Publications
Tools and automation
Compliance software, automation, open source GRC and what to expect from a platform.
The Delve scandal: what 493 identical SOC 2 reports say about compliance automation
What was alleged against Delve, why procurement teams missed it, how to check a SOC 2 auditor is legitimate, and what compliance automation should prove.
· 5 min readRead Tools and automationCompliance software lock in: how to own your compliance data
What to check in a compliance software contract before you sign or renew: data export, evidence history, renewal caps, Type II continuity and termination terms.
· 4 min readRead Tools and automationCompliance software or compliance consultant? You're asking the wrong question.
Compliance automation platforms like Vanta, Drata, Sprinto and Steppe versus consultants: what each does well, where each fails, and how to combine them.
· 5 min readRead Tools and automationContinuous compliance monitoring: why annual audits are no longer enough
What continuous compliance monitoring is, why point in time audits miss control drift, what to monitor first, and what still needs human judgement.
· 4 min readRead Tools and automationOpen source GRC tools: what free actually costs
An honest look at open source GRC tools like CISO Assistant, Probo and Comp AI: what they do well, what their GitHub issues reveal, and who should use them.
· 4 min readRead