The IRM Vendor Market: What the Major Analyst Firms Won’t or Can’t Tell You

IRM Navigator™ ReportsVendor CompassIRM Leaders
Written By Ori Wellington

Wheelhouse provides a buyer, investor, and vendor guide to the only research series that covers all five IRM market segments in a single, structured framework.

The major analyst firms have lost the plot on integrated risk management. Gartner has retreated to a narrow “Assurance Leader” persona, publishing Magic Quadrants for GRC tools and third-party risk management that serve audit and compliance functions while leaving enterprise risk leaders, CISOs, and business executives without a coherent market view. Forrester treats GRC and cybersecurity as parallel but disconnected research tracks, with no framework that ties them together. IDC publishes a single GRC MarketScape anchored to cybersecurity, mixing legacy risk platforms with compliance automation tools in ways that obscure more than they reveal. None of them cover ERM, ORM, TRM, and risk consulting together in a single, structured research program.

The market is delivering its own verdict. Gartner’s stock declined from a peak above $550 in late 2024 to roughly $149 by April 2026, a loss of more than $30 billion in market capitalization, as Contract Value growth decelerated from +8% to +1% in four consecutive quarters. Forrester’s market cap has fallen from nearly $1 billion in 2021 to roughly $97 million, with annual revenue down more than 25% over the same period and the company exiting its strategy consulting practice entirely. IDC changed hands twice in less than a decade, from a Chinese consortium to Blackstone, with its media business sold off in March 2025. These are not isolated business cycle corrections. They are structural signals that the traditional pay-to-play analyst model is losing its grip on enterprise technology buyers.

This is the wrong moment to narrow the aperture on risk research. AI adoption, regulatory velocity, and the pace of business change have made integrated risk management more relevant, not less. Organizations need a view of the full risk technology and services market, not a collection of persona-specific snapshots.

Wheelhouse Advisors was built to fill that gap, and our founder and CEO knows the incumbent model from the inside. After a decade at Gartner, where he created the Integrated Risk Management category, he built Wheelhouse Advisors on a fundamentally different research model: proprietary algorithms that access independent data on vendors across the full IRM market, The result is assessment built on evidence rather than participation, covering the full market rather than a subset of it.

That research model has produced the IRM50 AI Disruption Risk Index, published on The RTJ Bridge in February 2026. The ADRI classifies fifty risk technology and services vendors across six tiers by structural AI disruption exposure, using a methodology built on compliance-artifact dependency and autonomous risk capability rather than market share or feature count. It is the only index of its kind in the IRM market. RTJ Bridge subscribers can access the full ADRI and ongoing IRM50 OnWatch vendor assessments at wheelhouseadvisors.com/rtj-bridge.

The same research model underlies the IRM Navigator™ research series, now complete for the 2025–2026 cycle.

The 2025–2026 series covers the IRM market in full. The IRM Navigator™ Viewpoint Report establishes the market framework, identifies the six 2025 IRM50 Market Leaders, and sets the analytical foundation for everything that follows. The Vendor Compass reports then go deep on each of the five IRM market segments: Governance, Risk and Compliance, Enterprise Risk Management, Operational Risk Management, Technology Risk Management, and Risk Management Consulting. Each report evaluates vendors on two dimensions, solution coverage and level of integration, and places them in one of three tiers: Integrator, Accelerator, or Pace Setter. The newest addition to the series is the VC Sonar™ for Performance and Resilience, a cross-segment view spanning ERM and ORM that focuses on emerging risktech vendors driving the market toward autonomous risk management. A VC Sonar™ for Assurance and Compliance, spanning GRC and TRM, is forthcoming.

That is a serious body of research. And it raises a legitimate question for anyone who wants a full market orientation before going deep into individual reports.

The 2025–2026 Vendor Compass Segment Summary answers that. It pulls every vendor placement across all five Vendor Compass reports into one interactive table, available free to anyone with no login or subscription required. The full Vendor Compass reports for each segment are available for purchase through the IRM Navigator™ Research series. The table is at wheelhouseadvisors.com/2025-2026-vendor-compass-segment-summary, and here is how each audience gets the most out of it.

If You Are Buying

Sort by the Segments column first. Vendors with placements across four or five segments rise to the top. That is your starting point for any platform consolidation conversation. A vendor evaluated and placed in GRC, ERM, ORM, and TRM has had to demonstrate something real across all four contexts. Archer, Riskonnect, MetricStream, and IBM OpenPages are among the handful that appear across three or more segments at Integrator or Accelerator. That cross-segment consistency is worth knowing before you build a shortlist.

