Why Anyone Can Build a GRC Platform Now

The GRC funding tape this year reads like a market being rebuilt from scratch. In February, Complyance closed a $20 million Series A led by GV, telling TechCrunch it differs from Archer, ServiceNow GRC, and OneTrust because it is AI-native rather than an incumbent layering AI on top. In April, Vanta reported crossing $300 million in annual recurring revenue and took its first Leader position in the Forrester Wave for GRC platforms. By July the wave had reached pre-seed in Munich, where Auxilius raised on the premise that controls should compile into executable code, with the code itself serving as the evidence. Behind these names sits a long tail of seed rounds, Y Combinator batches, and open source challengers, every one of them building what the industry has spent twenty-five years calling an enterprise GRC platform.

The usual explanation is that venture capital found a hot category. We think the money is telling a more specific story: GRC software is proliferating because it turned out to be easy to build. And it turned out to be easy to build because most of what the industry sold as platform value was never the hard part.

The graphic above compresses that argument into a single view. It shows a GRC platform as five layers, bracketed into the three tiers of enterprise software that Wheelhouse Advisors has used to analyze this market since introducing the distinction in Not All SaaS Is Equal, the February research note that established why the system of record, the system of engagement, and the system of action carry structurally different disruption profiles under agentic AI. Read the stack from the bottom and the history of this market becomes the history of its barriers falling, one layer at a time, in order.

Reading the Stack From the Bottom Up

Start with the data model. The celebrated complexity of GRC data, one control mapped to twenty obligations across multiple jurisdictions and business units, is a many-to-many relationship problem, and relational databases solved that class of problem in the 1980s. A junction table is a textbook exercise. It was already a commodity before the first GRC platform shipped on top of it.

The hardening layer above it held out longer. Identity, granular permissions, encryption, audit logging, retention: in 2010 this took a vendor years of engineering and genuinely separated enterprise software from everything else. Cloud services ended that. What was a multi-year build is now a configuration exercise against managed identity providers and compliance-certified infrastructure. The moat was paved over and turned into a road anyone can drive on.

Together those two layers form the system of record, the trusted store of risks, controls, obligations, and their connections. Both went to commodity years ago. The market simply kept pricing them as though they had not.

The next bracket up is where 2026 is happening. The application layer, the forms, workflows, and dashboards that make up nearly everything a user ever sees, is the layer AI-assisted development just made close to free. A risk professional can describe an assessment process and hold a working application within days. That fact has an uncomfortable corollary for the established market. If the visible product can be convincingly rebuilt by a practitioner in a week, then the visible product was mostly forms and workflow over a database. A system of record wearing a nicer interface, sold at platform prices.

Sitting beside it in the engagement bracket is the layer deflating as we write: semantic interpretation. Reading a regulation and mapping it to a control library, reconciling overlapping frameworks, harmonizing taxonomies across business units. This was never really software. It was consulting labor billed by the hour, and it happens to be exactly the pattern-matching work large language models do well. The 2026 IRM Navigator Viewpoint Report names the force behind this the human work compression pattern and quantifies it: the services share of total market value is forecast to fall from 15.9 percent in 2026 to 12.0 percent by 2033. GRC absorbs the largest share of that redistributed consulting value because compliance is where human artifact production concentrates, which means GRC is also where the compression bites hardest.

That leaves the top of the stack. The system of action does not file a risk or route a task. It sees across performance, resilience, assurance, and compliance at once and operates on the risk itself, with the full institutional context a real business decision requires. Nothing in a thirty-year-old textbook answers that problem. It resisted commoditization for the simplest possible reason: until the current generation of AI, it could not be built.

A plainer way to say all of this. The record tier is the filing cabinet. The engagement tier is the clerk who fills it and fetches from it. The action tier is the officer with the authority to act on what the files say. The cabinet became free decades ago, the clerk became nearly free this year, and neither ever held the authority to act.

Growth and Deflation Are the Same Story

None of this describes a shrinking market. The 2026 IRM Navigator Viewpoint Report sizes GRC at $17.2 billion for 2026, second largest of four segments in a $69.7 billion integrated risk management market, and forecasts it to more than double to $35.8 billion by 2033. The segment detail matters more than the headline, though. GRC carries the lowest growth rate of the four segments, 11.1 percent compounded, and that is the point: the segment is modernizing rather than expanding, converting from a system of record cost center into the verification layer of agentic architectures, and it receives the largest share of redistributed consulting value along the way. Growth and commoditization are not in tension. Value is migrating up the stack, and the crowd of new entrants is the visible symptom of the deflation underneath. Commodities proliferate.

The pattern has a pedigree. Clayton Christensen described it two decades ago as the law of conservation of attractive profits: when one layer of a value chain becomes modular and good enough, it commoditizes, and attractive profits migrate to the adjacent layer that is not yet good enough. A market where entrants multiply is a market whose entry barriers have fallen; that much is introductory economics. What Christensen adds is the direction the profits travel, and in this market the not-yet-good-enough layer sits at the top of the stack.

The forecast quantifies the migration, and it required an unusual admission to get there. The 2025 edition projected risk management consulting as the fastest-growing segment of this market, compounding at 16.9 percent and reaching 19.2 percent of total value by 2032. Within a single year, the acceleration of agentic capability made that trajectory untenable, and the 2026 edition reverses it. Consulting no longer appears as a standalone segment at all; its value is redistributed into the four platform segments its engagements serve. On the prior methodology carried forward, the market would reach $147.0 billion in 2032. The current forecast reaches $141.6 billion. The roughly $5 billion gap is services displacement, partially offset by faster platform growth, and the offset is the finding that matters here: TRM now compounds at 13.9 percent, above its previously published rate, because migrating consulting spend converts directly into platform-embedded agentic capability. The dollars leaving hourly delivery are arriving as software.

The forecast also names what would prove it wrong. If the migrated-services component keeps growing above roughly 12 percent through 2027, displacement is arriving slower than modeled and a milder scenario applies. That is a checkable number, and publishing it is the honest way to hold a thesis this aggressive.

And the market has already shown what competition at a commodity layer looks like. The AI-native cohort contains real engineering and real traction. It also contains Delve, which raised a $32 million Series A at roughly a $300 million valuation, faced whistleblower allegations in March, watched named customers depart and re-certify elsewhere in April, and was removed from Y Combinator's portfolio directory. We examined that episode in April through the IRM Navigator Curve, which establishes that foundational program integrity is the architectural prerequisite without which agentic compliance capability is structurally unstable. When the product is cheap to replicate, competition migrates to speed, price, and claims. The casualties follow.

Where the Market Gets Decided

For buyers, the practical question has changed. It is no longer which vendor has the most complete record and engagement tiers, because those tiers are converging toward free, and paying platform premiums for them is paying 2015 prices for 2026 commodities. The question is which vendors are genuinely building the action tier, with integrated cross-domain context and accountable execution, rather than bolting a chatbot to a form library. Vendors face the same test from the other side. Defending the commodity layers is a margin strategy with a visible expiration date.

The barriers to entry in GRC did not collapse this year. They fell one at a time over four decades, from the bottom of the stack up, while the industry kept pointing at them as the moat. What remains above the waterline is the system of action, and that is where this market will be decided.

The full market sizing, segment forecasts, and vendor analysis behind this article are available in the 2026 IRM Navigator Viewpoint Report at wheelhouseadvisors.com/irm-navigator-research/p/2026-irm-navigator-viewpoint.