#078 · AUG 20, 2026 · 9 MIN · GRC ENGINEERING
What Comes After GRC Engineering...
The manifesto team coined the term. The market ran with the mechanics and left the job open. This issue is about the job.
The Changelog
EVERY RELEASE SINCE #001 · 78 SHIPPED · WEEKLY
78 RELEASES SHOWN
#077 · AUG 13, 2026 · 10 MIN · GRC ENGINEERING
The PR Approval Is Decaying. Your Change Management Control Hasn't Noticed.
Agent velocity is hollowing out the one artifact every change-management control leans on: the screenshot still looks fine while the approval underneath it means less every quarter.
#076 · AUG 06, 2026 · 14 MIN · GRC ENGINEERING
The Definitive GRC Engineering Guide to Infrastructure as Code
Your terraform repo is the best auditor you never hired. What it can prove, where it lies, and how to read it without losing the platform team.
#075 · JUL 30, 2026 · 12 MIN · GRC ENGINEERING
5 Metrics That Prove a Control Works. "It Exists" Didn't Make the List.
Existence checks are the weakest claim you can make about a control. Five GRC Engineering effectiveness checks: what each replaces, how to measure it, and what it lets you decide.
#074 · JUL 23, 2026 · 10 MIN · GRC ARCHITECTURE
The Compliance Leverage Ladder: Your GRC Roadmap Is Pulling the Weakest Levers
Most GRC energy goes into the weakest interventions there are. That's why a control can fail for 11 months before anyone notices.
#073 · JUL 16, 2026 · 10 MIN · GRC ENGINEERING
Everyone Says Get Technical. Nobody Says At What.
Being technical in GRC is local. Here is how to find your at-what, starting from the workflows you already own.
#072 · JUL 09, 2026 · 10 MIN · GRC ENGINEERING
Threatify Your GRC Workflows: Keep the Steps, Swap the Questions
AppSec escaped the "think like a hacker" trap with an operational method, tested across 400+ products. Here is the GRC Engineering port, one workflow at a time.
#071 · JUL 02, 2026 · 10 MIN · GRC ARCHITECTURE
GRC Finally Has Too Much Context. Most Teams Will Waste It...
For the first time, GRC ingests more context than the work it governs produces. You get raw material, and the teams that notice first will write guardrails everyone else inherits.
#070 · JUN 25, 2026 · 10 MIN · GRC ENGINEERING
Your GRC Program Has No Garbage Collector. So It Leaks.
A control that passes perfectly, while the risk it was built for quietly died. Your dashboard can't tell it apart from one that still matters.
#069 · JUN 18, 2026 · 10 MIN · GRC ARCHITECTURE
A Lot Of GRC Work Is Performative. So Was Security, Once Upon a Time.
GRC looks performative because it owns activity, not outcomes. GRC Engineering is how you flip that by owning decision-support at .
#068 · JUN 10, 2026 · 10 MIN · GRC ARCHITECTURE
Not Every Control Belongs in the ICU: A GRC Engineering Guide to Control Triage
A GRC engineering guide to triaging your controls: where to spend real hardening effort, which ones to just keep honest, and which to stop using bandwidth on.
#067 · JUN 01, 2026 · 10 MIN · GRC ENGINEERING
You Spent a Year Learning to Use AI for GRC. The Real Skill Is Assessing It.
The SOC 2 narratives, questionnaire answers and control docs crossing your desk are now written by AI, and built to pass, not to be true. Leaning on AI to check them erodes the judgment that would have caught them. Here is how to stay sharp!
#066 · MAY 25, 2026 · 8 MIN · GRC ENGINEERING
I just started at Lovable. 5 things I've been thinking about as I'm onboarding.
You're shipping from day one. The question is whether you understand what you're building into. Five things I focus on in parallel with the build, so I don't lock in the wrong decisions early.
#065 · MAY 11, 2026 · 7 MIN · GRC ENGINEERING
Meet The GRC Companion: Your GRC Engineering AI Learning Buddy
A free, open, learning-only AI companion that teaches GRC engineering through your real work, inside Claude Code, Cursor, Claude Projects, or Codex.
#064 · MAY 05, 2026 · 11 MIN · GRC ARCHITECTURE
GRC as Git: A Mental Model for your Whole Programme
Borrow the discipline behind modern software, and apply it to policy, controls, risk, and TPRM in whatever tools your team already uses. Without forcing your team into Git, and without pretending the audit trail you already keep is somehow not a Git workflow.
