795 practitioners
told the truth.

The consultant ratio is the hidden variable in every GRC market analysis. When 29% of respondents advise multiple organizations, their tool preferences carry disproportionate influence — a single consultant recommending a tool to ten clients generates more pipeline than ten individual buyers.

The traditional vendor playbook targets the buyer at a single company. The GRC market rewards whoever wins the advisor.

Each team-size threshold is a buying trigger. The ladder is consistent: nothing, then spreadsheet, then commercial, then platform.

Among solo practitioners who do adopt, Vanta leads with a 7.4x overrepresentation versus its non-solo share (Fisher's exact p=0.0002). When one person runs the entire compliance function, automation is the only way the job gets done.

And 28 of those solo practitioners are entry-level — no team, no mentorship, no architecture. They default to spreadsheets because that is what they know. This is where compliance theatre is born.

Almost every competitor analysis in GRC starts with the wrong assumption: that you are fighting other vendors. You are fighting inertia, spreadsheets, and "I'll just use Notion."

Spreadsheets persist because many practitioners lack the technical confidence to adopt and configure a dedicated platform. The switching cost is not financial. It is cognitive.

The consultant multiplier makes it worse: 64.9% of consultants use non-commercial solutions — an estimated 1,480 annual decisions steered away from commercial GRC products. The most influential distribution channel in the industry is actively recommending against the category.

The Director level is the most contested buyer segment in the dataset (HHI 924 — the lowest concentration of any seniority level). Every vendor has a shot. Nobody has a lock.

And then there's the auditor problem: your customer invests in a platform that produces evidence in structured formats. Their auditor expects screenshots and spreadsheet exports. The platform's value collapses — not because the product failed, but because the person validating the output won't accept the format.

Tool-choice entropy is decaying: early respondents reported 21 distinct tools (Shannon entropy 3.71 bits); later cohorts converged on 13 (3.25 bits). The long tail is already shrinking.

The open-source signal is the one to watch. As the industry trends more technical, adoption accelerates — and commercial vendors attracting technical buyers are not competing with each other. They're competing with build-it-yourself.

A capability gap, not an access gap. Mid-skill practitioners have tools and budget. They lack the confidence to move beyond default configurations. Vendor onboarding solves the first week; nobody solves months two through twelve.

A career structure problem. GRC has no technical forcing function between years 3 and 15. You can reach Director without writing a policy-as-code rule or configuring an API integration. The ladder doesn't reward technical growth because it doesn't require it.

A composition problem, not a development problem. The industry looks more technical because the audience expanded to include engineers and security professionals (avg 6.3) — not because existing practitioners (avg 5.3) built new skills. That bridge isn't a training program. It's a hiring pattern.