GRC Uncensored

In this episode, the crew digs into a messy but necessary topic: what does ethical auditing even mean in a market overrun with automation shortcuts, low-effort SOC 2 audits, and firms that self-declare “quality” without proving it?With Troy actively auditing today and Kendra working with auditors in real time, the team breaks down where rigor actually shows up, where the system is broken, and why SOC 2’s value is slipping as fast as demand for speed is rising.03:00 – “Quality theater” and firms self-labeling as high quality04:10 – Who defines quality—auditors or customers?05:00 – The four-hour SOC 2 audit example06:00 – The danger of “better than the worst” logic07:00 – What thorough auditing actually looks like (Kendra’s experience)09:30 – SOC 2 inconsistency across auditors and firms11:00 – Should audit firms be objectively measured?15:00 – Kendra’s “secret shopper auditor” idea19:20 – Automation platforms producing shallow “green checkmark” results22:00 – Drive-by auditors rubber-stamping automated data26:00 – Peer review and “enhanced oversight” gaps33:00 – Why the industry isn’t incentivized to fix the quality problem39:00 – Ethical auditors exist—but the system doesn’t reward them

This episode dives deep into the messy, absurd, and sometimes hilarious world of SOC 2 audits and compliance frameworks. Wiz CISO Expert Zlatko Unger joins the crew to talk about the expanding “acronym soup” of frameworks, the blurred lines between automation and assurance, and why finding an auditor who vibes with your team might matter more than the name on the certificate.The crew also debates the future of SOC 2 — from fast-track “15-hour audits” to the rise of AI-generated reports — and whether the entire model needs a ground-up rebuild.Guest: Zlatko Unger, CISO Expert at WizHosts: Troy Fine, Kendra Cooley, Elliot Volkman00:03 — Framework overload00:07 — Auditor “vibe check”00:11 — SOC 2’s fall from grace00:16 — TPRM and audit fatigue00:25 — SOC 2 for robots00:36 — Reform or rebuild?

TJ, Kendra, and Elliot are back, and welcomed Evan Millman, GRC Manager at Abnormal Security, for what started as a casual chat and evolved into a sharp look at compliance blind spots, the role of AI in GRC, and how professionals can shape their careers in a changing field.[00:02:00] Evan shares how he used ChatGPT to analyze a risk assessment report.[00:05:00] What GRC leadership looks like at Abnormal Security (ISO 27001, 27701, 42001, SOC 2).[00:07:00] The complicated relationship between organizations and auditors — bias, incentives, and the reality of “clean” reports.[00:12:00] Why third-party attestations are table stakes, not real assurance.[00:19:00] TJ and Evan debate solutions: peer reviews, government oversight, or is the system fundamentally flawed?[00:27:00] How Abnormal approaches vendor risk: criticality ratings, renewals, and compensating controls.[00:32:00] Tools and automation in GRC — benefits and buyer’s remorse.[00:36:00] The role of AI: evidence review, documentation search, and “trust but verify.”[00:39:00] Should GRC professionals become coders, or double down on soft skills?[00:44:00] Evan’s career advice: networking, persistence, and why soft skills matter more than technical depth.

This week on GRC Uncensored, hosts Troy Fine and Elliot Volkman sat down with Merritt Baer, Chief Security Officer at Enkrypt AI, for a candid conversation about the collision between AI, governance, and security. Merritt brought decades of CISO experience — from AWS to the intelligence community — and didn’t hold back, fully embracing our podcast name, on what’s hype, what’s real, and what CISOs should be doing today. Key Moments[00:03:00] – How Merritt uses ChatGPT to re-voice her own drafts — and why she immediately strips out the “saccharine” endings.[00:05:30] – Why security and innovation don’t need to “hold hands” — they just need shared expectations.[00:08:45] – The “foot guns” moment: how an accounting firm’s chatbot started teaching customers to hide assets from the IRS.[00:13:30] – Why most enterprises don’t even know where AI is being used internally.[00:15:00] – How to build guardrails that are realistic, enforceable, and tuned over time.[00:24:30] – Why “ostrich” policies will fail — and how enforcement actions, not regulations, will shape AI accountability.[00:40:00] – Merritt’s closing advice for CISOs: you don’t need to be an expert, but you do need a plan.

