The ISACA GRC conference this year brought together over 1500 compliance, audit, technology, and security leaders in San Diego for four days of sessions and workshops covering everything from quantum encryption and deepfake tech to agentic AI and access reviews. The breadth of topics was wide, but the underlying themes were consistent. With a team of our own in attendance, we’ve put together the key themes that surfaced over multiple sessions and conversations to give you a picture of what GRC professionals are thinking about today and where the industry is headed tomorrow.
Theme 1: AI Governance Isn’t a Future Problem
If there was a single topic that dominated the conference hall, it was AI. With ISACA recently releasing a new Advanced in AI Risk certification, GRC professionals are thinking about AI and the risk it presents to businesses now more than ever. Prior ISACA conferences focused primarily on how to use AI and LLMs within compliance. This year, however, the focus shifted to governing and securing AI in all the ways it shows up within an organization – agentic, predictive, generative.
Sessions across every track throughout the conference addressed this from different angles, depending on the speaker’s expertise. Technology leaders explored the risks of MCP (Model Context Protocol) and agentic AI infrastructure. Internal auditors explored how audit methodology has to evolve when the systems being audited can make their own decisions. Compliance experts discussed what AI governance looks like at scale, with organizations sharing the real-life frameworks they’ve built for governing AI systems.
The consistent thread: the tools and frameworks most organizations are using were built for a different problem and a different set of rules. Point solutions to cover the gaps are rapidly emerging, but it’s an underlying architectural challenge that organizations and solution providers must solve. And the debate is on for if anyone truly has yet.
Theme 2: The Compliance Checkbox Model is Officially Out
Multiple sessions at ISACA highlighted the complaints practitioners have been making for years: checkbox compliance is theater with minimal risk impact. The argument has never been that compliance doesn’t matter, but that compliance as the primary goal encourages organizations to over-index on taking a list-based approach instead of a true risk reduction mindset.
Vendors pass TPRM questionnaires but are still a primary attack vector, access reviews are completed on time but inappropriate access is still exploited, the list goes on.
What emerged across sessions is a reorientation around risk reduction as the primary objective. Reframing the process around the question of – what actually reduces risk and what is the most secure way to do this? Focusing first on answering that question should, hypothetically, lead you to compliance. Audits should be confirming that the program is working as intended, not a discovery exercise to then go quickly adjust access or fix misconfigurations that have existed for weeks.
Clarity Security’s CEO and Co-Founder, Alexis Moyse, addressed this in her Monday session on continuous risk assessment. She proposed a new model, contrasting with the NIST RMF framework, of Identify, Classify, Triage, Remediate. The audience seemed to recognize the problem and agree with the diagnosis, but are still working out what the new way forward looks like in practice.
Theme 3: Visibility and Evidence Generation are Still Hard
The third theme is one that rarely gets the keynote slot, but still showed up everywhere: most organizations still don’t have complete visibility into what’s happening, which makes producing defensible evidence during an audit a manual, painful process.
We heard from Heimdall Data’s CTO on the “database blind spot” and how reported access consistently fails to reflect effective access, which creates SoD conflicts and audit gaps. Multiple speakers talked on MCP security, highlighting a new category of access risk that most audit programs don’t take into account yet. Additional sessions on continuous compliance made the case that point-in-time assessments are structurally incapable of producing the evidence that regulators actually expect and increasingly demand.
The two problems are closely connected. If you can’t see all of your access and identities (nested, federated, human, non-human, agentic), then you can’t produce accurate reports to prove access is correct. Organizations producing this evidence manually will always be behind the rate of change in their environments, and their overall security posture will suffer.
What These Themes Signal for What’s Next in GRC
GRC is at a critical point in time. The frameworks most organizations rely on were built for a world that no longer exists. With AI dominating the conversation and infiltrating faster than most orgs can get a handle on, structural change needs to happen – for both the frameworks and the tools being used to meet those standards.
This conference made it clear that the professionals working in GRC are well aware of this, and are ready to tackle what’s next. The organizations that will be best positioned are the ones that start reorienting their programs around risk reduction and continuous management now, before the legal system catches up to make it mandatory.
Clarity Security helps security and GRC teams shift from point-in-time identity governance to a continuous program with a focus on risk reduction. To see how Clarity maps to your audit requirements, book a demo with us.
