# Market data and deal flow

Controlspan Research Desk · Last updated 28 October 2026

# What should enterprise GRC buyers take away from the market data?

**There is evidence of a substantial, growing GRC software market—but no defensible single public measurement of expenditure by this desk’s specific US enterprise buyer segment.** Published estimates describe materially different markets. Meanwhile, transaction-based pricing panels offer useful reference points, but not like-for-like quotations for regulated organisations with complex implementation requirements. ([verdantix.com](https://www.verdantix.com/vantage/report/market-size-and-forecast--governance--risk---compliance-software-2025-2031-global?utm_source=openai))

The practical conclusions are:

- **Do not use a broad GRC market estimate to justify a particular platform budget.** The research definitions differ in geography, software coverage and services inclusion; the figures below are not interchangeable. ([verdantix.com](https://www.verdantix.com/vantage/report/market-size-and-forecast--governance--risk---compliance-software-2025-2031-global?utm_source=openai))
- **Price the first operationally useful deployment, not an abstract enterprise platform.** IBM publishes separate application and environment charges, while LogicGate prices applications and Power Users separately from additional services. ([aws.amazon.com](https://aws.amazon.com/marketplace/pp/prodview-6xime4g75fiyo))
- **Treat implementation and continuing administration as separate purchasing decisions.** A recent commissioned ServiceNow study explicitly includes both supplier fees and implementation, management and training costs; it is not a licence-only comparison. ([tei.forrester.com](https://tei.forrester.com/go/ServiceNow/IRM/))
- **Acquisition announcements are shortlist-review triggers, not proof of integrated functionality.** Selected 2026 transactions bring third-party risk and AI-assisted controls testing into broader platforms. Buyers should require evidence of what is available now, what remains separately operated and what costs extra. ([diligent.com](https://www.diligent.com/company/newsroom/diligent-acquires-3rdrisk?utm_source=openai))

**Desk judgement:** the most useful commercial advantage is not knowing the largest market-size number. It is knowing which elements of a quotation are comparable, which implementation responsibilities remain with the buyer and which product capabilities are still being integrated.

---

# What market does this report actually cover?

For this research desk, the core purchase is a platform supporting connected risk, control, compliance, evidence, audit or remediation workflows at a regulated US organisation. The intended readers principally work in organisations with approximately **500–10,000+ employees**; this is an editorial targeting definition, not a measured market boundary.

The report distinguishes three purchasing categories:

| Category | Treatment in this report | Procurement question |
|---|---|---|
| Enterprise GRC, integrated risk, audit and controls software | Core platform market | Can the system support the first workflow and the intended operating model? |
| Security compliance, trust management, regulatory intelligence and specialist third-party risk | Relevant adjacent markets | Is this a substitute, an additional component or a source of overlapping expenditure? |
| Implementation, migration, integration and managed operations | Separate ownership-cost category | Who will deliver, maintain and eventually transfer the configuration and data? |

This scope deliberately avoids treating every product described as “GRC” as an equivalent substitute. It also avoids adding overlapping modules together to manufacture a larger addressable market.

**Evidence labels used throughout:**

- **Publisher estimate:** a market research company’s model, including historical estimates.
- **Company-reported:** a supplier or investor disclosure, not an independent capability assessment.
- **Observed pricing panel:** a procurement intermediary’s published sample, not the whole market.
- **Listed price:** an advertised component or package price, not a negotiated deployment quotation.
- **Desk calculation or illustration:** arithmetic with its inputs and assumptions exposed.
- **Undisclosed:** not stated in the announcement reviewed; it does not mean zero.

---

# How large is the enterprise GRC software market?

**The strongest public evidence supports several distinct measurements—not one reconciled US enterprise software total.** The table preserves each publisher’s definition, measurement period and forecast status. ([verdantix.com](https://www.verdantix.com/vantage/report/market-size-and-forecast--governance--risk---compliance-software-2025-2031-global?utm_source=openai))