In the latest episode of GRC Uncensored, hosts Kendra Cooley and Troy Fine sat down with Jake Bernardes, CISO of Anecdotes and host of Risking It All, to talk about the positive side of GRC. What unfolded was less about sugar-coating and more about the tensions shaping our industry from AI disruption to the shaky future of SOC 2 reports. More specifically, is there a world where we see a consolidation of regulations and frameworks in response to the sprawl we see now?[00:02:00] AI and Auditing – Will automation replace auditors or make them indispensable?[00:06:00] The Positive Side of GRC – How automation is reshaping the auditor’s role.[00:15:00] Are Compliance Platforms Lowering the Bar? – Check-the-box programs vs. meaningful assurance.[00:23:00] The SOC 2 Debate – Is it still valuable, or creating a false sense of security?[00:30:00] Toward Continuous Assurance – Dynamic trust centers and evidence as the new currency.[00:40:00] The Future of Risk in GRC – Why risk registers must evolve and become data-driven.[00:46:00] Closing Thoughts – Optimism about where GRC is headed despite today’s challenges.

This week, the crew sits down with Henry Stanley—founder of Fabrik and engineer-turned-GRC troublemaker-to dig into the messy reality of third-party risk management (TPRM). With experience across fintech, startups, and security consulting, Henry brings a pragmatic but optimistic view of how the industry can move forward.From the limits of SOC 2 and the myth of standardization to the risks and rewards of AI-powered questionnaires, the group unpacks why TPRM is so fragmented—and why that’s not necessarily a bad thing. They also get real about AI in audits, the future role of assurance professionals, and why human connection still matters.06:30 – Why TPRM Is Fragmented by Nature09:00 – SOC 2 Isn’t Enough (And Never Was)13:30 – Does Anyone Really Trust Audit Reports?17:30 – Blacklists, Quality Checks & the SOC 2 Vibe Check20:00 – The Rise of AI in Vendor Assessments25:30 – AI Answers vs. AI Confidence28:30 – Auditing the Auditors (and Their AI)32:00 – Reasonable Assurance in an AI World35:30 – Skepticism, Trust, and Human-in-the-Loop Auditing38:00 – Does AI Kill Creativity? A Side Quest44:00 – Will TPRM Be Agent-to-Agent in the Future?Guest: Henry Stanley, Founder of Security Program.ioHosts: Troy Fine, Kendra CooleyProducer: Elliot VolkmanRuntime: ~56 minutes

This week on GRC Uncensored, the crew welcomes John Santore, a longtime FedRAMP and SOC 2 practitioner who has seen firsthand how compliance frameworks evolve, and sometimes unravel. Now serving as Director of Cyber Acceleration at Constellation GovCloud, John joins Troy and Elliot to unpack FedRAMP 20x, a new pilot program designed to streamline the U.S. government’s cloud authorization process dramatically.The promise? Fewer controls, faster approvals, and greater automation.The concern? That all sounds a little too familiar.Together, they explore whether FedRAMP 20x is an overdue modernization or the start of a dangerous slide toward the kind of checkbox compliance that has made SOC 2 certifications easier to get but harder to trust. From control mapping and auditor disruption to agency adoption and AI-assisted audits, this episode provides a deep dive into what happens when good frameworks move too quickly and how to maintain trust when they do.[00:01:00] – Guest intro: John’s history with SOC 2, FedRAMP, and working with Troy[00:06:00] – How SOC 2 influenced John’s transition into federal compliance[00:08:00] – What is FedRAMP 20x, and why is it happening now?[00:10:00] – From 12-month review cycles to fast-tracking assessments[00:14:00] – Key Security Indicators (KSIs): replacing hundreds of controls with a handful of validations[00:18:00] – Are KSIs basically just vague control summaries? (Spoiler: yes)[00:22:00] – Why GRC platforms are being prioritized in the pilot[00:25:00] – Potential expansion to FedRAMP Moderate and High[00:28:00] – Will agencies even accept this?[00:31:00] – Advice for cloud service providers evaluating FedRAMP now[00:34:00] – Is FedRAMP on the path to commoditization?[00:39:00] – Evaluating rigor vs. relevance: security posture ≠ certification[00:44:00] – The problem of vague frameworks and audit inconsistency[00:48:00] – Comparing SOC 2, FedRAMP, and the race to the bottom[00:54:00] – Closing thoughts on AI, automation, and the future of white-collar workGuest: John Santore, Director of Cyber Acceleration, Constellation GovCloudHosts: Troy Fine & Elliot VolkmanRuntime: ~58 minutes

