that supply GRC capability to the enterprise. It covers 33 providers, 24 technology providers and nine services providers, all constituents of the 2026-2027 IRM50, and places each one in one of three categories according to its position on two axes. The graphic below shows the categories and the providers in each. The report shows where each provider sits on the axes and why, with a profile and placement rationale for every one.

GRC is the verification system of integrated risk management (IRM). It supplies the auditable evidence that connects the goals set in enterprise risk management (ERM), the processes run in operational risk management (ORM), and the assets governed in technology risk management (TRM) to accountable policies, certifiable controls, and reliable disclosures. The report evaluates providers on how well they produce that evidence and how far it travels.

Read More
Stop Deploying AI Agents You Cannot Monitor
IRM, Autonomous IRM, AI Governance, OpenAI Ori Wellington IRM, Autonomous IRM, AI Governance, OpenAI Ori Wellington

Stop Deploying AI Agents You Cannot Monitor

Three researchers fired by OpenAI have written to the company's board and safety committees with a warning that reaches well beyond one lab. According to The Wall Street Journal, which reviewed the letter, the former employees fear AI companies will lose the ability to monitor how their most capable systems reason, and they want OpenAI to work with outside safety auditors before that happens.

The concern centers on what researchers call chain of thought. It is the written record a model produces as it works through a problem, and labs read it to see how a system arrived at an answer or an action. The letter's authors, Jasmine Wang, Tomek Korbak, and Mikita Balesni, argue that the industry does not know how to safely build and release models it cannot monitor, and that frontier labs should not pursue advances that weaken that ability.

OpenAI's reply is the part risk leaders should read twice. The company says the three were dismissed for misconduct that included sharing confidential information with an outside AI safety group, and that the decisions had nothing to do with raising safety concerns. The former employees dispute that account. On the substance of the letter, the company did not push back. A staff memo shared by an OpenAI spokesperson said the ability to monitor its models is of the utmost importance and that third-party assessors are an important part of the safety ecosystem.

The lab and its critics disagree about the firings and agree on the principle. An AI system that cannot be monitored should not be deployed.

Read More
If Vendors Are Building Their Own AI Guardrails, Why Are Humans Still Doing the Checking?

If Vendors Are Building Their Own AI Guardrails, Why Are Humans Still Doing the Checking?

Every company in Fortune's account this week of how enterprises are governing AI agents shares one trait the story never names. Cisco built its MyAgent platform on Cisco's own compute, network, security, and observability products. Intuit built security, risk, and fraud tracking into GenOS, the platform behind Intuit's own customer software. Workday's agent system of record and ServiceNow's AI Control Tower govern Workday's and ServiceNow's own agents, and both are sold to customers as products. In each case the party building the agents, the party running them, and the party checking them is the same company. Fortune's John Kell presents this as chief information officers racing to put guardrails around agents. It is also four vendors grading their own homework.

The market's verdict on that arrangement arrived in the same news cycle. A Harris Poll survey found nine in ten organizations deploying autonomous agents and 76 percent hitting critical roadblocks moving them into production. Eighty-seven percent of decision-makers say their teams regularly re-verify the context.

Read More
Will AI Agents Make Third-Party Risk Management Smarter, or Just Faster?

Will AI Agents Make Third-Party Risk Management Smarter, or Just Faster?

ProcessUnity said this week that one early customer, a large global technology and consulting firm, has cut third-party intake cycle time by 54%, improved assessment throughput by 43%, and reduced incomplete inherent-risk questionnaires by 75% since putting AI agents to work. Those are vendor-supplied numbers from a single early adopter and deserve to be read that way. But the size of the numbers is not the story. The story is the kind of work the agents are being allowed to do.

Read More
Why Anyone Can Build a GRC Platform Now

Why Anyone Can Build a GRC Platform Now

The GRC funding tape this year reads like a market being rebuilt from scratch. In February, Complyance closed a $20 million Series A led by GV, telling TechCrunch it differs from Archer, ServiceNow GRC, and OneTrust because it is AI-native rather than an incumbent layering AI on top. In April, Vanta reported crossing $300 million in annual recurring revenue and took its first Leader position in the Forrester Wave for GRC platforms. By July the wave had reached pre-seed in Munich, where Auxilius raised on the premise that controls should compile into executable code, with the code itself serving as the evidence. Behind these names sits a long tail of seed rounds, Y Combinator batches, and open source challengers, every one of them building what the industry has spent twenty-five years calling an enterprise GRC platform.

The usual explanation is that venture capital found a hot category. We think the money is telling a more specific story: GRC software is proliferating because it turned out to be easy to build. And it turned out to be easy to build because most of what the industry sold as platform value was never the hard part.

The graphic above compresses that argument into a single view.

Read More

Subscribe for notifications when new RiskTech Journal articles and research updates are published.