Latest Articles

Only 13% of Organizations Have Full Visibility into AI Tools — The Governance Gap Is Widening Fast The Visibility Problem Drata's 2026 research on AI in GRC reveals a stark governance gap: only 13% of IT and security professionals have full visibility into the AI tools used in their organizations . A full 87% do not have complete visibility into the AI tools active across their business . This lack of oversight is contributing directly to operational and regulatory problems. The research found that 71% of organizations said an AI tool used for GRC had contributed at least once to a failed audit or a lapse in meeting a regulatory standard . Shadow AI: The New Shadow IT The biggest AI governance challenge is employees using unmanaged AI tools for productivity-related tasks without GRC oversight . By the time governance teams discover shadow AI tools, those systems may already be shaping customer communication, influencing hiring decisions, or processing sensitive data . High-risk actions that need prevention: Sensitive data copied into public AI tools Undocumented automated decisions Unreviewed AI-generated content sent externally Inconsistent answers across teams No audit trail for how outputs were produced The Vendor AI Problem The vendors you already approved are quietly becoming AI organizations. They are embedding models into products you procured for entirely different purposes. The vendor you assessed last year for CRM functionality now processes your customer data through an AI feature that nobody on your team signed off on . Why AI Governance Is Falling Behind Intent vs. Reality 69% of CISOs have allocated dedicated budgets for AI risk management in 2026. However, only 25% rate their governance maturity as advanced, and 39% have AI usage policies that exist on paper but are not consistently enforced . The Tooling Gap 86% of teams agree that many AI products aimed at GRC are not ready for large organizations, while 83% said they were not fully prepared for the next wave of AI integration . The Buyer Shift Some 64% of respondents said they would rather use targeted agentic AI systems than broad all-in-one platforms. That share rose to 70% among buyers focused on risk . "The horizontal AI platform era in GRC is over," said Matt Hillary, CISO and SVP of Security at Drata. "Buyers aren't waiting for the next generation of tools. They've moved their money toward agents that can prove specific, repeatable, and defensible outcomes" . Conclusion Without visibility, you cannot govern AI at scale. Organizations must establish a comprehensive view of all AI assets across the enterprise—including models, datasets, and agents—as a foundational step for AI governance . Action Items for Your Organization Conduct an AI discovery exercise to identify all AI tools in use Establish a centralized AI inventory Create AI usage policies and enforcement mechanisms Implement AI governance controls Monitor for unauthorized AI usage  

AI Agents Are Moving from Recommending Actions to Taking Them — GRC Will Never Be the Same The Autonomy Shift Agentic AI is reshaping GRC by enabling systems that can independently plan and execute multi-step workflows rather than simply generating outputs . This represents a shift from reactive compliance to continuous assurance, from static risk registers to real-time risk visibility, and from manual workflows to orchestrated risk management . What Agentic AI Can Do in GRC Autonomous Evidence Collection AI agents can continuously gather and validate evidence for audits, dramatically reducing manual effort . Automated Risk Remediation When risks are detected, agentic AI can initiate remediation workflows, orchestrate cross-functional actions, and generate executive-level insights . Continuous Third-Party Monitoring AI agents autonomously retrieve vendor data, validate responses, and correlate external risk signals . Regulatory Mapping AI systems interpret regulatory texts and map them to internal controls, generating audit-ready narratives . The Agentic AI Ecosystem The transformation involves a network of specialized agents: Agent Type Function Perception Agents Scan for risks and anomalies Reasoning Agents Analyze and interpret risk data Control Agents Validate compliance Action Agents Execute remediation Learning Agents Adapt and improve over time CISO Takeaways The shift requires a fundamental rethinking of how GRC is operationalized : Move from audit readiness to continuous assurance. Leading enterprises are collapsing audit cycles into always-on validation through AI-driven control monitoring. Prioritize platforms over point solutions. Move away from fragmented point solutions toward unified, AI-enabled GRC platforms. Shift focus from detection to orchestration. The true value of agentic AI lies in autonomous execution—enabling systems not only to identify risks but also to initiate remediation. The Adoption Reality Avasant research found that 68% of Gen AI projects are in production, while 30% of agentic AI projects have moved past the pilot/POC stage . The technology is moving from experimental to operational. Conclusion Agentic AI is enabling closed-loop GRC systems where risks are not only detected but also acted upon through orchestrated workflows. The future of GRC will be defined by the ability to operationalize intelligent, autonomous, and governed risk management at scale . Action Items for Your Organization Assess which GRC workflows could benefit from agentic AI Start with a pilot focused on one autonomous capability Establish governance for AI agent autonomy Define human-in-the-loop requirements Measure the impact on manual effort and response time  

