In January 2026, ISC2 surveyed 681 cybersecurity professionals responsible for GRC programs worldwide. What they found signals a fundamental shift in how the profession understands its own purpose.
There was a time when cybersecurity’s central preoccupation was the threat. Who is attacking us? What are they after? How do we stop them? Threat intelligence, threat hunting, threat actor profiling — the language of the field was built around adversaries and their capabilities. It was, in many ways, a military framing: know your enemy, defend your perimeter.
That framing, while still relevant, is no longer sufficient. And in 2026, the cybersecurity profession — particularly those working in GRC — appears to know it.
ISC2’s recent survey of 681 cybersecurity professionals with GRC responsibility found a clear consensus: those charged with GRC programs are focused on increasing the strategic impact of GRC, improving risk quantification, and modernising how GRC operates within their organisations. Threats remain a critical consideration, but they now sit within a wider frame — one defined by governance, accountability, and the language of business risk.
From Adversary to Appetite
The conceptual shift sounds simple, but the operational implications are profound. Threat-centric security asks: what might happen to us? Risk-centric security asks: what is the value of what we’re protecting, and what are the consequences if we lose it?
At ISC2’s recent Spotlight on GRC, John Sapp Jr, CISO of Texas Mutual Insurance Company and a FAIR Institute board member, put it plainly: risk quantification requires organisations to “determine and understand what is the value of what’s at risk” in the event of a cybersecurity incident.
That sounds straightforward. In practice, it demands a degree of cross-functional fluency that many security teams are still developing. Alexander Antukh, CISO at AboitizPower, identified four inputs required to evaluate a risk profile: the state of the threat landscape, an understanding of organisational impacts, control effectiveness, and continuous validation of all three. Getting all four right, simultaneously, with data that finance and legal teams will trust — that is the real challenge.
The Board Problem
The urgency behind this shift is not purely intellectual. It is being driven by boards and executives who are demanding something that security teams have historically struggled to deliver: financially quantified, real-time risk data.
One survey respondent captured the tension directly: “I find it difficult to provide the board with the real time, financially quantified risk data they demand. This is compounded by a critical talent shortage of professionals who possess the rare blend of technical cloud expertise and international legal fluency required to navigate this landscape.” I
This is not a new complaint. But the regulatory environment has made it an urgent one. Boards are no longer passive consumers of security updates — they are being held accountable by regulators for the adequacy of their cyber governance. When a board asks a CISO “what is our risk exposure?”, a heat map and a list of open vulnerabilities is no longer an acceptable answer.
The “Check-Box” Problem and How to Escape It
Alongside the push toward risk quantification, ISC2’s survey and Spotlight sessions surfaced a persistent cultural barrier: the perception of GRC as a compliance exercise rather than a strategic function.
One respondent put it plainly: “Many executives see GRC in cybersecurity as a ‘check box’ activity. If cybersecurity professionals can overcome the challenge of this by advocating for proper risk activities, this will create the larger opportunity to integrate cybersecurity as a business enabler.”
This framing matters. When GRC is seen as a compliance function, its value is measured in audits passed and findings closed. When it is seen as a risk function, its value is measured in better decisions made — investment prioritised correctly, exposure reduced, board confidence earned.
Karina Klever, CEO and CISO at Klever Compliance, made the point at ISC2’s Spotlight event that documents and controls are not primarily there for the benefit of the auditor: “The documents are there for the success of your team and your operations.” Controls that are too vague to measure are controls that cannot tell you whether you are winning or losing.
Precision Is Not the Goal
One of the more counterintuitive insights from ISC2’s GRC Spotlight came on the question of quantification itself. The instinct, when asked to put numbers on risk, is to seek precision. To build models. To demand better data. To wait until the inputs are clean enough to trust.
Omar Khawaja, CISO at Databricks and FAIR Institute board member, pushed back on that instinct: “Sometimes we over-index on how perfect the numbers need to be. The reality is to do risk quantification fairly well, you actually don’t need your numbers to be anywhere near perfect.”
Khawaja pointed to Fermi decomposition — the technique of breaking complex problems into manageable elements and using approximate estimates to reason about them — as a practical model for GRC teams. “There’s no one in the organisation that’s expecting you to predict the future down to plus or minus one percentage point.”
This is liberating, but it requires a shift in mindset. Directionally correct risk data, communicated confidently and in business terms, is more valuable to a board than a perfect model that never gets built.
The Opportunity Ahead
ISC2’s survey was clear on where the opportunity lies: “the biggest opportunity for GRC professionals is that cybersecurity has become a business priority, not just a technical issue. Organisations face stricter regulations, higher cybersecurity risks and increased use of cloud and AI technologies. GRC professionals help ensure compliance, manage risks in business terms and guide safe technology adoption.”
For GRC professionals willing to make the transition — from control-checkers to risk translators, from compliance reporters to strategic advisors — the conditions have rarely been better. Regulatory pressure is creating board engagement. AI and cloud adoption is creating new risk domains that need governance. The talent gap means that those who can bridge technical depth with business communication are in high demand.
ISC2’s view is that GRC professionals need to move beyond compliance enforcement into strategic leadership roles — combining regulatory expertise, technical fluency, risk quantification, and corporate communication to help organisations operate securely, compliantly, and competitively.
The threat will always matter. But the organisations that get ahead of the curve in 2026 will be those that have learned to talk about risk — clearly, credibly, and in the language their boards actually understand.”
Strengthening Your Cybersecurity with Intrix
Understanding the risks is only the first step. Acting on them is what makes the difference.
At Intrix, we help organisations stay ahead of AI-driven threats through penetration testing, continuous security validation, and expert advisory. Our approach focuses on identifying real-world risks, prioritising what matters, and helping your team respond faster.
If you want to understand your current exposure and how to improve your cybersecurity posture, contact us and let’s start a conversation.