#063 · APR 27, 2026 · 11 MIN · STAKEHOLDER MANAGEMENT
Your First GRC Lead Left. Their Instincts Are Still Running Your Program.
Four layers of inheritance are running your GRC programme. Here is an audit framework to find out what is intentionally designed and what is just left over and you have to engineer for.
#062 · APR 20, 2026 · 10 MIN · GRC ARCHITECTURE
What If Compliance Was Just a Query on Data You Already Collect?
Observability exists because understanding the true state of a system is hard. Control for the same reason. GRC Engineering can help you get there by leveraging observability principles.
#061 · APR 13, 2026 · 11 MIN · STAKEHOLDER MANAGEMENT
GRC Teams Are Getting More Capable Than Ever But The Shape Looks Different.
Why the future GRC team looks more like a basketball team than a football team, what that means for ICs and managers, and how to position yourself for either path.
#060 · APR 06, 2026 · 10 MIN · GRC ARCHITECTURE
Your GRC Program Serves the Audit. The Best GRC Engineering Programs Don't.
How the discipline collapsed into evidence collection, what enterprise GRC teams I know actually focus on, and why the audit should be a translation layer, not the foundation it's built on.
#059 · MAR 30, 2026 · 11 MIN · GRC ENGINEERING
Build vs. Buy: We Did Both. Here's What We Learned (RSAC 2026 Talk Summary)
We cycled through four GRC tools in four years before we built our own. The exercises that made us better builders are the same ones that make you a better buyer.
#058 · MAR 24, 2026 · 11 MIN · GRC ENGINEERING
Your Certification Covers 100%. Your Auditor Checked 0.07%.
The math behind compliance assurance does not work the way you think it does. Why moving at agentic speed means rebuilding the primitives of what GRC Engineering has to cover.
#057 · MAR 16, 2026 · 5 MIN · GRC ARCHITECTURE
State of GRC 2026 Report: Spreadsheets are still #1
The data, the patterns, and the gaps nobody's talking about. Everything you need to understand where GRC stands today through the largest independent practitioner survey ever conducted.
#056 · MAR 09, 2026 · 11 MIN · GRC ARCHITECTURE
How to Stop Making Risk Management a Compliance Control
Most risk programs exist because an auditor asked for one. Here are five signs yours is a compliance control, not actual risk management, and the fix.
#055 · MAR 02, 2026 · 10 MIN · GRC ENGINEERING
New to GRC Engineering? Start Here.
The ideas, the pillars, and the resources to go further. Everything you need to understand why GRC can be better than it is today through the GRC Engineering revolution.
#054 · FEB 23, 2026 · 15 MIN · CORSAIR
Building the GRC Engineering Trust Infrastructure: Introducing Corsair
A GRC Engineering-native answer to the trust and compliance exchange challenges. Open-source and free to sign. Assurance through cryptography instead of PDFs.
#053 · FEB 16, 2026 · 10 MIN · GRC ENGINEERING
GRC plays PvE when everyone else in Security plays PvP
GRC has the budget, the executive access, and the cross-functional visibility. It uses all of it to farm faster instead of leading the team to victory.
#052 · FEB 09, 2026 · 9 MIN · GRC ARCHITECTURE
Compliance-as-Cope: How GRC Engineering Automated the Wrong Thing
As a GRC industry, we leveraged APIs and scripting to spark what became a revolution. We followed the path of least resistance. Here's why GRC Engineering is risking becoming shelfware.
#051 · FEB 02, 2026 · 9 MIN · GRC ARCHITECTURE
The Framework Mapping Trap: When Documentation Precedes Reality
Build controls that work, translate to framework language second. Not framework requirements hoping to work. Reality before compliance!
#050 · JAN 22, 2026 · 13 MIN · GRC ENGINEERING
The 3 Types of Automation in GRC Engineering (pick the right one)
Think about your objective determines your automation type. Not what sounds cool or sounds more like GRC Engineering. Outcomes before tools!
#049 · JAN 15, 2026 · 10 MIN · GRC ARCHITECTURE
Engineer Your GRC Process Before You Automate It
Most GRC teams automate broken workflows and wonder why outputs stay broken. GRC Engineering starts with process design, not tools.