What's the Real Risk After Controls? — The Critical Distinction Every GRC Pro Must Understand The Two Risk States Risk assessment must consider both inherent and residual risk: Type Definition Inherent Risk The level of risk that exists before any risk treatment or controls are applied Residual Risk The level of risk that remains after risk treatment and controls have been applied Why the Distinction Matters The distinction is important because: It shows the value of controls It enables informed risk acceptance decisions It helps prioritize risk treatment It demonstrates control effectiveness Calculating Inherent Risk Inherent risk is assessed by considering: The potential impact of a risk event The likelihood of occurrence The vulnerability of the asset No controls are considered in inherent risk assessment. Calculating Residual Risk Residual risk is assessed by: Starting with inherent risk Subtracting the effect of controls Considering the remaining risk Residual risk = Inherent risk × (1 - Control Effectiveness) Example: If inherent risk is $1,000,000 and controls reduce it by 60%, residual risk is $400,000. Accepting Residual Risk Risk acceptance should be the least preferred option over risk mitigation through implementation of primary controls . When risk is accepted: Risk acceptance should be formally documented, approved, and signed-off by the business owner Risk acceptance should be provided with detail justification including impact of not implementing controls and compensating controls in place The accepted risk should be within the risk appetite Risk acceptance should be renewed periodically Risk acceptance should be presented and reported to the risk committee  The Risk Treatment Continuum 1. Risk Avoidance Eliminate the activity or asset that creates the risk entirely. 2. Risk Reduction (Mitigation) Apply controls to reduce likelihood or impact. 3. Risk Transfer Shift financial exposure through insurance or contractual terms. 4. Risk Acceptance Consciously tolerate residual risk within defined appetite. Why Organizations Avoid Formal Acceptance Many organizations avoid formal risk acceptance because: It requires executive visibility It creates accountability It exposes control gaps But formal risk acceptance is essential for effective risk management. Without it, risk is accepted informally—with no documentation, no accountability, and no visibility. Conclusion Understanding inherent and residual risk is essential for effective risk management. Organizations that calculate both will know the value of their controls and make better decisions about risk treatment. Action Items for Your Organization Calculate inherent risk for key risks Assess control effectiveness Calculate residual risk Document risk acceptance decisions Report risk acceptance to the risk committee Review risk acceptance periodically  

NIST RMF, ISO 27005, FAIR, and COSO ERM — Which Framework Is Right for Your Organization? What Is an IT Risk Management Framework? An IT risk management framework is a structured methodology that organizations use to identify, assess, quantify, and treat risks to their information technology systems and data. It provides repeatable processes for evaluating threats and vulnerabilities, determining risk tolerance, and implementing controls that reduce risk to acceptable levels . IT risk management frameworks differ from general enterprise risk management (ERM) by focusing specifically on technology-related threats: cyberattacks, data breaches, system failures, vendor compromise, and regulatory non-compliance . Major Frameworks Compared Criteria NIST RMF ISO 27005:2022 FAIR v3.0 COSO ERM Primary Focus Federal IT security Information security risk Risk quantification ($) Enterprise-wide governance Approach 7-step process 5-step cycle Quantitative analysis model 5 components, 20 principles Risk Measurement Qualitative Qualitative or quantitative Quantitative (dollar values) Qualitative with strategy integration Control Library 1,000+ controls References ISO 27001 No controls 20 integrated principles Best For Government, contractors ISO 27001 certification Board-level financial justification Cross-functional enterprise risk Complexity High Moderate Moderate High NIST Risk Management Framework (RMF) The NIST RMF is the most comprehensive framework for organizations that need structured, repeatable processes with a deep control library. Its seven steps—Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor—map directly to federal requirements under FISMA but are widely adopted in the private sector . When to use it: You need compliance with NIST SP 800-53 controls, are a government contractor, or want the most prescriptive implementation guidance available. ISO 27005:2022 ISO 27005 provides a five-step risk management cycle (Context Establishment, Risk Identification, Risk Analysis, Risk Evaluation, Risk Treatment) with two distinct approaches: event-based assessment and asset-based assessment . When to use it: You're pursuing ISO 27001 certification and need a risk assessment