GRC market 2026: What Forrester, Verdantix and GRC 20/20 say about AI and platforms

Why the analysts' view is worth a look in 2026

In 2026, almost every GRC software vendor talks about AI agents. Read the current analyses from the major market observers, however, and you find a far more sober assessment. Forrester, Verdantix and GRC 20/20 Research independently reach a similar conclusion: GRC platforms must change fundamentally, and the AI features being sold today barely deliver that change so far.

For organisations that are choosing a GRC platform or modernising their information security management system, this is an important point of orientation. This article summarises the publicly available findings of the three analyses, shows what they have in common and derives questions to ask during selection.

The three analyses at a glance

Forrester: From System of Record to System of Action

At the end of May 2026, Forrester published its Wave for governance, risk and compliance platforms, evaluating twelve vendors. Analysts Paul McKay and Cody Scott describe a market facing strong headwinds: many platforms still require too much manual data entry, offer only basic workflow automation and are too complex, too cumbersome and too expensive for their current purpose. Forrester

At the same time, Forrester expects the purpose of these platforms to change fundamentally over the next 18 to 24 months. Until now, GRC tools have mainly been a System of Record: they hold the results of risk assessments, compliance reviews and internal audits. In future, they are to become a System of Action that orchestrates work and delivers outcomes instead of merely storing data. The platform remains the home of the authoritative data, but uses automation across a broader ecosystem. To get there, vendors are increasingly partnering with specialists in risk data and regulatory content rather than building everything themselves.

Four further findings are particularly relevant when choosing a platform:

• AI adds little value today. Most AI features improve what already exists rather than fundamentally changing work. Customers cite functional limits and high costs as obstacles. The most sought-after benefit is very concrete: significantly faster risk assessments and compliance reviews.
• Continuous controls monitoring is the weakest criterion in the entire evaluation. Many platforms use it only to collect evidence for internal audit. According to Forrester, the real value lies in continuously monitoring whether controls are effective and policies are being followed, and in triggering corrective action when deviations occur. You can read more about this approach in Continuous controls monitoring: know what the signal proves.
• More data is not automatically better. Forrester draws a parallel with security analytics, where real value came only from focusing on clearly defined use cases. For GRC, the analysts recommend libraries of concrete monitoring cases and common thresholds, so that only the data that is actually needed is collected.
• Nobody knows how AI should be priced. Models range from included at no cost through fixed add-on packages to billing per governed AI use case. Customers often pay twice: for AI in the platform and for a separate AI governance module. Many reference customers were unable to assess the return on their AI investment.

Verdantix: Features are growing faster than their explainability

For the Green Quadrant GRC Software 2025, Verdantix compared 15 vendors across ten capability categories and cross-checked the results against financial and customer data. Verdantix The accompanying article on AI in GRC contains a finding that should make buyers sit up: every platform that achieved the top score for embedded AI features scored only one to two points on model explainability and governance. Verdantix blog

In other words, chatbots and automated control testing are reaching the market faster than the audit trails, confidence indicators and model risk reports that regulators will require in future. Verdantix explicitly refers to the EU AI Act: the bill for missing explainability will soon come due. To find out which standards are emerging here, read ISO/IEC 27090, EN 18286 & IEEE 2863: The 3 new AI governance standards of 2026 at a glance.

Three further findings fit this picture:

• A high AI score alone does not sell. Advanced AI generates interest, but if the underlying GRC modules are thin, prospects hesitate. Sustainable growth still depends on breadth of coverage and on implementation after the purchase.
• AI strength does not lead to higher renewal rates. Verdantix found no reliable correlation. Customers pay more attention to platform stability, fast implementation and good support.
• Depth requires investment. The clearest correlation was between development budget and genuine AI maturity. Without sustained investment, AI remains a set of superficial widgets.

For the coming years, Verdantix expects simple AI features such as generative search and summaries to become standard. Competition will therefore shift to transparency, oversight and regulatory fit. For vendors with a high share of development spending, Verdantix sees a rare window to overtake established vendors, provided they deliver on AI depth, data quality and transparency.

GRC 20/20: Orchestration requires accountability

In October 2026, Michael Rasmussen, founder of GRC 20/20 Research, published a 143-page Market Perspective on “GRC 7.0 – GRC Orchestrate”. GRC 20/20 His thesis: AI makes visible software features cheap and interchangeable. What becomes valuable instead is reliable information, business context, domain methodology and accountable execution.

He describes GRC 7.0 as an architecture that places three systems around the authoritative systems of record: one that detects and interprets change, one that carries out work within clearly defined authority and verifies its outcome, and one that allows GRC capabilities to be adapted in a traceable way. Rasmussen explicitly distinguishes this from a mere accumulation of AI features. We have summarised what this model looks like in detail and what it means in practice in GRC 7.0: What Michael Rasmussen's GRC Orchestrate means for organisations.

What the three analyses have in common

Reading the three analyses side by side reveals four common threads:

The analyses do not contradict each other on any essential point. They illuminate the same shift from three directions: Forrester from the perspective of customer evaluations, Verdantix by matching features against business figures, and GRC 20/20 from the perspective of architecture.

What organisations should look for when choosing a platform

For organisations currently choosing a GRC platform, for example for NIS2, ISO/IEC 27001 or the EU AI Act, the findings from Forrester and Verdantix lead to four questions to ask:

• Where does an assessment come from? For every result produced by an AI agent, can you trace which requirement, which piece of evidence and which rationale it is based on?
• What is monitored? Does the platform only collect evidence for the next audit, or does it show continuously whether controls are effective?
• What does it save in concrete terms? How much faster do risk assessments and gap analyses become? According to Forrester, this is the benefit customers look for most.
• How is AI priced? Is it clear what the AI features cost and what they deliver, or does AI governance require yet another module?

You can find the full catalogue of selection criteria in How to Choose the Best GRC Software.

How we see it at Secani

The analyses confirm a direction we are pursuing with Secani. The Secani agent is designed to take on extensive preparatory work: gathering information, proposing mappings, consolidating evidence and explaining gaps. The decision stays with a human, and it must remain traceable later. How we think about the link between requirement, evidence and judgement is described in AI in GRC: Citation Is Not Verification.

The yardstick, therefore, is not how many AI features a platform has. It is whether, for every assessment, you can answer why it holds, who is accountable for it and what would have to change for it to be reviewed again.

Conclusion

In 2026, Forrester, Verdantix and GRC 20/20 describe the same shift: GRC platforms are expected to get work done and deliver outcomes instead of merely storing data. AI is an important tool for this, but no longer a differentiator. What makes the difference is traceability, clear accountability and solid fundamentals. Anyone choosing a GRC platform should ask about exactly these points and have the answers demonstrated on their own use case.

Sources

• Announcing The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q2 2026 (Forrester, 29 May 2026)
• Green Quadrant: GRC Software 2025 (Verdantix)
• AI In GRC: Verdantix Green Quadrant Highlights Correlations And Emerging Trends (Verdantix, 27 August 2025)
• GRC 7.0 – GRC Orchestrate: The Architecture, Economics, and Competitive Reset of the GRC Market (GRC 20/20 Research, October 2026)