GRC Platforms

The GRC market in numbers

Four breakdowns of the 141 platforms listed on this directory. They describe this list, not the whole market: the catalog is curated, and nothing here is a ranking or a market share. Curated, not exhaustive. Every listed platform by name is on the market map.

As of 2026-10-29

Charts and CSVs are CC BY 4.0: reuse them with credit to GRC Platforms (grcplatforms.com) and a link. Platform descriptions are not licensed.

Share on LinkedInShare on X

Platforms by category, of listed platforms

n = 141141 of 141 have a categoryAs of 2026-10-29

Platforms by category, of listed platforms141 listed platforms by primary category: Compliance Automation 25, Enterprise GRC Suites 22, Integrated Risk Management 17, Third-Party Risk 15, Financial Crime & AML 14, Privacy & Data Governance 13, EHS, Quality & ESG 12, Cyber Risk & CCM 8, Audit Management 6, Policy, Training & Awareness 6, AI Governance 3.Compliance Automation18%25Enterprise GRC Suites16%22Integrated Risk Management12%17Third-Party Risk11%15Financial Crime & AML10%14Privacy & Data Governance9%13EHS, Quality & ESG9%12Cyber Risk & CCM6%8Audit Management4%6Policy, Training & Awareness4%6AI Governance2%3

Of listed platforms. Curated, not exhaustive.

Method: Each platform counts once, in the one primary category the directory assigns by main product focus.

CC BY 4.0, credit GRC Platforms (grcplatforms.com) with a link. Chart page · CSV

Numbers as a table
Platforms by category, of listed platforms
CategoryPlatformsShare of listed
Compliance Automation2518%
Enterprise GRC Suites2216%
Integrated Risk Management1712%
Third-Party Risk1511%
Financial Crime & AML1410%
Privacy & Data Governance139%
EHS, Quality & ESG129%
Cyber Risk & CCM86%
Audit Management64%
Policy, Training & Awareness64%
AI Governance32%

Frameworks and regimes named on listings, of listed platforms

n = 141141 of 141 name at least one frameworkAs of 2026-10-29

Frameworks and regimes named on listings, of listed platformsFrameworks named on 141 of 141 listed platforms, top 15: ISO 27001 91, GDPR 80, SOC 2 57, NIST CSF 41, HIPAA 31, PCI DSS 30, SOX 25, CCPA 12, ISO 45001 12, NIS2 12, ISO 31000 11, DORA 10, ISO 14001 10, BSA/AML 9, COSO 8.ISO 2700165% of listed91GDPR57% of listed80SOC 240% of listed57NIST CSF29% of listed41HIPAA22% of listed31PCI DSS21% of listed30SOX18% of listed25CCPA9% of listed12ISO 450019% of listed12NIS29% of listed12ISO 310008% of listed11DORA7% of listed10ISO 140017% of listed10BSA/AML6% of listed9COSO6% of listed8

5 more frameworks are also named on 8 listings each; full list in the CSV.

Of listed platforms. Named on the listing; not a verified capability. Curated, not exhaustive.

Method: Distinct frameworks per listing after normalization: "NIS 2" counts as NIS2; NIST stays apart from NIST CSF; AML, BSA/AML and 6AMLD stay apart. Top 15 by listings naming them, ties broken alphabetically; the heatmap uses the first 10 of the same ranking.

CC BY 4.0, credit GRC Platforms (grcplatforms.com) with a link. Chart page · CSV

Numbers as a table
Frameworks and regimes named on listings, of listed platforms
FrameworkListings naming itShare of listed
ISO 270019165%
GDPR8057%
SOC 25740%
NIST CSF4129%
HIPAA3122%
PCI DSS3021%
SOX2518%
CCPA129%
ISO 45001129%
NIS2129%
ISO 31000118%
DORA107%
ISO 14001107%
BSA/AML96%
COSO86%

Where listed platforms are headquartered

n = 141140 of 141 have a headquarters; 1 without one is not countedAs of 2026-10-29

Where listed platforms are headquartered140 listed platforms by headquarters country: United States 80, United Kingdom 15, Germany 9, Canada 7, France 5, Israel 5, Australia 4, Netherlands 3, Other (9 countries) 12. By region: United States 80, Europe 41, Canada 7, Other 12.United States57%80United Kingdom11%15Germany6%9Canada5%7France4%5Israel4%5Australia3%4Netherlands2%3Other (9 countries)9%12

By region

Where listed platforms are headquartered: by regionUnited States 80, Europe 41, Canada 7, Other 12United States57%80Europe29%41Canada5%7Other9%12

Of listed platforms. Curated, not exhaustive.

Method: Country is the last part of the recorded headquarters, with "USA" and "United States" counted as one. Top 8 countries (a tie at the cut stays together), the rest grouped as Other. Regions: Europe is the EU and EEA countries plus the United Kingdom and Switzerland; Other includes Israel and Australia. Shares are of platforms with a headquarters.

CC BY 4.0, credit GRC Platforms (grcplatforms.com) with a link. Chart page · CSV

Numbers as a table
Where listed platforms are headquartered
CountryRegionPlatforms
United StatesUnited States80
United KingdomEurope15
GermanyEurope9
CanadaCanada7
FranceEurope5
IsraelOther5
AustraliaOther4
NetherlandsEurope3
DenmarkEurope2
IrelandEurope2
SwitzerlandEurope2
BrazilOther1
FinlandEurope1
LuxembourgEurope1
NorwayEurope1
SingaporeOther1
South AfricaOther1

Consolidation on this list: sourced events by year

n = 1313 events on 12 platforms on this directory, 2 of them brand-retired history pagesAs of 2026-10-29

Consolidation on this list: sourced events by year13 sourced events on 12 listed or history platforms, by year: 2016 1, 2017 0, 2018 0, 2019 1, 2020 0, 2021 1, 2022 1, 2023 2, 2024 4, 2025 0, 2026 (to 2026-10-29) 3.20161 acquisition1201702018020191 majority stake12020020211 acquisition120221 acquisition120232 acquisitions220243 acquisitions, 1 merger4202502026 (to 2026-10-29)1 acquisition, 1 rebrand, 1 spin-off3

On this directory. Events affecting platforms on this directory, from its own sourced ledger; deals whose products were never listed are missing. Curated, not exhaustive.

Method: A hand-curated ledger (data/consolidation-events.json): each event names its year, type, status, counterparty and a source (a decision record of this directory or a primary-source URL). Formations and unconfirmed events are left out; announced deals are marked announced. Not a measure of GRC M&A volume.

CC BY 4.0, credit GRC Platforms (grcplatforms.com) with a link. Chart page · CSV

Numbers as a table
Consolidation on this list: sourced events by year
YearPlatformEventCounterpartyStatus
2026Octave Reliance (formerly ETQ Reliance)spin-offHexagonclosed
2026Optro (formerly AuditBoard)rebrandOptroclosed
2026StandardFusionacquisitionWolters Kluwerclosed
2024Bizzdesign HOPEX (formerly MEGA International)mergerBizzdesignclosed
2024CammsacquisitionRiskonnectclosed
2024FastpathacquisitionDelineaclosed
2024PrevalentacquisitionMitratechclosed
2023ArcheracquisitionCinvenclosed
2023RiskLensacquisitionSafe Securityclosed
2022Octave Reliance (formerly ETQ Reliance)acquisitionHexagonclosed
2021AlessaacquisitionTier1 Financial Solutionsclosed
2019Coritymajority stakeThoma Bravoclosed
2016EnablonacquisitionWolters Kluwerclosed