Why Risk Technology Is More Exposed to the Systems of Record Shift Than Other Software Categories
Source: wheelhouseadvisors.com
Between December 2025 and February 2026, venture commentary converged on an architectural argument: traditional systems of record are losing primacy as agentic AI takes over execution, and value is migrating from the systems that record state to the systems that capture reasoning. Sarah Wang at Andreessen Horowitz, Jamin Ball at Clouded Judgement, and Jaya Gupta and Ashu Garg at Foundation Capital each made a version of the case in pieces published within two weeks of one another. Foundation extended the argument in a February conversation with Aaron Levie of Box. The vocabulary varied across the pieces. The underlying claim did not.
Wheelhouse Advisors published the IRM50 AI Disruption Risk Index (ADRI) on February 24, operationalizing the same architectural shift as a vendor-level exposure scoring framework across fifty IRM and GRC vendors. The venture commentary asked where new platforms will be built. ADRI asks which existing risk technology vendors are structurally exposed to the shift those platforms will cause.
Risk Technology Is Structurally More Exposed
The venture commentary drew its examples from sales, support, and finance. Those domains can tolerate lossy decision capture. A CRM that stores the final discount without the reasoning is expensive but not structurally disqualifying. A general ledger that records the transaction without the exception memo is the same.
Risk management is different. Audit, compliance, and assurance are not optional use cases bolted onto risk platforms. They are the reason the platforms exist. Each of them requires the ability to answer why something was allowed to happen, and that is precisely the question object-centric systems cannot answer. The architectural problem the venture commentary identifies for enterprise software broadly is a commercial problem. The same problem in risk management is a structural one, because the entire regulatory and governance regime assumes decision lineage exists and can be produced on demand.
This is why the current wave of agentic GRC offerings from legacy vendors is a transitional category rather than a destination. Bolting a copilot onto an object store does not produce decision lineage. It produces faster access to the same lossy record. Vendors shipping these offerings are extending the useful life of their existing architectures. They are not solving the autonomous operation problem that is coming for their customers.
How ADRI Measures Exposure
ADRI evaluates fifty IRM and GRC vendors across two structural dimensions. Compliance-artifact dependency measures how much of a vendor’s commercial position rests on producing and reconciling the object-centric artifacts audit and compliance regimes have historically required. Autonomous risk capability measures how much of the platform is built to operate as a decision-centric system of action rather than an object-centric system of record.
The two dimensions operate independently, producing a six-tier exposure structure. Vendors high on dependency and low on capability sit in the maximum exposure position. Their commercial footprint is concentrated in the object-centric layer the venture commentary predicts will be demoted with no credible path to the decision-centric layer being promoted. Vendors high on both dimensions carry scale and architectural alignment. Vendors low on object dependency and high on decision capability are the emerging entrants: well-positioned structurally but without commercial scale to capture the shift yet.
The tier assignments follow from where fifty named vendors actually sit on both dimensions. They are not editorial judgments.
What Buyers and Investors Should Take From This
Procurement decisions made over the next twenty-four months will lock in architectural postures that determine how well the risk function operates under autonomous conditions. Vendors high on compliance-artifact dependency and low on autonomous risk capability will age poorly. The buyer’s exposure is inherited from the vendor’s exposure, and the lock-in periods on most GRC contracts are long enough that the inheritance cannot be unwound quickly.
For investors, the exposure is unevenly distributed and currently mispriced. The February 2026 software selloff began to incorporate AI disruption risk into valuations in general terms, but the structural differences captured in the tier separations have not been fully priced in at the vendor level. The gap between tier one and tier five is not incremental. It is the difference between absorbing the shift and being absorbed by it.
The venture conversation asked where trillion-dollar platforms get built. ADRI answers a harder question for risk technology buyers and investors: Which existing vendors survive the architectural shift, and which do not?
The IRM50 AI Disruption Risk Index, including all fifty vendor tier assignments and the full methodology, is available exclusively on The RTJ Bridge at wheelhouseadvisors.com/rtj-bridge.
Source References
Wang, S. “Systems of record lose ground.” In “Big Ideas 2026: Part 1,” Andreessen Horowitz, December 9, 2025. https://a16z.com/newsletter/big-ideas-2026-part-1
Ball, J. “Clouded Judgement 12.12.25: Long Live Systems of Record.” Clouded Judgement, December 12, 2025. https://cloudedjudgement.substack.com/p/clouded-judgement-121225-long-live
Ball, J. “Clouded Judgement 12.19.25: The Front Door to the Systems of Record.” Clouded Judgement, December 19, 2025. https://cloudedjudgement.substack.com/p/clouded-judgement-121925-the-front
Gupta, J. and Garg, A. “AI’s trillion-dollar opportunity: Context graphs.” Foundation Capital, December 22, 2025. https://foundationcapital.com/ideas/context-graphs-ais-trillion-dollar-opportunity
Garg, A. “The case for context graphs: With Aaron Levie, Co-founder and CEO, Box.” Foundation Capital, February 20, 2026. https://foundationcapital.com/ideas/the-case-for-context-graphs
Wheeler, J. A. “The IRM50 AI Disruption Risk Index: Which Vendors Are More Durable in the Age of Autonomous IRM?” The RTJ Bridge, Wheelhouse Advisors, February 24, 2026. https://www.wheelhouseadvisors.com/rtj-bridge/the-irm50-ai-disruption-risk-index
