Published October 27, 2026
Governance, risk and compliance (GRC) software records an organization's risks, controls, policies and audit work in one system. It maps controls to the laws and frameworks that apply, collects the evidence that each control works, and tracks the issues found. This edition covers platforms bought for enterprise risk, internal audit and compliance programs, and the tools that automate evidence for security certifications.
Where the market stands
In April 2023, Cinven agreed to acquire Archer from RSA Security, then owned by Clearlake Capital and Symphony Technology Group, and to run it as a standalone business. Clearlake and STG completed the sale on July 10, 2023. Archer bought Compliance.ai, a regulatory change management vendor, in February 2024.
Hg's acquisition of AuditBoard was finalized in July 2024. AuditBoard put its valuation at over $3 billion. On October 22, 2025, AuditBoard signed a definitive agreement to acquire FairNow, an AI governance platform. On March 9, 2026, AuditBoard renamed itself Optro. On May 6, 2026, Optro announced it had acquired Midship, an AI-based SOX automation product, and said Midship will be fully integrated into its Controls Management product. The same release refers to the FairNow acquisition as done.
On February 11, 2025, Drata announced a definitive agreement to acquire SafeBase, which runs trust centers and AI tools for security questionnaires. Drata now sells SafeBase as part of its own portfolio.
The rules behind the purchase
- DORA. The EU Digital Operational Resilience Act has applied since January 17, 2025. It requires an ICT risk management framework, reporting of major ICT incidents to the competent authorities, resilience testing and monitoring of ICT third-party providers.
- SEC cybersecurity disclosure. Rules adopted on July 26, 2023 require public companies to report material cybersecurity incidents on Form 8-K, generally within four business days of deciding an incident is material. Annual reports must describe cybersecurity risk management, strategy and governance, starting with fiscal years ending on or after December 15, 2023.
- NIST Cybersecurity Framework 2.0. Released on February 26, 2024, it adds a Govern function and is written for organizations of any sector and size.
- SOC 2. A SOC 2 examination, performed by a CPA under AICPA criteria, covers a service organization's controls over security, availability, processing integrity, confidentiality and privacy.
Four kinds of platform
- Enterprise GRC suites. These cover risk, audit, policy and compliance across the whole organization. Archer covers enterprise and operational risk, risk quantification, regulatory compliance, policy, IT and security risk, audit and third-party governance, and offers on-premises and SaaS deployment. IBM says OpenPages runs on any cloud or on premises, with modules including operational risk, regulatory compliance, internal audit, policy, third-party risk and model risk. MetricStream sells enterprise and operational risk, regulatory change, internal audit, SOX compliance, IT and cyber risk and third-party risk, plus a DORA solution. Diligent One combines board management with risk, audit and compliance applications.
- Configurable and audit-led platforms. LogicGate says Risk Cloud is configured without code, with applications for enterprise risk, third-party risk, cyber risk, controls compliance and AI governance. Optro says its platform gives one view across audit, risk, infosec and compliance.
- Compliance automation. Vanta and Drata connect to the tools a company runs, collect evidence automatically and monitor controls continuously. Vanta says it pulls data from more than 400 tools and covers more than 35 frameworks, including SOC 2, ISO 27001 and HIPAA. Drata says it connects to hundreds of tools and covers multiple frameworks. Both sell trust centers for sharing security evidence with customers.
- GRC on a platform you already run. ServiceNow sells Integrated Risk Management as applications on the ServiceNow Store. It describes IRM Standard as the foundation of an Integrated Risk Management program on ServiceNow.
What it costs where prices are public
Vanta and Drata publish list prices on AWS Marketplace, not on their own pricing pages. The figures below are list prices as published, for 12-month contracts.
- Vanta. The Vanta pricing page names four plans: Essentials, Plus, Professional and Enterprise. It shows no prices. Vanta's AWS Marketplace listing says Vanta prices by employee count and gives starting costs for companies of 1 to 20 employees: $14,000 for Essentials, $21,500 for Plus and $23,000 for Professional. Add-ons are priced separately, such as $6,000 for Trust Center and $13,600 for third-party risk management covering up to 50 vendors a year.
- Drata. The Drata pricing page shows no prices. Drata's AWS Marketplace listing gives a list price of $15,000 for its Foundation package, for companies of 1 to 50 employees.
For the other platforms named here, ask each vendor for the pricing unit (modules, users, frameworks, employees or monitored vendors) and for the price at the size you expect in year three.
AI governance moves into GRC
ISO/IEC 42001, published on December 18, 2023, specifies requirements for an AI management system. The NIST AI Risk Management Framework 1.0, released on January 26, 2023, is for voluntary use. NIST added a Generative AI Profile on July 26, 2024, and says AI RMF 1.0 is being revised.
Archer and LogicGate list AI governance among their products. Optro sells an AI governance product, and FairNow's former website now redirects to it. FairNow's platform offered an AI registry and risk assessments when AuditBoard agreed to buy it.
What a deployment requires
Start with one use case: a priority framework or the top operational risks. Agree the risk taxonomy and control library for that scope only. Name the first-line owners who will use the system, and check that the assessments and attestations are simple enough for them to complete.
Connect the platform to the systems that hold the evidence: cloud accounts, identity, ticketing and HR. Prefer controls tested against live data to evidence uploaded by hand.
Run the first framework end to end with the real owners before adding more. Map controls across frameworks so one tested control satisfies several. Then add risk domains, third-party risk and regulatory change monitoring.
Build a three-year cost comparison. Count subscriptions, add-on modules, implementation services, integration work and the staff who run the program. Subtract the manual evidence collection the platform replaces.
Questions to settle first
Settle these before writing a shortlist.
- Is the main driver enterprise risk visibility, audit and SOX, security certifications, or consolidation onto a platform you already run?
- Which frameworks and regulations apply in the next three years, and does the vendor maintain content for each?
- Which controls can be tested automatically from systems you run today, and which will stay manual?
- What is the pricing unit, and what happens to the price when headcount, frameworks or vendors double?
- Do you need AI governance now, and in the same platform as the rest of the program?