Filter to Integrators only to see every vendor holding the top tier placement in at least one segment. Then sort by whichever segment is your immediate priority. The Integrator tier is not evenly distributed across segments. Seeing where it concentrates tells you something about where the market has actually matured versus where vendors are still catching up.

One more move: find your current vendor by name and scan across the row. If your GRC platform holds a placement in ORM or TRM, you may have more leverage in your next renewal conversation than you realize. If it has no placement outside its home segment, that is also useful to know before you commit to expanding the relationship.

If You Are Investing

Sort by Segments, then look at which vendors appear in three or more columns at Integrator or Accelerator. In a market where enterprise buyers are consolidating vendors and demanding more from fewer platforms, cross-segment placement is a reasonable signal of competitive durability. A vendor with broad evaluated presence has had to build and defend that position across multiple buyer contexts.

The IRM50 AI Disruption Risk Index adds another dimension to this analysis. The ADRI classifies vendors by structural AI disruption exposure across six tiers. A vendor that holds Integrator placement in multiple Vendor Compass segments and a strong ADRI tier is a structurally different investment proposition than one that leads a single segment but carries high AI disruption risk. Blackstone now requires AI disruption risk assessment on the first two pages of every deal memo. The ADRI was built to answer exactly that question for the IRM market.

Filter to IRM50 Market Leaders. Six vendors qualified in 2025. The table shows their cross-segment positions in one view. Some hold strong placements across multiple domains. Some are concentrated. The gap between market recognition and actual segment coverage is visible here in a way that no individual report makes easy to see.

Sorting by Type separates technology platforms from consulting firms. The Risk Management Consulting segment placement data reflects where institutional risk program delivery is consolidating, which matters for anyone tracking professional services dynamics alongside technology.

If You Are a Vendor

Your position in this table is public. Sorting by any segment column shows where you sit relative to every evaluated competitor in that domain. A buyer expanding their program can see in a few seconds whether you hold a placement in the segments adjacent to your core. If you do not, that absence is visible too.

The multi-segment filter is worth running with your own name in mind. Vendors placed in two or more segments appear there. Vendors placed in only one do not. That distinction shapes how buyers read platform potential versus point solution depth, and it shapes how investors read market addressability.

The Optro row is also worth noting. The rebrand from AuditBoard is documented directly in the table. Market positioning changes show up in this research in ways that a press release alone cannot replicate. The RTJ Bridge published a full IRM50 OnWatch assessment of the Optro rebrand and its structural implications in March 2026.

Your ADRI tier is equally visible to the buyers and investors reading this research. Vendors with high AI disruption exposure and limited cross-segment placement face a compounding credibility challenge in a market that is actively pricing AI durability into procurement and investment decisions.

What the Table Does Not Replace

It shows where vendors stand. It does not explain why, and it does not tell you whether a given vendor fits your organization’s maturity stage, architecture, or procurement constraints. That analysis lives in the full Vendor Compass reports for each segment, along with buyer guidance and placement rationale that does not appear in the summary.

The Segment Summary is the view from altitude. The reports are what you read before you commit to a direction. Access the full 2025–2026 IRM Navigator™ research series at wheelhouseadvisors.com/irm-navigator-research.

SOURCE REFERENCES

Wheelhouse Advisors Research

Analyst Firm Research

Market and Financial Sources

Ori Wellington is the lead editor for The RiskTech Journal and The RTJ Bridge, published by Wheelhouse Advisors LLC. Wheelhouse Advisors is an independent IRM strategy and technology advisory firm. Placement research reflects independent analysis conducted using proprietary methodology; vendor self-reporting alone does not qualify as placement evidence. The IRM Navigator™ Model is the intellectual property of Wheelhouse Advisors LLC. Opinions expressed are those of Wheelhouse Advisors and do not constitute investment, legal, or procurement advice.

Ori Wellington

Orion “Ori” Wellington is the lead editor for The RiskTech Journal and The RTJ Bridge, where he helps shape editorial direction, guide strategic narratives, and support media relations across Wheelhouse Advisors. As a digital editorial advisor, Ori synthesizes trends in risk, technology, and governance, drawing from roles modeled on information security, risk analytics, and IT leadership.

Part of Wheelhouse’s AI-augmented research team, Ori works to distill complex signals into actionable intelligence—bridging expertise across domains and elevating the voice of integrated risk thinking.

https://wheelhouseadvisors.com
Previous

What Risk Leaders Need to Know About AI Infrastructure
Next

Chasing the Certificate: How AI Hype Is Putting Vendors, Buyers, and Investors at Risk