| Publisher and evidence date | Geography and scope | Historical/base-year estimate | Forecast | How buyers should use it |
|---|---|---:|---:|---|
| Verdantix, **15 July 2026** | Global GRC **software**; model uses disclosed and calculated vendor revenues | **Over $6.5bn in 2025** | **$10.9bn in 2031; 9% CAGR** | A software-specific category reference, not US expenditure. ([verdantix.com](https://www.verdantix.com/vantage/report/market-size-and-forecast--governance--risk---compliance-software-2025-2031-global?utm_source=openai)) |
| MarketsandMarkets, **September 2026** | US eGRC; includes **solutions and services** | **$5.45bn in 2025** | **$10.17bn in 2030; 13.3% CAGR** | A US estimate, but not software-only or restricted to this desk’s buyer segment. ([marketsandmarkets.com](https://www.marketsandmarkets.com/Market-Reports/us-enterprise-governance-risk-compliance-market-210046005.html)) |
| Grand View Research, undated live databook, checked **28 October 2026** | US eGRC; **software and services** | **$17.3304bn in 2025**; **$19.4099bn estimated for 2026** | **$40.5251bn in 2033; 11.1% CAGR for 2026–2033** | A materially broader-valued market model; the 2026 figure remains an estimate. ([grandviewresearch.com](https://www.grandviewresearch.com/horizon/outlook/enterprise-governance-risk-and-compliance-market/united-states)) |

### Why can a US estimate exceed a global software estimate?

Because these are not demonstrably the same market. Services alone do not reconcile the difference: Grand View reports a **75.4% US software share for 2025**. Applying that share to its total produces an **approximately $13.07bn implied software estimate**, a desk calculation rather than a separately published measurement. ([grandviewresearch.com](https://www.grandviewresearch.com/horizon/outlook/enterprise-governance-risk-and-compliance-market/united-states))

That result is still above Verdantix’s global software estimate. **Our inference is that taxonomy and modelling differences are material**, not that US expenditure exceeds worldwide expenditure. Public summaries do not provide a sufficient vendor-by-vendor reconciliation. ([verdantix.com](https://www.verdantix.com/vantage/report/market-size-and-forecast--governance--risk---compliance-software-2025-2031-global?utm_source=openai))

Do not average the estimates. An average would have no coherent geography, product boundary or services treatment.

### Can the desk publish its previous $4–7bn US software estimate?

**Not as a verified market measurement.** The supplied desk materials describe that number as a working assumption. This research has not established an independently reproducible bridge from the published markets to US software expenditure by organisations in the target employee range.

For external publication, use an attributed, explicitly scoped estimate from the table—or state that the narrower segment remains unmeasured. The same restriction applies to the supplied segment estimates for integrated GRC, IT risk, third-party risk and internal audit: they should not be added together or promoted to measured facts.

---

# How fast is the market growing—and does that mean more new implementations?

**Published forecasts point to growth, but they do not establish a common US enterprise software growth rate.** Verdantix’s software forecast and the two US eGRC forecasts cover different markets and periods. They are expectations, not observed 2026 growth. ([verdantix.com](https://www.verdantix.com/vantage/report/market-size-and-forecast--governance--risk---compliance-software-2025-2031-global?utm_source=openai))

Supplier disclosures offer a more concrete, although narrower, view of purchasing activity.

### What do disclosed customer and contract volumes show?

| Indicator | Reported observation and period | Important limitation |
|---|---|---|
| Workiva customer base | **6,750 customers at 30 June 2026**, up **283** year on year; approximately **4.4% growth**, calculated from the disclosed counts | Company-wide customers, not US GRC-only deployments. |
| Workiva larger contracts | **2,690 customers above $100,000 ACV; 656 above $300,000; 276 above $500,000**, at 30 June 2026 | These are **nested**, not additive, thresholds. |
| Workiva contract expansion | Those cohorts grew **20%, 34% and 33%**, respectively, year on year | Growth in large accounts is not the same as new-logo growth. |
| Workiva revenue | **$255m in Q2 2026**, up **19%** year on year | Portfolio revenue, not a standalone enterprise GRC market measure. |

**Source for all Workiva figures: financial results published 4 August 2026.** The company also reported **111% net retention**, a measure that includes both solution and pricing changes. ([investor.workiva.com](https://investor.workiva.com/news-releases/news-release-details/workiva-announces-second-quarter-2026-financial-results))

**Interpretation:** this example supports distinguishing customer acquisition from expansion and pricing. Net customer additions do not disclose gross wins, implementation completions or replacement projects. ([investor.workiva.com](https://investor.workiva.com/news-releases/news-release-details/workiva-announces-second-quarter-2026-financial-results))

In an adjacent category, **Fortune reported Vanta reaching $300m ARR on 29 April 2026**. ([fortune.com](https://fortune.com/2026/04/29/exclusive-vanta-arr-300-million-sequoia-shadow-ai-claude-cursor/))

For market modelling, keep recurring-revenue run-rates, recognised revenue, customer counts and contract counts in separate columns. Do not divide a broad market estimate by a pooled average contract value to claim a national installation count.