methodology that integrates with the broader ISO 27000 family of standards. FAIR v3.0 (Factor Analysis of Information Risk) FAIR is the only internationally recognized standard for quantifying information risk in financial terms. Updated in January 2025, FAIR v3.0 uses the formula: Risk = Threat Event Frequency × Vulnerability × Loss Magnitude . When to use it: You need to justify security investments in financial terms, compare risk reduction ROI across projects, or communicate risk to non-technical stakeholders. COSO ERM COSO ERM takes a top-down approach, integrating risk management with organizational strategy and performance. Its five components—Governance and Culture, Strategy and Objective Setting, Performance, Review and Revision, Information and Communication—span the entire enterprise rather than focusing on IT alone . When to use it: You need enterprise-wide risk governance that connects IT risk to business strategy, financial risk, operational risk, and compliance. How to Choose the Right Framework If Your Organization… Start With Consider Adding Is a government contractor or federal agency NIST RMF FAIR for quantification Needs ISO 27001 certification ISO 27005 NIST CSF for maturity benchmarking Needs to justify security budgets to the board FAIR NIST CSF for operational controls Manages risk across multiple business functions COSO ERM NIST RMF or ISO 27005 for IT specifics Is a mid-market company starting from scratch NIST CSF 2.0 ISO 27005 or FAIR as you mature Many mature organizations layer frameworks rather than choosing just one. A common approach is COSO ERM for enterprise governance, NIST CSF 2.0 for cybersecurity operations, and FAIR for quantifying risk when presenting to the board . Action Items for Your Organization Assess your regulatory requirements Evaluate your risk maturity level Choose a primary framework based on your needs Consider layering frameworks for different purposes Map controls across frameworks to avoid duplication 7. The Five-Step IT Risk Management Lifecycle Headline: From Identification to Monitoring — The Five Steps Every Organization Needs for Effective IT Risk Management The Core Risk Management Lifecycle The core risk management lifecycle follows a consistent pattern across all major frameworks, even though terminology varies. Every framework moves through some version of these phases . Step 1: Establish Context and Scope Define what's in scope (business units, systems, data types), your organization's risk appetite, and your risk tolerance . Key activities: Identify business units, systems, and data types in scope Define risk appetite—the strategic level of risk you're willing to accept Establish risk tolerance—the acceptable deviation from risk appetite Document a formal risk appetite statement approved by the board Risk Appetite vs. Risk Tolerance: Risk appetite is a strategic, board-level decision about how much risk the organization is willing to pursue in achieving its objectives. Risk tolerance is the operational, business-unit-level acceptable variation around that appetite . Step 2: Identify and Catalog Risks Build a risk register by systematically identifying threats, vulnerabilities, and assets . Key activities: Asset-based identification—what systems hold sensitive data? Threat-based identification—what attack vectors target our industry? Include third-party risks—49% of breaches now originate with vendors Include emerging risks from AI deployment Step 3: Analyze and Quantify Assess each risk's likelihood and potential impact . Key activities: Start with qualitative ratings (Low/Medium/High/Critical) if you lack data Plan to move toward quantitative analysis as you mature Use risk quantification formulas and methods Step 4: Treat and Prioritize For each risk, select a treatment option based on a cost-benefit analysis : Option Description Cost/Risk Reduction Remediate Eliminate the root cause permanently Highest cost, highest risk reduction Mitigate Reduce likelihood or impact through compensating controls Moderate cost, partial reduction Transfer Shift financial exposure through insurance or contractual terms Variable Accept Consciously tolerate residual risk within defined appetite No cost, risk remains Avoid Eliminate the activity or asset that creates the risk entirely Variable Remediation vs. Mitigation: Remediation addresses root causes through permanent fixes—patching a vulnerability, replacing an insecure protocol, or decommissioning an unneeded system. Mitigation reduces consequences of a risk that still exists—adding monitoring, implementing compensating controls, or limiting blast radius . Step 5: Monitor and Iterate Risk management is continuous, not a one-time exercise . Key activities: Establish Key Risk Indicators (KRIs) Define monitoring cadences Integrate risk reviews into existing governance processes Document residual risk acceptance Regularly update the risk register Conclusion Risk management is not a one-time project—it's a continuous cycle. Organizations that follow this five-step lifecycle will be better positioned to identify, assess, and mitigate IT risks effectively. Action Items for Your Organization Document your risk appetite and tolerance Build a risk register Implement risk quantification Define risk treatment plans Establish Key Risk Indicators (KRIs) Review and update risk assessments regularly