This Is GRC
Make GRC relevant.
Get close enough to the technology and the business to see what is changing. Use AI to connect the signals. Help people make a better call while there is still time to make one.
The argumentSee it in action →
The problem
We have made GRC too small.
A company changes its products, vendors and systems every day. Too often, GRC meets that change later as an evidence request.
We chase screenshots, polish a spreadsheet and ask an engineer to explain a decision that happened three months ago. That is bureaucracy with a security vocabulary. GRC can do more.
The profession I want to build
GRC belongs where the work happens.
Our work is technical because the systems are technical. It is human because the decisions are human. We should be embedded with the teams building and running the business, with access to the data that tells us what is changing.
See the signals.
A control drifts. A vendor starts handling new data. The same finding returns. Those records already exist across the enterprise.
Connect the story.
AI can read across more of that evidence than a person can hold in one inbox. It can show the pattern, the missing context and the competing explanation.
Act while it matters.
A practitioner can take that understanding to the people who own the work, test the interpretation and help shape the decision before the next audit or incident.
See the idea in action
What happens when GRC sees a change early?
Try a fictional case. A vendor's use changes, a control claim drifts, or findings start to repeat. Follow the records and decide what deserves attention. The working demos show both what AI can connect and what a person still has to judge.
Explore the demos
The person behind this
I'm PP. I work on making this real.
I have built GRC programs, worked alongside technical teams and taught practitioners to get closer to the systems they are asked to assess. This Is GRC is where I put that point of view to work.
About me and my public work →