This week, I published the GRC Buyers Guide summarizing how satisfied clients are with their GRC platforms. The report is based on customer reference data from the Forrester Wave Governance, Risk and Compliance, Q2 2026. Speaking to customers in evaluative research processes is my favorite part of doing Forrester Waves, as it helps us to get specific insight into what’s working well in the industry and what isn’t. This blog outlines my own 4 key takeaways from those discussions and research including:

  • Customers are dismayed with current AI capability, but that’s improving rapidly. At the time of the Wave evaluation, many AI capabilities offered little beyond enterprise AI tools such as Copilot and Claude. Customer feedback on the use of AI within GRC tools can be summarized neatly with the Shakespearean quote “a plague on all of their houses”, placing the use of AI as the lowest ranked platform feature for our reference customers. Since then, AI capabilities are rapidly improving as providers release agents that can execute parts of risk assessments, audits, and controls testing. In spite of these improvements, trust in the quality of what AI produces remains patchy. Risk leaders must bring their teams on side to realize AI’s benefits, as they are a skeptical bunch by nature. Show your teams that AI features can accelerate their work, while human review and oversight remain essential tools in mitigating against AI hallucinations and other quality issues.
  • AI features pricing is messy, making it difficult to assess whether provides value for money. AI pricing in GRC was inconsistent, with vendors offering a spaghetti mess of different approaches. Customers cited pricing clarity as the primary reason holding them back from using AI capabilities. Pricing complexity of AI such as whether or not it’s included, separately priced, or consumption-based, made it a struggle to assess whether the outcomes delivered match the sticker price. As frontier AI labs shift to token-based pricing, GRC providers’ AI delivery costs have surged. One CEO in the market shared recently their AI costs had increased over 10x overnight because of this shift causing heartburn for their CFO. Risk leaders should engage with GRC providers who offer consumption-based pricing, to validate the AI cost management practices vendors are using to keep AI token usage bills low, and in line with their AI usage.
  • Tech leaders and CISOs want continuous controls monitoring (CCM) yesterday. There is currently a significant gap between customer desires for CCM and what GRC platforms can provide. Wave reference customers wanted this capability but saw no clear path to achieve it. For CISOs and Tech Risk professionals I’ve spoken with recently CCM is rapidly becoming a non-negotiable requirement as the burden of manual assessments becomes too difficult to continue to justify. Many customers have concluded that GRC platforms are unable to deliver this, and are looking into building their own solution, or looking for specialist CCM providers to plug this gap. Providers need to pay attention, or risk losing business with tech and cyber leaders if they cannot meet the moment. Tech and security leaders should press GRC providers to deliver CCM or build it themselves using specialist CCM solutions or alternative data analytics technology.
  • “Going to Gold” is used to avoid expensive customization. A minority of wave reference customers mentioned they are “going to gold”, implementing their GRC platform out of the box as closely as possible. A small number of customer references have either made “going to gold” a guiding principle of their current deployment, or are refactoring their existing implementation to go back to the basics. Customers are adopting this approach to avoid costly over-customization that delays implementation, and to simplify upgrades and access to new functionality throughout the platform’s lifetime made difficult or impossible by bespoke capabilities. Adopt “going for gold” as a guiding principle for faster implementation and simpler upgrades and access to new functionality.

As always, Wave reference customers are an invaluable part of the process and bring levity and reality to the process which helps us immensely in getting a pulse for what’s going underneath the surface. Forrester customers wishing to discuss the GRC market or selection of providers based on these findings can schedule a guidance session or inquiry with me.

Share