**Unresolved:** this research did not establish an authoritative annual count of US enterprise GRC purchases, completed implementations or incumbent replacements.

---

# What does enterprise GRC software actually cost?

**Public evidence is useful for challenging a quotation, but insufficient for assigning a universal price to an enterprise GRC deployment.** The most usable observations are scoped procurement samples, explicit component prices and disclosed contract-value cohorts—not unsourced “typical enterprise” ranges. ([vendr.com](https://www.vendr.com/marketplace/auditboard?requestType=priceEstimate&utm_source=openai))

### What annual price ranges appear in procurement data?

| Product label in source | Published annual pricing panel | Sample and date | Appropriate interpretation |
|---|---:|---|---|
| AuditBoard, now Optro | **Median $45,947; displayed low–high $21,220–$111,208** | Vendr panel: **86 purchases**; page checked 28 October 2026; guide marked updated February 2026 | A mixed-scope purchasing reference, not a price for a specified regulated-enterprise implementation. ([vendr.com](https://www.vendr.com/marketplace/auditboard?requestType=priceEstimate&utm_source=openai)) |
| LogicGate | **Median $53,784; displayed low–high $12,294–$136,130** | Vendr panel checked 28 October 2026; sample count and transaction window not disclosed in the retrieved panel | Useful for initial challenge questions, but not a matched quote benchmark. ([vendr.com](https://www.vendr.com/marketplace/logicgate?requestType=priceEstimate&utm_source=openai)) |

These panels have presentation limitations. Vendr’s AuditBoard page separately shows “deals handled” and “purchases” counts; its LogicGate header and median panel differ slightly. This report uses the explicitly labelled median panel and does not combine the counters or infer percentile definitions for “low” and “high”. ([vendr.com](https://www.vendr.com/marketplace/auditboard?requestType=priceEstimate&utm_source=openai))

**Buyer implication:** a quote above the panel’s high figure is not automatically excessive. Require a comparison by modules, administrators, contributor rights, legal entities, integrations, services and contract term before treating the panel as negotiating evidence.

### Which IBM OpenPages prices are directly observable?

IBM’s AWS Marketplace listing provides explicit **12-month component charges**. The following are list observations checked on **28 October 2026**, not complete platform quotations. ([aws.amazon.com](https://aws.amazon.com/marketplace/pp/prodview-6xime4g75fiyo))

| Listed component | Cost per 12 months | What it does—and does not—price |
|---|---:|---|
| Financial Controls Management application | **$26,520** | Application entitlement; not the complete deployment. |
| Internal Audit Management application | **$31,800** | Application entitlement; environment and other required charges must be scoped. |
| Operational Risk Management application | **$37,080** | Application entitlement; not implementation or continuing administration. |
| Essentials base plan for a non-production instance | **$7,740** | A specifically labelled **non-production** component, not a production-platform starting price. |

The listing also identifies usage-based charges and warns that additional AWS infrastructure costs may apply. Obtain a configuration-specific bill of materials rather than adding an arbitrary selection of visible items. ([aws.amazon.com](https://aws.amazon.com/marketplace/pp/prodview-6xime4g75fiyo))

IBM’s own pricing page displays starting figures of **$3,300 and $6,050 for AWS SaaS**, and **$6,250 and $9,000 for IBM Cloud-hosted options**. The retrieved page does not state the billing period alongside those figures. **This report therefore does not annualise them or describe them as monthly prices.** IBM also describes the prices as indicative and excluding applicable taxes and duties. Source checked 28 October 2026. ([ibm.com](https://www.ibm.com/products/openpages/pricing))

### How do named users, administrators and occasional contributors change the comparison?

The commercial unit is not consistent across suppliers:

- **LogicGate:** its current pricing page says customers purchase applications and Power User licences. Standard and External user licences are included without additional user-licence charges; additional features and services are separately scoped. Page checked 28 October 2026. ([logicgate.ai](https://www.logicgate.ai/platform/pricing/?utm_source=openai))
- **ServiceNow IRM:** the entitlement document effective **1 May 2025** distinguishes Operator and Lite Operator rights and identifies conditions and exclusions, including separately purchased Unified Compliance Framework access. Treat that document as a dated entitlement reference and obtain the version governing the proposed order. ([servicenow.com](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/other-document/entitlements/PROD12491.pdf))

**Recommended comparison method:** ask every shortlisted supplier to price the same role inventory. Separate people who configure workflows, perform assessments, approve decisions, submit evidence, answer questionnaires and only read reports. Require written confirmation of the permissions each quoted licence permits.

For a **ServiceNow IRM vs Archer vs IBM OpenPages** comparison, do not substitute an enterprise-wide employee count for this role inventory. For an **AuditBoard/Optro vs Workiva SOX** comparison, hold the controls, entities, audit scope and evidence responsibilities constant.

---

# How much should buyers budget for GRC implementation and ownership?

**This research does not validate a universal implementation multiplier.** The supplied assumption of 0.5–2 times first-year subscription cost should remain a scenario input, not a published market benchmark.

A **May 2026 Forrester study commissioned by ServiceNow** modelled approximately **$1.1m in three-year present-value supplier fees** and **$1.1m in implementation, ongoing management and training costs**. The latter is not implementation alone; neither figure is a market median or a supplier quotation. ([tei.forrester.com](https://tei.forrester.com/go/ServiceNow/IRM/))

The study is useful for identifying cost categories. It is not evidence that a particular bank, health plan or public company should spend that amount.

### What does a transparent three-year GRC TCO illustration look like?

**Source for every figure below: desk scenario dated 28 October 2026. These are assumed inputs and arithmetic, not observed prices, savings estimates or supplier quotations.**

| Cost category | Explicit assumption | Three-year amount |
|---|---|---:|
| Software subscription | $150,000 annually × 3 years | **$450,000** |
| External implementation | Assumed fixed project charge | **$150,000** |
| Internal setup work | 800 hours × $75 loaded hourly cost | **$60,000** |
| Continuing administration | 60 hours monthly × 36 months × $75 | **$162,000** |
| Legacy dual-running | Assumed transition expenditure | **$30,000** |
| **Total** | No subscription increases; no separately charged extras | **$852,000** |

Two sensitivities expose different risks:

- **5% annual subscription increases** would raise three-year software expenditure to **$472,875**, adding **$22,875** to the base scenario.
- **An additional 40 administration hours each month**, at the same assumed labour rate, would add **$108,000** over three years.

These are deterministic calculations, not predictions. They illustrate why administrative workload can matter more than a modest subscription discount.

For a real-world labour signal, a **Bankers Trust Company** advertisement posted **3 September 2026** offered **$88,000–$104,500 annual salary** for a Senior Enterprise Risk System Administrator responsible for the bank’s GRC solution. That is one advertised role—not a national salary benchmark, a required staffing ratio or a fully loaded employment cost. ([jobtarget.com](https://www.jobtarget.com/jobs/jt-t6fj4nviy3/sr-enterprise-risk-system-administrator-des-moines-iowa?utm_source=openai))

### What must be included before a quote is commercially comparable?

Use this checklist as the minimum input to a **GRC total cost of ownership calculator**:

- [ ] Applications and use cases included in the first release.
- [ ] Administrators, practitioners, occasional contributors and external-user rights.
- [ ] Production, testing and sandbox environments.
- [ ] Migration record counts, attachments, relationships and historical audit trails.
- [ ] Connectors, API rights, integration engineering and maintenance ownership.
- [ ] Regulatory content, analytics, AI allowances and usage overages.
- [ ] Internal process design, cleansing, testing and training effort.
- [ ] Continuing administration, support and configuration-change capacity.
- [ ] Renewal mechanics, expansion prices and dual-running assumptions.
- [ ] Export testing and separately modelled exit assistance.

**Unknown costs must remain unresolved inputs, not zeroes.** Request a bottom-up statement of work before relying on any implementation-to-subscription ratio.

