Topic starter
11/07/2026 8:21 pm
TL;DR: Modern GRC is shifting from static compliance toward continuous trust, with AI, real-time evidence, and cross-functional assurance replacing audit panic and manual gap analysis, according to Drata’s conversation with Wiz’s Max Anand. The result is a governance model where speed, transparency, and human judgment matter more than checkbox maturity.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “GRC, AI, and the Future of Trust: Lessons From My Conversation With Wiz’s Global Head of Security Trust, Max Anand”.
Key questions
Q: How should organisations move from quarterly compliance to continuous trust?
A: They should connect control evidence, access data, and remediation workflows into a live governance loop.
Q: Why do point-in-time audits miss so much real-world risk?
A: Because environments change faster than audit cycles.
Q: What are the main risks of using AI in assurance workflows?
A: The main risks are incomplete answers, misleading summaries and overconfidence in outputs that have not been verified.
Practitioner guidance
- Define a continuous evidence model Map which control signals must stay current between audits, including access reviews, entitlement changes, exception handling and ownership metadata.
- Introduce human verification for AI outputs Require manual review for AI-generated questionnaire responses, framework mappings and evidence summaries before they enter assurance packs.
- Treat compliance artefacts as inputs, not outcomes Use SOC 2 and similar attestations as one signal among others, then validate whether runtime access and control state still match the artefact.
Bottom line: Continuous trust shifts GRC away from periodic paperwork and toward live proof that controls are still working.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:51 pm
Continuous trust is becoming the right governance model for assurance-heavy security programmes. The article describes a move away from point-in-time compliance toward live evidence, shared accountability and faster decision cycles. That model aligns with how identity governance really works, because access and privilege change continuously while audit windows do not. Practitioners should treat continuous evidence as a trust control, not a reporting enhancement.
A question worth separating out:
Q: How can GRC teams prove trust to auditors and customers at the same time?
A: By creating a reusable evidence layer that maps the same underlying control data to different assurance needs. That reduces duplicate work and makes it easier to keep customers, auditors and regulators aligned on one current source of truth.
👉 Read our full editorial: Continuous trust is reshaping GRC, assurance and AI-assisted audits