Journal
Features, cases, and briefs on governance, risk, compliance, and security.
Feature · Governance & Compliance
AI in Investigations: 5 Structural Risks in Automated Compliance Workflows
AI is increasingly embedded in compliance and investigative workflows. While automation expands monitoring capacity and accelerates case handling, it also reshapes how accountability, escalation, and institutional trust function inside organizations. In this guest contribution, Andy Miller examines five structural risks that emerge as investigative systems become algorithmically assisted.
Feature · Privacy
The Myth of "Nothing to Hide": How Tiny Clicks Quietly Redraw the Borders of Your Privacy
This article challenges the idea that privacy only matters if you have something to hide. It explores how everyday clicks and small digital habits quietly shape your online identity, why privacy is about freedom and choice rather than secrecy, and how convenience often trades away independence. Readers will learn simple, practical ways to protect their digital space and stay in control of their personal data.
Feature · Human Behavior
Culture Is Caught, Not Taught: Why Leading by Example Shapes Security
This article explores how culture shapes security through everyday behavior and social learning. It explains why people mirror the shortcuts and good habits they see, how social proof influences workplace security, and why leading by example is one of the most powerful tools in governance, risk, and compliance. Readers will learn how small choices create lasting cultural signals that strengthen or weaken security.
Feature · Privacy
The Small Details That Give You Away
This article explores how everyday social media habits expose more than we realize. It explains how small details like birthdays, tags, and photos can be pieced together into a complete picture of your life, often used by attackers for social engineering and identity theft. Readers will learn practical steps to share more safely online and understand why privacy is not about secrecy but about control and awareness.
Feature · Governance & Compliance
GRC in 2025: Emerging Risks & Priorities You Can’t Ignore
Explore the top GRC risks and priorities for 2025 including AI, regulatory complexity, and supply chain vulnerabilities. Learn how GRC leaders can shift from reporting to action, embed compliance into business strategy, and build proactive, resilient risk programs.
Feature · Human Behavior
Why Familiar Feels Safe (and Isn’t)
This article explores why familiarity can create hidden security risks. It explains how normalcy bias and the gambler’s fallacy trick us into trusting what looks routine, and how attackers exploit that trust. Readers will learn why familiar does not mean safe and how a simple pause can prevent costly mistakes in governance, risk, and compliance practices.
Feature · Governance & Compliance
Every Rule Creates a Shortcut: Why Workplace Friction Fuels Risk
This article explores how workplace friction leads employees to create risky shortcuts that bypass risk, and compliance controls. Learn why strict policies often fail in practice, how “work as imagined” differs from “work as done,” and what redesign tactics can reduce friction and strengthen security.
Brief · Governance & Compliance
Essential GRC Resources for Beginners and Growing Teams
This article highlights essential GRC resources for beginners and growing teams, including frameworks, online guides, communities, and free tools. Learn how to navigate governance, risk, and compliance with practical references like NIST, ISO 27001, policy templates, and expert publications.
Feature · Human Behavior
Cognitive Load and Security Fatigue: Why Simplicity is a Risk Control
When security and compliance processes become too complex, people cut corners. This post explores how cognitive load and security fatigue undermine GRC controls, and how simpler steps, smarter defaults, and better guardrails can strengthen resilience.
Feature · Human Behavior
Make Reporting Normal: A Psychological Safety Playbook for GRC
Making reporting normal is one of the most effective ways to prevent risks from growing into incidents. This post shows how psychological safety empowers employees to speak up, why silence is dangerous for GRC, and how a simple “See it. Say it. Sorted.” mindset can strengthen organizational resilience.
Case · Incidents & Governance Failures
Case Study: The Governance Gap Behind a Massive Breach
In 2017, a missed software patch at Equifax exposed the personal data of over 145 million people. This case study explains how human error, unclear ownership, and weak verification turned a preventable issue into one of history’s largest data breaches, and the governance lessons every organization can learn from it.
Feature · Human Behavior
The Psychology Behind Security
Most security breaches do not begin with a hacker breaking through code. They start with a person making a quick decision that opens the door. This article explores how psychology shapes those decisions through cognitive biases, stress, messaging, and everyday habits. You will see how these mental shortcuts can work for or against you, and learn practical steps to protect yourself and your organization by understanding how the mind influences security.
Feature · Governance & Compliance
ISO Frameworks Explained: What Every GRC Professional Should Actually Know
ISO isn’t just about getting certified. It’s about creating a reliable foundation for governance, risk, and compliance. This post breaks down the most important ISO standards, why they matter, and how GRC teams can use them to build real structure, not just pass audits.
Feature · Governance & Compliance
Behavioral GRC: A Blind Spot We’re Finally Seeing
This post introduces Behavioral GRC, a human-centered approach to governance, risk, and compliance. Learn how understanding behavior can improve security, reduce risk, and build a stronger compliance culture.
Brief · Governance & Compliance
GRC Tools for Startups and Small Teams in 2025
This article introduces beginner-friendly GRC tools that help small businesses, startups, and solo professionals manage governance, risk, and compliance more easily. Learn how platforms like Vanta, Drata, and Sprinto simplify tasks such as audit preparation, policy management, and risk tracking. Perfect for teams new to compliance or looking to scale their security practices.
Feature · Human Behavior
From Awareness to Action: Rethinking the Human Role in Cybersecurity
This post challenges the long-held idea that people are the weakest link in cybersecurity. Instead of focusing solely on awareness training or technical controls, it explores how secure behavior is shaped by the environments we create. Drawing from psychology and GRC principles, it offers a fresh perspective on how to design systems that make secure actions easier, more natural, and more likely.
Case · Incidents & Governance Failures
Qantas Data Breach Explained: Third Party Risk, Social Engineering, and GRC Lessons
A breakdown of the 2025 Qantas data breach that exposed 5.7 million customer records through a third-party vendor. Learn how social engineering, weak vendor oversight, and delayed trust controls created the perfect storm and what it means for GRC, cybersecurity behavior, and risk management today.
Feature · Human Behavior
Why People Break Rules Even When They Know Better
Why do people break rules even when they know better? This post explores the psychology of noncompliance in the workplace, looking at decision fatigue, friction bias, social influence, and poor system design. It offers practical ways organizations can support better behavior by removing barriers, encouraging good habits, and creating compliance systems that work with human nature rather than against it.
Feature · Governance & Compliance
Exploring Governance, Risk, and Compliance: Insights from the GRC Journal
New to cybersecurity or curious about how organizations stay secure and accountable? This post breaks down the basics of Governance, Risk, and Compliance (GRC) in plain language. Learn what GRC really means, why it matters, and how it helps businesses make smarter, safer decisions. Perfect for beginners, students, or anyone exploring the intersection of tech, trust, and leadership.
Editor's Note · Editorial
Pilot Post: From Zero to Something
This is the first entry of The GRC Journal, a space to learn out loud as we explore Governance, Risk, and Compliance (GRC) from the ground up. In this post, we share why this project exists, what we aim to learn, and how we plan to make sense of GRC, cybersecurity, and the human side of digital risk.
No pieces match that search or filter.