grc
(55)
Chris Pantaenius and the problem with a perfect plan
Chris Pantaenius helped start Onspring with a contract-management idea. Building a business around the ways people actually work took him somewhere more interesting.
Optro sees the risk between the spreadsheets.
It began with two friends and a neglected customer: the auditor. Now the company formerly called AuditBoard is teaching AI to do the paperwork - and helping businesses keep an eye on AI.
AuditBoard made the paperwork talk.
Two auditors built a business around the work nobody wanted to repeat. Now called Optro, AuditBoard is taking the same idea from SOX checklists to AI agents.
Pathlock follows the money. And the permissions.
A valid login can still lead to a bad payment. Pathlock connects access rights to business transactions, giving enterprises a closer look at what their people - and their machines - can actually do.
Aayush Ghosh Choudhury and the business hidden in the paperwork
He set out to build procurement software. The work required to win an enterprise customer led him somewhere else: Scrut Automation, and a continuing argument for giving small teams access to security expertise.
Vendict wants your next deal to escape the spreadsheet
A security questionnaire can hold a sale hostage. Vendict turns company documents into answers with evidence attached - and its most revealing customer story begins with a team that did not want to switch.
SecurityPal AI sells the relief of a finished security review
A nearly 200-page questionnaire gave Pukar Hamal his business idea. SecurityPal AI now pairs software with human analysts to get enterprise assurance work off the desk and out the door.
ControlCase and the art of doing the audit once
Every new security standard can bring another request for the same evidence. ControlCase has built a business around a sensible objection: why collect it twice?
Ncontracts and the Bank That Forgot Its Own Spreadsheet
A bank can remember every transaction and still forget how its own rules work. Ncontracts has built a business around that peculiar lapse, turning contracts, compliance and institutional knowledge into something people can actually use.
Andera's 43,000-Line Answer to a Spreadsheet
An early customer handed the audit startup a mountain of unruly workbooks. The fix became a 43,000-line Excel engine - and a revealing lesson in where useful AI actually begins.
Anecdotes and the Evidence That Refused to Sit Still
A compliance record can be correct on Monday and wrong by Friday. Anecdotes built its business around that awkward interval - and the enterprises willing to stop treating an audit as an annual scavenger hunt.
Dan Campbell and the Architecture of Useful Friction
He helped turn three consultants' irritation with inflexible compliance software into a platform built to bend. A decade later, LogicGate's co-founder is still asking the architect's favorite question: what should remain changeable?
Ideagen built a billion-pound business on “prove it”
A missing signature. An outdated procedure. Sixty people reviewing the same document. Ideagen sells order to organizations that cannot afford to lose the paper trail.
GRC Solutions wrote the rulebook. Now it does the work.
A business that began with security books now sells the people, software and testing behind compliance. Its next bet puts round-the-clock cyber response on the same shopping list.
Darin Ohlandt’s Long Route to Marketing the Rules
Before he marketed compliance software, Darin Ohlandt worked in consulting, satellites, online chat, language learning, legal information and analytics. The industries changed. His fascination with making marketing measurable did not.
Michael Schultz Has Spent 20 Years Teaching New Software Categories to Speak Enterprise
From PlaceWare and DocuSign to Bugcrowd, Nintex, Enlyft, and LogicGate, Schultz keeps arriving where useful technology still needs a language the enterprise can trust.
Drata Turned the Audit Scramble Into an Always-On Machine - Then Went After the Sales Cycle
The founders met compliance as a recurring evidence hunt. Five years later, Drata had crossed $100 million in annual recurring revenue and was selling a bigger idea: make proof of trust useful every day, not just during an audit.
Origami Risk Built a 1,000-Client Business by Fixing Insurance’s Unglamorous Plumbing
The Chicago software company won by treating claims, safety reports and policy records as one connected data problem. Now its bet is that the same platform can carry insurers from first incident to final invoice - with AI tucked into the paperwork.
