GRC Is Broken. The Buyer Is The Bigger Problem | Guest: Jake Bernardes
Source: YouTube · GRC Engineering Club · published Oct 18, 2026 · 38:40
BLUF: Jake Bernard argues that the GRC industry is fundamentally broken because it relies on binary "checkbox" artifacts rather than real-time data, creating a cycle of fear and theater where neither vendors nor buyers are technically equipped to handle true compliance evidence. 1:00
Key Takeaways:
- The Data Gap: Modern compliance requires raw JSON data from live systems, not static tick-boxes, yet most organizations lack the engineering skills to produce or interpret this data. 1:15
- Buyer Incompetence: The core issue lies with buyers who are not technically competent to analyze JSON evidence and instead demand binary yes/no answers to avoid making subjective risk-based decisions. 4:30
- Fear of Legal Consequence: Vendors avoid sharing true compliance postures due to the fear that real-time data will be used against them in court, unlike marketing claims which are rarely scrutinized with the same legal rigor. 8:50
- Outcome-Focused GRC: Professionals should ignore 80% of vendors and rigorously assess only those critical to the "Minimum Viable Business," aligning all security tools and budgets directly to specific risks in the risk register. 16:20
- Career Strategy: Breaking into GRC requires reverse-engineering roles by identifying desired outcomes and upskilling via AI tools, rather than memorizing outdated technical checklists. 31:00
Closing Statement: To fix GRC, the industry must shift from legalistic theater to engineering-driven resilience, requiring brave CISOs and technically competent buyers to embrace real data and risk-based prioritization.
Sources:
- 1:00 Argument that GRC is broken and relies on ineffective tick-box artifacts.
- 1:15 The need for raw JSON data over binary compliance confirmations.
- 4:30 Buyers' lack of technical competence to interpret real compliance data.
- 8:50 Vendor fear of legal repercussions from sharing true compliance evidence.
- 16:20 Strategy to focus only on the 20% of vendors critical to business resilience.
- 31:00 Advice on reverse-engineering career paths in GRC using AI and outcome focus.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Compliance & GRC. Commonly maps to: Security and Risk Management, Asset Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Welcome friends to another scintillating edition of the anti-checkbox podcast. I am joined today by someone who a phrase of his when I first met him still lives rent free in my head. I hear it maybe once or twice a week and uh I think he knows what it is but we'll we'll get into it. Jake Bernard is Jake. Welcome sir. >> Thank you for having me. It's um absolute a pleasure. Um, I have the the blessing and benefit of no longer being a direct Well, I am a semi-mp employee in the GLC world, but now I have a a freer ability to say what I think and what I want in a world I didn't several months ago. So, let's let's get right into it then. At that point, what what would be certain things that you you were itching to get into or talk about that you wouldn't you didn't have that freedom? Like, let'…