In this episode of GRC Uncensored, Richa, founder and CEO of Complyance, joins the hosts to unpack the growing tension between scalable compliance tooling and the real needs of maturing GRC teams. The conversation examines why SOC 2 in a box solutions fall short for mid-market organizations and what it truly means to integrate AI without compromising privacy. Along the way, the group debates the future of entry-level roles, the role of trust in automation, and whether AI is truly replacing, or simply reshaping, the GRC profession.[00:01:00] — Intro & guest introduction: Who is Richa and what is Complyance?[00:03:00] — Why Complyance is not “SOC 2 in a box” and how their ethos differs[00:06:00] — Segmenting the GRC tooling market: Startups vs mid-market vs enterprise[00:08:00] — Mid-market struggles: From Excel to Airtable to tailored automation[00:12:00] — The audit bundling debate: Why Complyance refuses to package audits[00:15:00] — Saying no to venture capital pressure and building for the right customer[00:18:00] — What GRC software should enable: peace of mind, not paperwork[00:19:00] — Roundtable: Troy and Kendra weigh in on AI in GRC[00:27:00] — Conversational AI, embedded AI, and the rise of Agentic AI[00:31:00] — Risk owners, vendor reviews, and trust in automation[00:34:00] — Is AI replacing entry-level jobs or just reshaping them?[00:38:00] — Teaching with AI: From education to GRC upskilling[00:42:00] — The risk treatment plan case study: AI as a draft, not a decision[00:47:00] — Closing thoughts on AI, SaaS disruption, and Jetsons-level predictionsHosts: Troy Fine, Kendra CooleyProducer: Elliot VolkmanRuntime: ~49 minutes

As organizations contend with growing threats and shrinking GRC teams, this episode explores the widening talent gap in governance, risk, and compliance. Guest Shruti Mukherjee, a former software engineer turned GRC practitioner, shares her journey, her insights on the evolving nature of the field, and her call to action for both professionals and organizations to rethink what GRC careers can look like.Guests: Shruti (GRC Professional)Hosts: Troy Fine, Kendra CooleyProducer: Elliot VolkmanRuntime: ~55 minutesShow Notes & Segments:00:00 – Intro & BanterCasual chatter and AI banter with the crew, including Shruti’s first ChatGPT query and a few carrot cake recipes.09:00 – GRC’s Image Problem: Is It Just Boring?Shruti discusses the perception problem around GRC, generational gaps in interest, and why it’s often viewed as unsexy or undervalued work.14:30 – Reframing the Pipeline: Who Should We Be Recruiting?The group considers alternative talent pipelines, especially mid-career professionals who better understand the strategic value of GRC.Quote: “Maybe it’s time to come to the good side.” – Kendra20:30 – The Role of AI and Automation: Friend or Foe?Shruti and the hosts weigh in on how automation platforms are shaping the field—for better or worse—and whether GRC jobs are at risk of being replaced.Quote: “I treat AI like an intern. It can do some of the work, but I’ll always check it before it leaves the building.” – Shruti26:00 – What Should New GRC Pros Learn?Shruti shares what she wishes she had known earlier—especially around audit practices—and the value of soft skills and continuous learning.30:30 – Critical Thinking, Not Just CheckboxesWhy GRC professionals must retain their ability to think critically, validate automation outputs, and question assumptions.Quote: “We are losing our ability to be critical thinkers.” – Kendra36:00 – Does GRC Need to Be Technical Now?Shruti unpacks how her technical background helps her talk with engineers, understand tooling, and embrace AI; arguing that technical fluency is becoming essential.44:30 – Final Thoughts: Risk Culture, Knowledge Transfer, and the FutureThe group reflects on the need to pass down GRC fundamentals, resist overreliance on AI, and target new demographics for hiring.