---

# How much GRC deal activity has been reported?

**There is evidence of substantial consolidation, but published transaction universes are broader than this desk’s enterprise-platform scope.** They should not be presented as US platform transaction totals. ([irp.cdn-website.com](https://irp.cdn-website.com/bbd57769/files/uploaded/Stax_and_Shea_2025_GRC_Market_Update.pdf))

| Coverage period | Reported activity | Source and publication context | Boundary |
|---|---|---|---|
| **2024** | **More than 50 deals; $25.7bn aggregate enterprise value** | Shea & Company/Stax, *2025 GRC Market Update* | Broad GRC taxonomy, including services and adjacent categories. ([irp.cdn-website.com](https://irp.cdn-website.com/bbd57769/files/uploaded/Stax_and_Shea_2025_GRC_Market_Update.pdf)) |
| **2025** | **At least 63 GRC acquisitions** | Herbert Smith Freehills Kramer, *Global M&A Report 2026*, checked 28 October 2026 | Broad global GRC category; not a census of enterprise platform acquisitions alone. ([hsfkramer.com](https://www.hsfkramer.com/it/insights/reports/2026/global-ma-report-2026/sector-perspectives/cybersecurity)) |
| **2026 to the research cut-off** | No reconciled sector-wide count established in this research | Selected verified announcements below | The selected list is not a market-volume estimate. |

Do not calculate a year-on-year acquisition growth rate from the first two rows: their publishers and inclusion rules differ. Likewise, aggregate enterprise value is not annual software spending, venture funding or cash available for product development.

---

# Which recent acquisitions and funding rounds matter to enterprise buyers?

### What happened within the latest twelve-month research window?

The window is **28 October 2025–28 October 2026**. The following selected records contain **three acquisition announcements and one financing announcement**. This is a desk count of the displayed records, not a comprehensive market total.

| Announcement date | Parties and event | Disclosed value and status | Buyer-side significance and question |
|---|---|---|---|
| **14 January 2026** | **Diligent acquired 3rdRisk**, a Netherlands-based AI-native third-party risk platform | Acquisition announced as completed; **consideration undisclosed** in the release | Relevant to vendor risk management consolidation. Ask which workflows, permissions, contracts and data models are shared with the wider Diligent portfolio. ([diligent.com](https://www.diligent.com/company/newsroom/diligent-acquires-3rdrisk?utm_source=openai)) |
| **11 February 2026** | **Complyance announced a Series A led by GV** | **$20m financing**; valuation not stated | Additional capital for an enterprise GRC challenger. Validate operational references, implementation capacity and AI output controls rather than treating fundraising as proof of maturity. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/02/11/3236367/0/en/Complyance-Raises-20M-Series-A-Led-by-GV-Google-Ventures-to-Modernize-Enterprise-GRC-with-Agentic-AI.html?utm_source=openai)) |
| **21 April 2026** | **Protecht acquired VISO TRUST**, a US third-party risk platform | Acquisition announced; **consideration undisclosed** in the release | A broader risk platform adding AI-assisted third-party assessment. Require a demonstration of the combined workflow rather than separate product presentations. ([protechtgroup.com](https://www.protechtgroup.com/en-us/news/protecht-acquires-leading-ai-powered-risk-platform-viso-trust?utm_source=openai)) |
| **6 May 2026** | **Optro, formerly AuditBoard, acquired Midship** | Acquisition announced as completed; **consideration undisclosed** in the announcement reviewed | Relevant to SOX and controls-testing buyers. Test evidence handling, human review, reproducibility and the price of the acquired capability. ([optro.ai](https://optro.ai/blog/optro-acquires-midship?utm_source=openai)) |

**Analyst inference:** the selected acquisitions indicate investment in specialist evidence, testing and third-party-risk capabilities around broader platforms. They do not establish that implementation effort has fallen or that the acquired functionality is included in existing customer contracts. ([diligent.com](https://www.diligent.com/company/newsroom/diligent-acquires-3rdrisk?utm_source=openai))

### Which older transactions still shape the shortlist?

These are **historical reference transactions outside the latest twelve-month window**. Their values must not be added together as a single measure of “market investment”.

