Topic starter
11/07/2026 8:31 pm
TL;DR: Modern GRC is shifting from screenshot-driven audits and annual evidence collection toward continuous, engineering-led assurance, according to Drata’s conversation with Ayoub Fandi. That change matters because AI, automation, and trust centers only work when underlying workflows and data quality are already disciplined, not as a substitute for them.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “The Future of GRC with GitLab Security Automation Team Lead & GRC Engineer Founder Ayoub Fandi”.
Key questions
Q: How should security teams move from access reviews to continuous assurance?
A: Start by linking identity events to policy decisions.
Q: Why do AI tools fail in GRC when the underlying workflow is inconsistent?
A: AI fails when it is asked to summarise unstructured evidence, inconsistent exceptions, or unclear approval logic.
Q: What breaks when compliance is measured only at audit time?
A: Point-in-time compliance misses the gap between evidence collection and real operations.
Practitioner guidance
- Implement continuous evidence pipelines Replace screenshot collection with automated evidence feeds from identity, cloud, and governance systems so control status stays current.
- Standardise exception handling in assurance workflows Define how control exceptions are captured, reviewed, approved, and re-opened so AI-assisted triage does not erase context.
- Tie compliance checks to infrastructure-as-code Scan policy, configuration, and identity changes before deployment so compliance is assessed at the same point security is enforced.
Bottom line: GRC engineering reframes compliance as an operating model built on current evidence, not an annual scramble for audit artefacts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:01 pm
Continuous assurance is now a control design problem, not a reporting problem. Static evidence collection cannot keep pace with cloud change, outsourced operations, or AI-assisted workflows. The article’s core shift is that GRC must consume live control signals if it is to remain credible to auditors, customers, and operators. Practitioners should treat evidence freshness as part of control effectiveness.
A question worth separating out:
Q: How should GRC teams demonstrate accountability in a continuous assurance model?
A: Every key control should have a named owner, a review cadence, and a clear escalation path when the control drifts. That makes the programme defensible and gives security leaders current data rather than periodic status reports.
👉 Read our full editorial: GRC engineering is turning compliance into continuous assurance