#048 · JAN 08, 2026 · 10 MIN · AI IN GRC
3 Basic Things Killing Your AI Usage for GRC
Your AI outputs are mediocre. You're making 3 basic mistakes. Fix your prompts, add context, use system instructions. Copy-paste templates included.
#047 · DEC 24, 2025 · 9 MIN · GRC ENGINEERING
GRC Engineer 2025 Wrapped (+ Shape What's Next)
A year of frameworks, practitioner stories, and community building that moved GRC Engineering from theory to practice. Here's what resonated most—and where we're headed in 2026.
#046 · DEC 18, 2025 · 17 MIN · STAKEHOLDER MANAGEMENT
GRC Engineering Collector Cards: Chief Information Security Officer
The GRC Engineering guide to CISOs: strategic alignment, board communication, synthesizing risk data, and going beyond sales enablement. Moving from audit prep to security strategy.
#045 · DEC 12, 2025 · 11 MIN · GRC ENGINEERING
What Engineers Know That GRC Professionals Don't
3 simple systems-thinking heuristics that transform GRC Engineering from compliance theatre to threat reduction. Measure outcomes, eliminate noise, ship fast.
#044 · DEC 04, 2025 · 12 MIN · STAKEHOLDER MANAGEMENT
GRC Engineering Collector Cards: Software Engineer
The GRC Engineering guide to Software Engineers: protecting flow state, routing requests properly, and staying invisible. Embedding requirements in systems.
#043 · NOV 27, 2025 · 11 MIN · STAKEHOLDER MANAGEMENT
What GRC Engineering Is Actually Grateful For Across People, Process, and Technology
How modern GRC practitioners are building empathy with stakeholders, designing systematic processes, and leveraging better tools to transform programmes beyond compliance theatre.
#042 · NOV 14, 2025 · 13 MIN · STAKEHOLDER MANAGEMENT
GRC Engineering Collector Cards: Security Engineer
The GRC Engineering guide to Security Engineers: threat priorities, continuous monitoring, speaking their risk language and being a team player.
#041 · NOV 07, 2025 · 11 MIN · GRC ENGINEERING
Are You Building for Auditors or Attackers? The GRC Engineering Shift
How threat-driven GRC Engineering transforms your technical stack, stakeholder relationships, and value delivery from annual audits to continuous monitoring.
#040 · OCT 30, 2025 · 16 MIN · STAKEHOLDER MANAGEMENT
GRC Engineering Collector Cards: Product Manager
The GRC Engineering guide to working with Product Managers: what they care about, when to engage them, and how to speak their language
#039 · OCT 23, 2025 · 14 MIN · AI IN GRC
GRC's AI Dilemma: Strong Workflow, Dumb AI vs Dumb Workflow, Strong AI
Why GRC teams are optimising the wrong variable in AI adoption, and what the GRC Engineering approach to workflow discipline means for stakeholder trust and automation ROI
#038 · OCT 16, 2025 · 23 MIN · PODCAST
Rebuilding GRC from Scratch at Docker w/ Emre & Chad
How two GRC engineers, in six months, were able to completely rebuilding a GRC program at a major tech company by leveraging GRC Engineering principles everywhere.
#037 · OCT 09, 2025 · 20 MIN · GRC ENGINEERING
You Still Work in GRC: What GRC Engineering Is, and What It Isn't
The framework that separates GRC engineering thinking from tool requirements, and the specific actions you can take this week to advance GRC objectives
#036 · OCT 02, 2025 · 13 MIN · COMPLIANCE
The Zillow Effect in GRC: When Platforms Perform Control Testing
How GRC automation shifted from evidence storage to active control assessment, and what that means for your audit relationship and your GRC Engineering practice
#035 · SEP 25, 2025 · 7 MIN · GRC ARCHITECTURE
The Three Lines of Defence, a systems-thinking approach
Why your defence lines need systems thinking and shared intelligence, not just functional independence and isolated processes, a GRC Engineering approach.
#034 · SEP 18, 2025 · 16 MIN · COMPLIANCE
Automating Quarterly Access Reviews: GRC Engineering in practice
The Step-by-Step GRC Engineering Practical Guide to Leveraging Existing IAM Infrastructure to automate Quarterly Access Reviews and get better visibility
#033 · SEP 10, 2025 · 13 MIN · GRC ENGINEERING
The GRC Engineering Implementation Framework That Works for Enterprises (no more DIY failures)
A 5-step methodology that addresses coordination challenges, leverages existing infrastructure, and delivers business value without creating the technical debt that kills most initiatives
#032 · SEP 04, 2025 · 10 MIN · STAKEHOLDER MANAGEMENT
GRC Engineering isn't running parallel to security, it's running behind it
Why building parallel GRC infrastructure wastes resources, alienates teams, and fragments authority across competing systems. Also, what to do instead!