| Original event date | Transaction | Disclosed figure | Correct interpretation |
|---|---|---:|---|
| **23 May 2024 announcement; investment completed July 2024** | Hg acquisition of AuditBoard | **Transaction valued above $3bn** | Acquisition transaction value, not funding raised by the operating company. Announcement and completion are separately documented. ([hgcapital.com](https://hgcapital.com/insights/auditboard-agrees-to-be-acquired-by-hg?utm_source=openai)) |
| **2025**, confirmed retrospectively in Protecht’s 21 April 2026 acquisition release | PSG investment in Protecht | **$280m investment** | The cited release does not provide enough detail to equate the investment amount with company valuation or fresh primary capital. ([protechtgroup.com](https://www.protechtgroup.com/en-us/news/protecht-acquires-leading-ai-powered-risk-platform-viso-trust?utm_source=openai)) |
| **8 April 2025 original release dateline** | Anecdotes expanded Series B | **$30m additional close; $55m total round** | Count the additional close and total round separately; do not describe both as new money in the same event. ([anecdotes.ai](https://www.anecdotes.ai/pr-articles/anecdotes-secures-55m-series-b-to-revolutionize-ai-powered-grc-solutions)) |
| **23 July 2025** | Vanta Series D led by Wellington Management | **$150m raised at a $4.15bn valuation** | Financing amount and valuation are different measures; neither is a software pricing benchmark. ([tech.yahoo.com](https://tech.yahoo.com/cybersecurity/articles/wellington-led-funding-boosts-vantas-120426152.html?utm_source=openai)) |

**Date-quality warning:** the retrieved Anecdotes page displays a May 2026 page date, but its announcement text is explicitly datelined **8 April 2025**. This report assigns the financing to the original event date, not the refreshed page date. ([anecdotes.ai](https://www.anecdotes.ai/pr-articles/anecdotes-secures-55m-series-b-to-revolutionize-ai-powered-grc-solutions?utm_source=openai))

**Naming correction:** AuditBoard became **Optro on 9 March 2026**. The rebrand is not another acquisition and should not create a duplicate supplier or transaction record. Historical AuditBoard pricing and contracts need to be reconciled with the current Optro name. ([optro.ai](https://optro.ai/blog/auditboard-is-now-optro?utm_source=openai))

---

# What does consolidation change in a GRC procurement?

**Use an ownership or product acquisition as a reason to reopen due diligence—not as an automatic reason to buy or reject a platform.** The selected announcements establish ownership activity; they do not settle the following buyer questions. ([diligent.com](https://www.diligent.com/company/newsroom/diligent-acquires-3rdrisk?utm_source=openai))

| Decision area | Evidence to request | Commercial protection to consider |
|---|---|---|
| Product integration | Demonstrate shared records, permissions, reporting and identity management | Make required functionality an acceptance criterion, not a roadmap statement |
| Contract consolidation | Identify contracting entities, subprocessors and separate subscriptions | Confirm which terms govern each component |
| Data migration | Show how acquired-product records, histories and attachments transfer | Price migration and remediation responsibilities explicitly |
| Pricing and packaging | Identify included features, paid additions and future usage meters | Document expansion prices and renewal treatment |
| Product continuity | Provide supported-version and migration plans | Agree notice, assistance and export provisions with legal review |
| AI assurance | Demonstrate source traceability, reviewer intervention and permission boundaries | Define acceptable behaviour and evaluation evidence before commitment |

These are desk recommendations. Their purpose is to convert a corporate announcement into an implementation and contracting assessment.

---

# What is creating buying pressure in late 2026?

### Are regulatory deadlines still ahead—or already behind buyers?

For relevant New York-regulated financial organisations, the final phased requirements discussed here are **already in the past**. NYDFS’s implementation timeline sets **1 November 2025** for the expanded multifactor-authentication and asset-inventory provisions; a subsequent DFS review identifies **15 April 2026** as the annual notification deadline covering those and other Part 500 requirements. Applicability and exemptions need entity-specific review. ([dfs.ny.gov](https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf?utm_source=openai))

**Buyer implication:** a late-2026 business case should distinguish remediation of an existing evidence gap from preparation for a future deadline. Do not recycle 2025 compliance dates as forthcoming urgency, and do not assume that buying software establishes compliance.

