This week, I published the Buyer’s Guide: Governance, Risk, And Compliance Platforms, 2026, summarizing how satisfied clients are with their governance, risk, and compliance (GRC) platforms. The report is based on customer reference data from The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q2 2026. Speaking to customers during evaluative research processes is my favorite part of doing Forrester Wave reports, as it helps us to get specific insights into what’s working well in the industry and what isn’t. This blog outlines my own four key takeaways from those discussions and research:

  • Customers are dismayed with current AI capabilities, but that’s improving rapidly. At the time of the Wave evaluation, many AI capabilities offered little beyond enterprise AI tools like Copilot and Claude. Customer feedback on the use of AI within GRC tools can be summarized neatly with the Shakespearean quote “a plague on both your houses,” placing the use of AI as the lowest-ranked platform feature for our reference customers. Since then, AI capabilities have been rapidly improving as providers release agents that can execute parts of risk assessments, audits, and controls testing. In spite of these improvements, trust in the quality of what AI produces remains patchy. Risk leaders must bring their teams on side to realize AI’s benefits, as they’re a skeptical bunch by nature. Show your teams that AI features can accelerate their work while human review and oversight remain essential for mitigating AI hallucinations and other quality issues.
  • AI features pricing is messy, making it difficult to assess its value for money. AI pricing in GRC is inconsistent, with vendors offering a spaghetti mess of different approaches. Customers cited pricing clarity as the primary reason holding them back from using AI capabilities. Pricing complexity of AI — such as whether or not it’s included, separately priced, or consumption-based — makes it a struggle to assess whether the outcomes delivered match the sticker price. As frontier AI labs shift to token-based pricing, GRC providers’ AI delivery costs have surged. One CEO in the market shared that their AI costs had increased 10x overnight because of this shift, causing heartburn for their CFO. Risk leaders should engage with GRC providers that offer consumption-based pricing to validate the AI cost management practices vendors are using, which will enable them to keep AI token usage bills low and in line with their AI usage.
  • Tech leaders and CISOs want CCM yesterday. There’s currently a significant gap between customer desires for continuous controls monitoring (CCM) and what GRC platforms can provide. Wave reference customers wanted this capability but saw no clear path to achieve it. For CISOs and tech risk professionals I’ve spoken with recently, CCM is rapidly becoming a nonnegotiable requirement as the burden of manual assessments becomes too difficult to justify. Many customers have concluded that GRC platforms are unable to deliver this: They’re looking into building their own solution or looking for specialist CCM providers to plug this gap. Providers need to pay attention or risk losing business with tech and cyber leaders if they can’t meet the moment. Tech and security leaders should press GRC providers to deliver CCM or build it themselves using specialist CCM solutions or alternative data analytics technology.
  • “Going to gold” is used to avoid expensive customization. A minority of Wave reference customers mentioned they’re “going to gold,” implementing their GRC platform out of the box as closely as possible. A small number of customer references have either made going to gold a guiding principle of their current deployment or are refactoring their existing implementation to go back to the basics. Customers are adopting this approach to avoid costly overcustomization that delays implementation and simplify upgrades and access to new functionality throughout the platform’s lifetime, which can be made difficult or impossible to achieve by bespoke capabilities. Adopt “going for gold” as a guiding principle for faster implementation, simpler upgrades, and access to new functionalities.

As always, Wave reference customers are an invaluable part of the process and bring levity and reality to the process, which helps us immensely in getting a pulse for what’s going underneath the surface. Forrester customers wishing to discuss the GRC market or selection of providers based on these findings can schedule a guidance session or inquiry with me.

Share