The Risk Wheelhouse Podcast
The Risk Wheelhouse is the podcast dedicated to exploring how RiskTech is reshaping the future of risk management. Hosted by our experts, Ori Wellington and Sam Jones, each episode delves deep into Integrated Risk Management (IRM), offering insights into the latest trends, technologies, and strategies. Join us to stay ahead in the ever-evolving risk landscape and empower your organization with actionable knowledge.
S9E1: Stop Buying GRC Hype
Your GRC stack can generate perfect audit evidence and still leave the business exposed. We just released the 2026-2027 IRM Navigator Vendor Compass for Governance, Risk, and Compliance, and we are using it to cut through the loudest AI claims in the GRC software market and get brutally practical about what actually improves enterprise resilience.
S8E6: Why Embedded Enterprise AI Agents Create Governance Blind Spots
Your monitoring stack can be immaculate and your business can still be in trouble. We walk through the green dashboard paradox: an embedded autonomous AI agent issues a massive, unapproved customer credit, every API call is authenticated, every system returns success, and yet the executive team is left staring at perfect telemetry with no usable explanation. That is the new enterprise AI risk, not broken software but software behaving exactly as designed while making a decision your organization never meant to authorize.
S8E5: The New Rules of Autonomous Risk
The safest factory is the one you can see: raw materials arrive, machines do predictable work, and when something fails you can point to the exact station that broke. AI flips that mental model. Our enterprise “assembly line” for decisions now runs in the dark across cloud systems, open source repositories, and black box models making probabilistic calls at machine speed. If you are responsible for integrated risk management, GRC, or security, that shift creates one urgent mandate: prove trust with defensible evidence.
S8E4: The Death of the GRC Moat
That million dollar GRC pricing sheet on your screen might be selling you the digital equivalent of a 1980s filing cabinet. We pull apart why governance, risk, and compliance software suddenly looks like a gold rush in 2026, and why the old buying signals no longer work. The key shift: storing and linking risk data is largely a commodity, and even “enterprise hardening” security features are increasingly just cloud configuration. If a vendor’s big flex is secure storage plus a polished dashboard, we explain why that’s not a premium platform anymore.
S8E3: From Passive GRC To Autonomous IRM
Your risk platform might be perfectly secure, perfectly organized, and completely useless at the moment risk actually happens. We start with a blunt diagnosis of legacy GRC and integrated risk management software: it records history after the work is done, creating a dangerous latency gap between operations and compliance. Then we lay out the shift that is reorganizing the enterprise risk technology market, the agentic control plane, where the system can sense an anomaly, decide on a response, execute an intervention, and produce immutable proof in real time.
S8E2: How To Spot Real Autonomous AI In GRC Buying
“Autonomous AI” is not a vibe, it’s an architectural promise. When a vendor tells you their GRC platform can run compliance, risk, and controls without humans, they’re claiming a system of action: detect, decide, act, and verify in a closed loop. We dig into a sharp Wheelhouse Advisors report on Optro’s acquisition of Midship to separate what’s real from what’s merely well-written.
S7E5: When Agentic AI Breaks The Law And You Take The Fall
A subpoena shows up, and it is not addressed to “the company.” It is addressed to you, because an autonomous AI agent quietly renegotiated contracts, stripped a mandatory compliance clause, and triggered a regulatory breach that no human even knew was happening. That is the new baseline for executive risk, and it is why we go deep on the Wheelhouse Advisors 2026 IRM Navigator Leadership Persona Guide and what it reveals about integrated risk management in the age of agentic AI.
S7E4: Your Company Just Hired 10,000 Invisible Interns
10,000 invisible autonomous AI agents working inside a single enterprise sounds like a productivity dream until you realize no one can explain who chartered them, what data they touch, or what decisions they are quietly making. We take on the popular “AI agent sprawl” narrative head-on and argue for a sharper label: a governance failure in progress that can undermine integrated risk management from the inside out.