The $5.3 Billion Cookie-Banner Company Had to Grow Up - Now OneTrust Wants to Govern Your AI
OneTrust turned a deadline called GDPR into one of software's fastest growth stories. After a bruising reset, the company behind countless cookie pop-ups is betting that the next compliance emergency will be every company's unruly fleet of AI models and agents.
AJ Sarkar Asked Hundreds of Executives What Risk Looks Like. Then He Built the Dashboard.
The RiskOpsAI founder has spent years translating the anxious language of cyber risk into decisions a board can actually use. His latest bet is that AI governance must move as quickly as AI itself.
Meiran Galis Turned the Audit Pile Into a Company
He began with screenshots, logs and a weekend blog. Five years later, Scytale had become an acquirer - proof that even the dullest business problem can hide a lively company.
Justin Beals Turned the Worst Part of Enterprise Sales Into a Company
A theater graduate, programmer and repeat founder, Justin Beals built Strike Graph around a lesson learned the expensive way: when trust arrives late, deals die early.
Strike Graph Wants to Turn Your Next Security Audit From a Fire Drill Into a Background Task
The Seattle startup began with one founder's bruising SOC 2 experience. Six years and $20.4 million later, it is betting that graph-based data and small, private AI models can make compliance useful between audits - not merely survivable during them.
The Company That Made Audit Season Boring
Meiran Galis spent years at EY watching startups treat security audits like a fire drill. Scytale is his bet that compliance can run in the background instead of eating a quarter.
The Startup That Taught AI to Read the Rulebook
Most companies drown in regulation. 4CRisk.ai built specialized AI that reads the rulebook for them - and turned a six-month compliance grind into a four-day job.
SOC 2 Is a $23 Billion Business Now
SOC 2 used to be a dull audit checkbox. Now it anchors a governance, risk and compliance software market worth roughly $23 billion in 2026. A cohort of startups - Vanta, Drata, Secureframe, Sprinto, Orbiq - turned a painful PDF ritual into recurring revenue, while incumbents like AuditBoard and OneTrust and security giants like CrowdStrike circle the same prize: the business of proving you can be trusted.
Dan Zitting
Dan Zitting is the CEO of Nitrogen, the wealth management technology company formerly known as Riskalyze, best known for its Risk Number and advisor growth platform. Before wealthtech, he spent more than a decade building governance, risk and compliance software: he founded the cloud audit tool Workpapers.com, ran Galvanize (formerly ACL) as CEO and grew it to roughly $100M in ARR, and helped steer its roughly $1 billion sale to Diligent, where he served as Chief Product and Strategy Officer. He took the top job at Nitrogen in December 2023, focused on helping financial advisors reduce friction and grow through connected workflows and AI.
Compyl
Compyl is a New York-based SaaS company that unifies governance, risk, and compliance (GRC) on a single platform. Founded in 2020 by former CISOs, it pulls evidence directly from more than 125 integrated systems, maps controls across 70+ frameworks like SOC 2, ISO 27001 and HIPAA, and uses agentic AI to draft evidence, score vendors and answer security questionnaires while keeping humans in control of decisions. Compyl raised a $12M Series A in June 2025 to scale its AI-led platform for mid-market and enterprise security teams.
CyberSaint
CyberSaint is a Boston-based cybersecurity software company whose CyberStrong platform helps enterprises assess, quantify, and communicate cyber risk. It converges compliance, security operations, and risk management, using AI to automate control scoring, translate cyber risk into financial terms, and produce board-ready reporting for Fortune 500 companies and high-growth organizations.
Lema AI
Lema AI is a New York-based cybersecurity startup building an agentic AI platform for third-party risk management (TPRM). Founded by three veterans of Israel's Unit 8200, Lema replaces static vendor questionnaires and check-the-box compliance with continuous, behavior-based analysis that maps how vendors actually operate inside an enterprise - tracking data access, permission changes and 'risk drift' to surface real attack paths. The company emerged from stealth in February 2026 with roughly $24M in total funding, including a $17.5M Series A led by Team8.