⌕ SEARCH · ⌘K
SIGN IN
SUBSCRIBE
Most GRC market reports survey 100 to 300 people, primarily enterprise buyers sourced through vendor relationships. This survey reached nearly 800 practitioners across every seniority level, team size, and practitioner type.
Over the past two years, 12,000+ professionals have joined this community. When I asked them to tell me the truth about how they work, 795 of them did. No vendor funded this report. No sponsor influenced the questions. When the data says the #1 GRC tool is still a spreadsheet, there is no commercial pressure to soften that message.
AYOUB FANDI · FOUNDER, THE GRC ENGINEER
Nine numbers that define the state of the discipline going into 2026.
93 respondents still rely on spreadsheets as their primary GRC tool.
Nearly a quarter (22.8%) rate themselves 1-3 out of 10.
CISO/VP+ average 6.5 vs Director 5.4. The top of the ladder out-skills the middle.
3 in 5 practitioners use no commercial tool.
18% work solo. 51% of teams have 4 people or fewer.
The most fragmented enterprise software market.
High-skill industry practitioners choose commercial tools 65% of the time. Engineers: 47%.
81% of solo senior managers adopt commercial tools vs 10% of solo entry level.
20% of auditors use spreadsheets. Highest of any persona.
The largest independent survey of GRC practitioners conducted outside of vendor-sponsored research.
Respondents self-selected from a GRC-focused audience. Results may over-represent practitioners actively investing in professional development and may not reflect the broader GRC population. Tool usage data reflects primary tool only. 32 vendor employees were identified via email domain matching; their responses are included but flagged for transparency. Each analysis section has two parts: the data and the insight.
29.8% of respondents are Director-level or above. These are tool buyers and budget holders. This audience is not just using GRC tools. They are choosing them.
When 29% of your respondents advise multiple organizations, their tool preferences carry disproportionate influence. A single consultant who recommends a tool to ten clients generates more pipeline than ten individual buyers.
The GRC market rewards whoever wins the advisor.
Nearly 1 in 5 practitioners run the entire GRC function alone. The mid-market (2-10 people) is 56% of the market and the most underserved segment.
| SOLO | 2-4 | 5-10 | 11+ | |
|---|---|---|---|---|
| Entry Level | 10% ⚠ | 10% | n<8 | n<8 |
| Intermediate | 6% | 22% | 26% | n<8 |
| Senior | 10% | 37% | 49% | 34% |
| Manager | 27% | 36% | 50% | 47% |
| Senior Manager | 81% ★ | 51% | 48% | 62% |
| Director | 19% | 43% | 50% | 68% |
| CISO/VP+ | 26% | n<8 | 70% | n<8 |
Solo does not mean junior. 40% of entry-level practitioners work solo with an average skill of 3.6. But 19 CISOs also work solo, averaging 6.3. Same team size. Completely different reality. One group is drowning. The other chose to swim alone.
The graduation path is consistent: at team size 1, 42% use no tool at all. At 2-4, commercial adoption jumps to 51%. At 5-10 it reaches 58%. At 11+ it hits 62% and spreadsheets collapse to 3%. Each team size threshold is a buying trigger. Nothing, then spreadsheet, then commercial, then platform.
The ranked truth. 93 practitioners rely on spreadsheets ahead of ServiceNow, custom tools, and every commercial platform.
The 93 spreadsheet practitioners average 4.9 technical skill. 41 of them work in teams of 2-4, the most spreadsheet-heavy segment. Spreadsheets persist because many practitioners lack the technical confidence to adopt and configure a dedicated platform. The switching cost is not financial. It is cognitive.
The consultant multiplier makes this worse. 64.9% of consultants use non-commercial solutions. 228 consultants in this survey. That is an estimated 1,480 annual decisions steered away from commercial GRC products. The most influential distribution channel in the industry is actively recommending against the category.
The people who approve GRC budgets do not use the market leaders. This is not a market share game. It is a market creation game.
Among solo adopters, Vanta leads with 15 users, a 7.4x overrepresentation versus its non-solo share (Fisher's exact p=0.0002). When one person runs the entire compliance function, automation is the only way the job gets done.
Only 7.4% of CISOs use ServiceNow, compared to 17.3% for all other seniority levels. CISOs know what is available. Their average technical skill (6.5) makes them the most capable seniority level. They evaluate tools rigorously. And they are choosing to build rather than buy.
The Director level is the most contested buyer segment in the entire dataset: HHI of 924, the lowest concentration of any seniority level. Every vendor has a shot. Nobody has a lock.
Cross self-reported technical skill with primary tool, then layer in team size. 278 industry practitioners only. No security engineers, no auditors, no consultants, no vendors.
The technical mid-market (Drata, Open Source): high skill scores, balanced team sizes, buyers who evaluate on capability. The automation-first startup (Vanta): strong technical users in small teams who need leverage. The Vanta power user is the one-person compliance department. The enterprise incumbent (ServiceNow, AuditBoard, Archer IRM): mid-range skills, large teams, buyers who evaluate on integration.
The open source signal is the one to watch. As the industry trends more technical, open source adoption will accelerate. Commercial vendors attracting technical buyers: you are not competing with each other.
The industry's defining challenge. Among 258 industry practitioners: average 5.3, median 5.5. Half the industry sits between spreadsheet defaults and automation capability.
A capability gap, not an access gap. 62.3% of mid-skill practitioners already use a commercial tool. They bought the platform. They cannot unlock it. Vendor onboarding solves the first week. Nobody solves months two through twelve.
A career structure problem. Intermediate (5.1), Manager (5.2), Senior Manager (5.0), Director (5.4). Four levels spanning a decade of career progression, separated by less than half a point. Promotion doesn't come with technical growth.
A composition problem, not a development problem. Comparing early respondents to late, average skill barely moved (p=0.36). The industry isn't getting more technical. The audience is. The bridge between 5.3 and 6.3 isn't a training program. It's a hiring pattern.
Where the market goes from here: consolidation is already visible in the data, and the least consolidated software category will not stay that way.
59% of practitioners use no commercial GRC tool. The mid-market isn't fragmented by tool count. It's fragmented by buyer persona. The vendor that figures this out wins the largest segment.
ServiceNow owns enterprise GRC with 34 users in the 11+ segment. Nearly 5x spreadsheet usage. Can automation vendors grow before ServiceNow absorbs their innovations?
38 users. Ahead of OneTrust. Ahead of Archer. Average skill 6.3, 21% CISOs, 45% consultants. The most skilled, most senior, most influential practitioners choose open source.
7.4% of CISOs use ServiceNow. The most important buyer segment prefers custom tools, spreadsheets, and open source over every commercial platform.
5.4 average technical skill. Every finding in this report traces back to this. The next year will be defined by which side of this gap you're on.
36 PAGES · EVERY CHART · METHODOLOGY · FREE