S7E3: Why ERM Keeps Getting Ignored
93% is not a rounding error, it’s a warning flare. When enterprise leaders ask for guidance on the biggest strategic risks ahead, many risk teams respond with a quarterly risk register and a heat map. That’s not “wrong,” it’s simply what a compliance-first system is designed to produce. The result is an asymmetric exchange: executives need a radar, and the organization hands them a snapshot from the past.
We walk through new practitioner research from COSO and Crowe alongside John A. Wheeler’s analysis in the RiskTech Journal to explain why the ERM strategy gap persists. Our core claim is straightforward: the failure of ERM is largely structural, not behavioral. When ERM gets fused with GRC under the same reporting line, tooling, and audit committee cadence, uncertainty gets treated like a defect. That destroys psychological safety, suppresses early warning signals, and leaves strategy teams flying blind.
S6E7: AI Upends GRC - From Clipboards To Control Planes
What happens when the firm that helped define integrated risk management turns a critical lens on the category's foundations?
In this episode, analysts Ori Wellington and Sam Jones preview two major Wheelhouse Advisors research publications: The Integration Trap for GRC and the IRM50 AI Disruption Risk Index. The data reveals a surprising finding: when 50 IRM vendors are scored on structural exposure to AI disruption, market leadership and market durability turn out to be very different things.
At the heart of the analysis is what Wheelhouse calls the Integration Trap. Many established platforms excel at compliance documentation and assurance reporting but were never architected for real-time operational control. That distinction matters now more than ever. Agentic AI does not need dashboards or user interfaces. It needs APIs and control planes. Vendors with deep operational DNA are naturally positioned for this shift, while those built primarily around human workflows face difficult architectural decisions.
S6E6: Board Priorities 2026 - The Integration Trap
Growth used to win every boardroom vote. Now the data says something different: directors are prioritizing technology adoption and integration as the top 2026 investment, even as they admit their weakest expertise sits in AI, cybersecurity, and geopolitics. We unpack that paradox and show how uninformed speed turns “integration” into a superhighway for risk, unless you pair it with decision rights, embedded controls, and verifiable assurance.
S6E2: Rethinking Integrated Risk, From ROI To Dividends
Integrated Risk Management (IRM) is repeatedly underfunded for a structural reason: leaders keep forcing IRM into an ROI construct that demands a single, auditable chain of causality, while IRM is designed to distribute value across multiple domains at once. In this episode, Ori Wellington and Sam Jones explain why ROI framing collapses into assumption-stacked narrative under CFO scrutiny, and why risk leaders need a finance-compatible alternative that remains decision-grade.
The episode’s answer is a disciplined shift: evaluate IRM with cost/benefit analysis, and label the benefit streams as dividends. Dividends are distributed outcomes that improve enterprise performance and resilience without requiring false precision in a single attributable cash-flow line.
S5E9: ServiceNow Buys Armis, Telemetry Meets Workflow for IRM
ServiceNow’s planned $7.75B all-cash acquisition of Armis (targeted to close in H2 2026) is easy to misfile as “just another cybersecurity deal.” In this episode, Wheelhouse Advisors’ Ori Wellington and Sam Jones explain why it is actually a defining IRM market signal, one that raises the standard for what “risk management at scale” should mean going into 2026 procurement cycles.
S5E8: 2025 ERM Vendor Compass, The New Enterprise Decision Layer
ERM has a perception problem, and in 2025 it becomes a performance problem. Many programs still optimize for completeness, annual reporting cycles, and beautifully formatted board packs. Boards increasingly optimize for something else: faster, defensible decisions under volatility. The market’s new standard is measurable and uncompromising: time to decision and time to evidence. If your ERM platform depends on manual synthesis to tell the story, the story arrives late, and leadership is forced to decide on partial facts.