### Are AI and continuous controls monitoring lowering costs yet?

The public evidence does not support a universal saving. In its **13 October 2026** discussion of GRC customer references, Forrester highlighted unmet continuous-controls-monitoring expectations, AI consumption-cost concerns and some customers’ efforts to reduce costly customisation. These are qualitative findings, not a representative savings estimate. ([forrester.com](https://www.forrester.com/blogs/grc-customers-have-spoken-four-market-realities-vendors-cant-ignore/))

For procurement, translate those findings into three tests:

1. **Continuous evidence:** require a working integration, failed-sync scenario and named maintenance owner—not a connector logo.
2. **AI cost control:** request the usage meter, allowance, overage rate, reporting and spending-control mechanism.
3. **Configuration discipline:** ask the implementation partner to identify what can be delivered through supported configuration and what creates continuing custom maintenance.

For an **AI-enabled GRC platform comparison**, measure reviewer effort and correction work on buyer-approved synthetic material. Do not import supplier productivity claims into the financial model without a buyer-specific test.

---

# What should a buying team do with this research now?

**Use market data to structure the decision, not to substitute for requirements or delivery evidence.** The recommended next step is a normalised commercial pack for a narrowly defined first release.

### For a first enterprise deployment

- Define one accountable workflow and its acceptance criteria.
- Complete a migration-readiness sample before requesting a fixed migration price.
- Obtain separate software, implementation and continuing-operation quotations.
- Compare prices against scope-matched observations, not broad vendor averages.

### For an incumbent replacement or renewal

- Inventory configuration, integrations, retained specialist products and export dependencies.
- Ask whether repair or simplification of the existing deployment is a credible alternative.
- Price dual-running and internal delivery capacity before comparing headline subscriptions.
- Recheck product ownership and packaging changes since the last contract.

### For an audit-, controls- or security-led expansion

- Establish whether the additional workflow shares evidence without weakening permissions or assurance independence.
- Test the specialist functionality separately from the enterprise platform demonstration.
- Identify what can actually be retired and what must remain.
- Separate claimed labour efficiency from cash savings; neither is assumed in this report.

**Bottom line:** this market offers credible competition, expanding supplier portfolios and useful public price observations. The evidence still does not support a universal US enterprise GRC price, implementation multiplier or installation count. The buyer’s defensible business case remains a scoped quotation plus a tested migration and operating plan.

---

# How was the research assembled—and what remains uncertain?

Research covered market publishers, company and investor announcements, financial results, official pricing and entitlement material, procurement pricing panels, regulatory sources, industry analysis, job advertisements and practitioner-media discovery. Podcasts and video search results were used for discovery rather than as quantitative market evidence; no implementation or savings claim is inferred from unreviewed audiovisual content.

The hierarchy used here is:

1. Official financial disclosures and dated transaction announcements for reported figures.
2. Official marketplace and supplier documents for listed prices and licence structures.
3. Attributed market models and procurement samples, with their limitations retained.
4. Explicitly labelled desk calculations and recommendations.

The principal unresolved questions are the US software-only spend of the target buyer segment, scope-matched enterprise contract distributions, implementation labour benchmarks and a complete 2026 platform transaction census. The sources establish market activity and useful commercial observations; they do not resolve those narrower measurements.

---

# Sources

Publication or event dates are stated above. Undated live sources were checked for this report on 28 October 2026.

