How to Be a GRC Hero (Without Heroics)
summary
Argues that spreadsheets and fire drills are obsolete and shows a working playbook: connect telemetry streams to controls so an MFA drop 99%→95% flips control status automatically, run continuous vendor scoring to trigger automatic vendor risk propagation (pause renewals, flag contracts), detect unassigned critical CVs and create risks, and run policy drift detection that maps policy clauses to live telemetry. Claims these automations exist today, reduce evidence chasing, and scale GRC without heroics.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker intro
- 3:29The audit session hero problem
- 5:32How GRC has evolved
- 7:44GRC as a business function
- 9:31GRC as decision infrastructure
- 13:22Ending heroics with automation
- 15:10Real GRC engineering examples
- 21:57If a computer can do it
- 23:44What makes a GRC hero
- 37:08Closing thoughts and future
related talks
32mGRC Engineering - Bringing GRC to a repository near you
30mFireproof Your Castle with Risk-First GRC
05mBreaking Hero Behaviour
40mCloud Native GRC
15mCyber Risk Management: let’s try to manage it with open source and free software
26mPrevent Heroism: How to Work Today Reduce Work Tomorrow
12mLightning Talk: Revolutionize Security GRC: Leverage AI and LLM for Continuous Control...
36mNot Your Mama's Risk Assessment