In this episode, we unpack the 2025 IRM Navigator™ Vendor Compass for Enterprise Risk Management (ERM) and explain why ERM must operate as the enterprise decision layer. That means converting risk appetite into quantified thresholds and escalation logic, sustaining a living scenario portfolio that can be refreshed and reused, and reusing verified evidence from ORM, TRM, and GRC to produce board-grade outputs with traceability.
S5E7: Stop Buying Better Silos: How the IRM Navigator™ Curve Exposes RiskTech Hype
In this episode of The Risk Wheelhouse, Ori Wellington and Sam Jones tackle one of the most expensive mistakes in risk management today: buying impressive tools that quietly deepen silos instead of advancing your program. If you have ever sat through a RiskTech demo and wondered whether you are truly moving forward or just spending more, this conversation is your roadmap.
Ori and Sam unpack the IRM Navigator™ Curve, a visual model that traces the journey from fragmented Risk Dysfunction to unified Risk Agency, where human and machine agency work together inside validated guardrails. They explain the five maturity levels and four investment domains, then show why you cannot simply “skip ahead” by buying an advanced TRM or AI platform before your GRC, ERM, and ORM foundations are in place.
S5E6: Build An Emerging Risk Reflex Before The Next Shock Hits
The conversation centers on a stubborn truth: most boards are well briefed on emerging risks, yet few translate insight into movement. The research shows 76 percent receive comprehensive risk reports, 42 percent engage meaningfully, and just 22 percent act. That collapse at the decision point is the “funnel of inaction.” The hosts argue that leaders chase the wrong fix by investing in problem precision using hyper-detailed probabilities and impact ranges. This approach only provides a marginal, statistically insignificant uplift in action. Precision invites skepticism, shifts attention to model assumptions, and implies costly, multi-year programs that boards rationally defer. The better path is to reframe conversations around solution options that emphasize low regret actions, the cost of delay, adjustments to existing programs, and clear pacing across quarters.
S5E2: Redrawing Data Lines - DOJ’s DSP and the New National Security Mandate
Your “encrypted” data may still be regulated and today the rules start to bite. We unpack how the Department of Justice’s Data Security Program moves from guidance to strict enforcement and why it reframes data governance as a national security mandate. From redefining “covered data” to treating anonymized and encrypted datasets as in-scope when they enable linkage or inference, we walk through what changes right now for risk leaders, counsel, and compliance teams.
S4E9: The SaaS Domino Effect - How Compromised OAuth Tokens Created a Cybersecurity Nightmare
Behind every digital business lies an invisible web of trust: the OAuth tokens silently connecting your applications. What happens when these trusted connections become your greatest vulnerability? A sophisticated attack campaign recently exploited these connections, bypassing traditional security measures to breach major cybersecurity companies including Cloudflare, Palo Alto Networks, and Proofpoint. Rather than directly attacking primary platforms, threat actors targeted Drift's OAuth integration tokens, effectively stealing the keys that allowed them to impersonate this trusted web chat tool when connecting to enterprise Salesforce instances.
S4E7: The Academic Reckoning of Risk Management
Risk management evolution isn't just about new acronyms. It's about organizational survival in an increasingly complex world. When we examine the journey from checkbox compliance to genuine integration, we uncover profound lessons about how businesses navigate danger and why some approaches fundamentally fail when pressure hits.
This deep dive traces the fascinating progression from Governance, Risk and Compliance (GRC) through Enterprise Risk Management (ERM) to today's Integrated Risk Management (IRM) framework. Drawing from John Wheeler's powerful "Risk Ignored" series, we explore how GRC emerged after Sarbanes-Oxley as an elegant solution on paper that quickly collapsed under its own weight. As Norman Marks memorably quipped, GRC often stood for "Governance, Risk Management, and Confusion."
S4E3: An Extinction Level Event - Risk in the Digital Age
Modern risk management stands at a precipice of transformation where AI-driven platforms are causing what ServiceNow's CEO Bill McDermott calls an "extinction-level event" for traditional software vendors. This profound shift is reshaping how organizations approach enterprise resilience, with implications for businesses across all sectors.