Survey Finds Spreadsheets Still Lead GRC Tools Amid Practitioner Skills Gaps
Summary
A survey of 795 GRC practitioners finds spreadsheets remain a leading tool, while 59.1% use no commercial GRC platform. It also identifies technical skills gaps and differences in tool adoption by team size and seniority.
Key points
- The survey collected 795 responses from GRC Engineer newsletter subscribers and community members between April 2025 and March 2026; 748 unique respondents remained after deduplication.
- The report says 59.1% of practitioners use spreadsheets, custom tools, open source, or no tool, rather than a commercial GRC platform.
- Among 142 solo practitioners, 42% reported using no GRC tool; spreadsheets remained the leading tool across team sizes except teams of 11 or more.
- Among 258 industry practitioners, 20.5% rated their technical skills low, 50.4% mid-range, and 29.1% high; 62.3% of mid-skill practitioners used a commercial tool.
- The report found commercial tool adoption rose with team size, from 51% in teams of 2–4 to 62% in teams of 11 or more.
- The findings are based on a self-selected, GRC-focused audience and self-reported skills; the report cautions that results may not represent the broader GRC workforce.
Article Details
- Publisher
- The GRC Engineer
- Report Period
- April 2025 to March 2026
- Scope
- Survey of GRC practitioners covering workforce, team structure, tool use, and technical skills.
- Sample Size
- 795 responses; 748 unique respondents after deduplication.
- Key Statistics
- 59.1% of practitioners were described as commercially unaddressed, combining spreadsheet, custom-tool, open-source, and no-tool users.
- 51% of GRC teams had four people or fewer.
- Among 258 industry practitioners, 20.5% rated their technical skills 1–3, 50.4% rated them 4–6, and 29.1% rated them 7–10.
- Only 7.4% of surveyed CISOs used ServiceNow; 73.6% used no commercial tool.
People
Vendors
Archer IRM- **The enterprise incumbent (ServiceNow, AuditBoard, Archer IRM):** mid-range skills, large teams, buyers who evaluate on integration.AuditBoardand organizational team size against specific vendor platforms including Drata, Vanta, ServiceNow, AuditBoard, Open Source, and Spreadsheets.]Drataskill distribution (scale 1-10) and organizational team size against specific vendor platforms including Drata, Vanta, ServiceNow, AuditBoard, Open Source, and Spreadsheets.]OneTrust38 users. Ahead of OneTrust. Ahead of Archer. Average skill 6.3, 21% CISOs, 45% consultants. The most technically skilled, most senior, and most influential practitioners in the industry choose open source.ServiceNowdata diagrams depicting commercial tool adoption rates across executive and director roles, focusing on ServiceNow adoption rates among CISOs versus other roles, and the prevalence of open-source/non-commercial toolsVantaAmong those who do adopt, Vanta leads with 15 users, a 7.4x overrepresentation versus its non-solo share (Fisher's exact $p=0.0002$).
Products
Archer IRM- **The enterprise incumbent (ServiceNow, AuditBoard, Archer IRM):** mid-range skills, large teams, buyers who evaluate on integration.AuditBoardand organizational team size against specific vendor platforms including Drata, Vanta, ServiceNow, AuditBoard, Open Source, and Spreadsheets.]Drataskill distribution (scale 1-10) and organizational team size against specific vendor platforms including Drata, Vanta, ServiceNow, AuditBoard, Open Source, and Spreadsheets.]OneTrust38 users. Ahead of OneTrust. Ahead of Archer. Average skill 6.3, 21% CISOs, 45% consultants. The most technically skilled, most senior, and most influential practitioners in the industry choose open source.ServiceNowdata diagrams depicting commercial tool adoption rates across executive and director roles, focusing on ServiceNow adoption rates among CISOs versus other roles, and the prevalence of open-source/non-commercial toolsVantaAmong those who do adopt, Vanta leads with 15 users, a 7.4x overrepresentation versus its non-solo share (Fisher's exact $p=0.0002$).