#031 · SEP 02, 2025 · 14 MIN · DEEP-DIVE
Deep-Dive on Coveo's GRC Program w/ Pierre-Paul Ferland
Pierre-Paul Ferland has scaled Coveo's GRC program from startup to IPO. This deep-dive explores their technical architecture, tooling decisions, and engineering integration strategies.
#030 · AUG 28, 2025 · 11 MIN · COMPLIANCE
Why the Policy-as-Code revolution didn't happen (and what can we do?)
On the back of the news of the acquisition of the Styra team behind Open Policy Agent by Apple, we'll discuss how Policy-as-Code has been fitting into GRC Engineering and the way forward.
#029 · AUG 26, 2025 · 8 MIN · PODCAST
The GRC Engineering Blueprint for the Public Sector w/ Dr. Ibrahim Waziri Jr.
Insights from a leader who delivered ATOs across US Federal and worked on GRC Engineering in both the Cloud Service Provider and Consulting spaces
#028 · AUG 21, 2025 · 11 MIN · GRC ENGINEERING
GRC Engineer vs. GRC Engineering. Which one you need? Maybe both?
The 2x2 matrix that reveals why the industry is asking the wrong questions about your GRC maturity, assess if you need GRC Engineering, GRC Engineers or both.
#027 · AUG 14, 2025 · 13 MIN · GRC ENGINEERING
The GRC Engineering Maturity Model v1.0
The Complete Framework for Assessing and Advancing Your Organisation's GRC Engineering Maturity with Strategic Progression Pathways
#026 · AUG 07, 2025 · 15 MIN · GRC ARCHITECTURE
Why DIY GRC Automation Breaks at Enterprise Scale
Why GRC Engineering principles that work in proof-of-concept fail when evidence collection automation drives your enterprise program scaling
#025 · JUL 31, 2025 · 14 MIN · AI IN GRC
Vibe Coding for GRC Engineering: A Practitioner's Guide
Master context engineering to generate custom GRC solutions for your actual environment and understand the 3 main use-cases for Vibe Coding in GRC
#024 · JUL 29, 2025 · 7 MIN · PODCAST
Why Cyber Risk Quantification is the mindset shift your GRC program needs w/ Tony Martin-Vegue
Learnings from an expert who conducted ~1,000 FAIR assessments and showcases Cyber Risk Quantification and GRC Engineering is a match-made in heaven!
#023 · JUL 24, 2025 · 9 MIN · SYSTEMS THINKING
Signal vs. Noise: The Mental Model That Transforms GRC Effectiveness
Why your green compliance dashboards are hiding real security gaps, and the simple So What? test that reveals what actually matters
#022 · JUL 10, 2025 · 9 MIN · PODCAST
Beyond The API: GRC Engineering in the Real World w/ Ange Ferrari
From Technical Pentester to Global CISO: Ange Ferrari's GRC Engineering Journey. Deep Dive with a Leader Who's Been There (METRO, AWS, IKEA)
#021 · JUL 03, 2025 · 11 MIN · GRC ARCHITECTURE
GRC Team Topologies: When to Centralise, Distribute, or Build Platform Models
The Decision Framework from 150+ GRC Leader Conversations + Step-by-Step Implementation Roadmap for Building Teams That Scale
#020 · JUN 26, 2025 · 9 MIN · GOVERNANCE
Git-Based Policy Management: The Version-Controlled Future of Governance
Transform policy lifecycle management from manual document chaos to automated Git + Markdown workflows that engineering teams already trust
#019 · JUN 19, 2025 · 9 MIN · COMPLIANCE
Designing Controls Where Compliance is an Afterthought
Transform compliance-driven GRC programs into security-first systems that reduce business risk, automate evidence collection, and earn executive trust
#018 · JUN 12, 2025 · 11 MIN · RISK MANAGEMENT
The GRC Graduation: From Compliance Theatre to Risk-Driven Insights
A step-by-step framework for GRC professionals to build decision support systems, implement risk-driven metrics, and engineer security foundations that make compliance effortless
#017 · MAY 29, 2025 · 10 MIN · STAKEHOLDER MANAGEMENT
Selling GRC Engineering: From Vision to Executive Buy-In
How to Build the Business Case That Transforms GRC Engineering Skeptics into Automation Champions
#016 · MAY 22, 2025 · 10 MIN · STAKEHOLDER MANAGEMENT
The Human API: Building Interfaces Between GRC and Engineering Teams
How to Create Standardised Communication Protocols That Don't Rely on Technical Integration but Pushes Your Program Forward
#015 · MAY 15, 2025 · 9 MIN · GRC AS A PRODUCT
Becoming a GRC Product Manager: The Evolution Beyond Compliance TPM
How to Transform Your Compliance Role from Project Management to Strategic Product Leadership
#014 · MAY 08, 2025 · 10 MIN · GRC ENGINEERING
Unlocking the Hidden Value in Your Current GRC Platform
Most organisations use less than 30% of their GRC platform capabilities. Learn how to extract maximum value through GRC engineering fundamentals.
