Topic starter
21/08/2026 4:43 pm
TL;DR: Clarity Security reports that over 1500 leaders at ISACA GRC 2026 converged on AI governance, MCP risk, continuous compliance, and the evidence gap from point-in-time reviews. GRC teams now have to verify access and control status continuously, or risk evidence that is complete on paper but stale in practice.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “What ISACA GRC 2026 Made Clear About the Future of Governance, Risk, & Compliance”.
By the numbers:
- The ISACA GRC conference brought together over 1500 compliance, audit, technology, and security leaders in San Diego.
Key questions
Q: Why does agentic AI create both security gains and governance risk in incident response?
A: Agentic AI creates value because it can process large datasets quickly, spot anomalies, and act before damage spreads.
Q: How do organisations know if continuous compliance is actually working?
A: Continuous compliance is working when evidence is current, exceptions are visible, and remediation is tracked in the same workflow as the control.
Q: What breaks when compliance is still run as a point-in-time exercise?
A: Point-in-time compliance breaks when the environment changes faster than the review cycle.
Practitioner guidance
- Rebuild compliance around continuous control validation Replace point-in-time evidence collection with ongoing checks that confirm access, SoD, and configuration state while systems are live.
- Classify AI systems as governed access paths Map agentic AI, MCP-connected tools, and delegated workflows to the identities, permissions, and approvals they actually consume.
- Reconcile reported access with effective access Compare what IAM and GRC systems say should exist with what databases, SaaS platforms, and non-human identities can truly do.
Bottom line: AI governance is no longer separate from identity governance when systems can make decisions and invoke tools under delegated authority.
Glossary terms: Continuous Compliance, Agentic AI, Effective Access, Model Context Protocol
What's in the full article
Clarity Security's full article covers the conference themes and operational implications this post intentionally leaves at a higher level:
- Specific session themes on AI governance, continuous compliance, and evidence generation from the ISACA conference floor
- The practical discussion around MCP risk and why it changes how teams think about agentic AI access
- Examples of how conference speakers framed audit methodology when systems can make their own decisions
- The article's own view on why point-in-time assessments struggle to produce defensible evidence
👉 Read Clarity Security's analysis of AI governance and continuous compliance at ISACA →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
21/08/2026 5:03 pm
Checkbox compliance is becoming a false comfort layer. The article’s core insight is that passing audits does not mean reducing risk when access and system behavior change continuously. GRC programmes that optimise for evidence completion rather than control effectiveness will keep producing neat artifacts and unresolved exposure. The practitioner conclusion is that compliance has to become a byproduct of continuous risk control, not the primary objective.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should GRC and IAM teams do when audit evidence does not match effective access?
A: Treat the mismatch as an operating-control failure, not a documentation issue. Investigate the source of truth for identity, entitlement, and system access, then fix the lifecycle gap that lets reported access diverge from real access. The goal is to restore evidence that reflects what users, services, and agents can actually do.
👉 Read our full editorial: AI governance and continuous compliance are reshaping GRC priorities