1. **Verdantix — Market Size And Forecast: Governance, Risk & Compliance Software 2025–2031**, 15 July 2026. `https://www.verdantix.com/vantage/report/market-size-and-forecast--governance--risk---compliance-software-2025-2031-global`
2. **MarketsandMarkets — US eGRC Market**, September 2026. `https://www.marketsandmarkets.com/Market-Reports/us-enterprise-governance-risk-compliance-market-210046005.html`
3. **Grand View Research — US Enterprise Governance, Risk and Compliance Market Outlook, 2033**, live databook. `https://www.grandviewresearch.com/horizon/outlook/enterprise-governance-risk-and-compliance-market/united-states`
4. **Workiva — Second Quarter 2026 Financial Results**, 4 August 2026. `https://investor.workiva.com/news-releases/news-release-details/workiva-announces-second-quarter-2026-financial-results`
5. **Fortune — Vanta reaches $300m ARR**, 29 April 2026. `https://fortune.com/2026/04/29/exclusive-vanta-arr-300-million-sequoia-shadow-ai-claude-cursor/`
6. **Vendr — AuditBoard pricing panel**, guide marked February 2026. `https://www.vendr.com/marketplace/auditboard?requestType=priceEstimate`
7. **Vendr — LogicGate pricing panel**, live page. `https://www.vendr.com/marketplace/logicgate?requestType=priceEstimate`
8. **IBM — OpenPages pricing**, live page. `https://www.ibm.com/products/openpages/pricing`
9. **AWS Marketplace — IBM OpenPages**, live 12-month pricing listing. `https://aws.amazon.com/marketplace/pp/prodview-6xime4g75fiyo`
10. **LogicGate — Pricing**, live supplier page. `https://www.logicgate.ai/platform/pricing/`
11. **ServiceNow — Integrated Risk Management entitlements**, effective 1 May 2025. `https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/other-document/entitlements/PROD12491.pdf`
12. **Forrester — The Total Economic Impact of ServiceNow Integrated Risk Management**, May 2026; commissioned by ServiceNow. `https://tei.forrester.com/go/ServiceNow/IRM/`
13. **Bankers Trust Company/JobTarget — Senior Enterprise Risk System Administrator**, posted 3 September 2026. `https://www.jobtarget.com/jobs/jt-t6fj4nviy3/sr-enterprise-risk-system-administrator-des-moines-iowa`
14. **Shea & Company/Stax — 2025 GRC Market Update**, reporting 2024 activity. `https://irp.cdn-website.com/bbd57769/files/uploaded/Stax_and_Shea_2025_GRC_Market_Update.pdf`
15. **Herbert Smith Freehills Kramer — Global M&A Report 2026: Cybersecurity**, reporting 2025 activity. `https://www.hsfkramer.com/it/insights/reports/2026/global-ma-report-2026/sector-perspectives/cybersecurity`
16. **Diligent — Acquisition of 3rdRisk**, 14 January 2026. `https://www.diligent.com/company/newsroom/diligent-acquires-3rdrisk`
17. **Complyance — $20m Series A announcement**, 11 February 2026, distributed through GlobeNewswire. `https://www.globenewswire.com/news-release/2026/02/11/3236367/0/en/Complyance-Raises-20M-Series-A-Led-by-GV-Google-Ventures-to-Modernize-Enterprise-GRC-with-Agentic-AI.html`
18. **Protecht — Acquisition of VISO TRUST**, 21 April 2026. `https://www.protechtgroup.com/en-us/news/protecht-acquires-leading-ai-powered-risk-platform-viso-trust`
19. **Optro — Acquisition of Midship**, 6 May 2026. `https://optro.ai/blog/optro-acquires-midship`
20. **Hg — Agreement to acquire AuditBoard**, 23 May 2024. `https://hgcapital.com/insights/auditboard-agrees-to-be-acquired-by-hg`
21. **HgCapital Trust — Q3 2024 Report**, confirming July 2024 investment completion. `https://www.hgcapitaltrust.com/~/media/Files/H/Hgcapital-Trust-V2/documents/investors/publications/2024/q3-report-september-2024.pdf`
22. **Anecdotes — Expanded Series B announcement**, original dateline 8 April 2025. `https://www.anecdotes.ai/pr-articles/anecdotes-secures-55m-series-b-to-revolutionize-ai-powered-grc-solutions`
23. **Reuters — Vanta Series D and valuation**, 23 July 2025, syndicated by Yahoo. `https://tech.yahoo.com/cybersecurity/articles/wellington-led-funding-boosts-vantas-120426152.html`
24. **Optro — AuditBoard rebrand announcement**, 9 March 2026. `https://optro.ai/blog/auditboard-is-now-optro`
25. **NYDFS — Cybersecurity Implementation Timeline for Covered Entities**, November 2023. `https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf`
26. **NYDFS — Regulatory three- and five-year review**, discussing the November 2025 provisions and April 2026 notification. `https://www.dfs.ny.gov/industry_guidance/regulatory_and_legislative_activities/agency_rules_3and5year_review`
27. **Forrester — GRC Customers Have Spoken: Four Market Realities Vendors Can’t Ignore**, 13 October 2026. `https://www.forrester.com/blogs/grc-customers-have-spoken-four-market-realities-vendors-cant-ignore/`