#013 · MAY 06, 2025 · 15 MIN · GRC MARKET PULSE
GRC Market Pulse April/May 2025 Part 1: Anecdotes $55M Series B, The Full Deep-Dive Analysis
Market Validation, Competitive Positioning, Strategic Direction and what are the impact for Practitioners, with 6 Questions to ask your Vendor
#012 · MAY 01, 2025 · 11 MIN · GRC ENGINEERING
The Technical Foundations Every GRC Professional Needs
How to Build the Right Technical Knowledge Without Needing to Become an Engineer
#011 · APR 24, 2025 · 9 MIN · STAKEHOLDER MANAGEMENT
From Obstacles to Allies: Winning Over Key GRC Stakeholders
How to Build Bridges That Transform Compliance Resistance into Partnership
#010 · APR 17, 2025 · 10 MIN · RISK MANAGEMENT
Risk Registers Reimagined: From Static Inventories to Action Engines
Moving Beyond Static and Outdated Data Stores to Drive Actual Security Improvements
#009 · APR 10, 2025 · 11 MIN · COMPLIANCE
Control Orchestration: The Missing Link in Enterprise Compliance Programs
Driving Consistent Security Control Execution in Complex, Mixed-Technology GRC Environments
#008 · APR 03, 2025 · 9 MIN · GRC ARCHITECTURE
Building a Central Data Layer: The Foundation of Modern Enterprise GRC
How to Create a Single Source of Truth That Unifies Your Fragmented GRC Ecosystem
#007 · APR 01, 2025 · 9 MIN · VENDOR ROUNDTABLE
GRC Automation Vendors Roundtable
7 Platform Leaders from Competing GRC Automation Platforms Share Unfiltered Insights in a Historic Roundtable
#006 · MAR 27, 2025 · 7 MIN · GRC AS A PRODUCT
Where GRC is a Product: Breaking the Project Mindset
How to Transform Your GRC Program from a Compliance Checkbox to a Strategic Asset
#005 · MAR 20, 2025 · 9 MIN · GRC ARCHITECTURE
From Silos to Systems: GRC Architecture
How to Design Information Flows, Establish Unified Language, and Create Team Interfaces Before Automating GRC
#004 · MAR 20, 2025 · 9 MIN · GRC ARCHITECTURE
From Silos to Systems: GRC Architecture
How to Design Information Flows, Establish Unified Language, and Create Team Interfaces Before Automating GRC
#003 · DEC 27, 2024 · 8 MIN · GRC AS A PRODUCT
Your GRC Program Needs a Product Manager, Not Another ex-Auditor
This week's sprint #1: 3 reasons why Product-led GRC rocks, why SQL is Excel for grown-ups and one quote you can continuously monitor
#002 · DEC 24, 2024 · 5 MIN · PODCAST
Is GRC Engineering the next DevSecOps?
GRC Engineering Podcast | Season 2 Episode 1: Build vs. Buy, GRC Success Metrics and Compliance Commoditisation with Justin Pagano, Director of Security Risk & Trust at Klaviyo
#001 · DEC 19, 2024 · 6 MIN · PODCAST
AI Agents as the next GRC Frontier
GRC Engineering Podcast: Season 2 Episode 2: Beyond the Checkbox with Shruti Gupta, CEO at Zania
$ grep returned nothing — clear the search or filter and try again.