Hyperproof’s 2026 GRC Benchmark Links Automated Risk Management to Lower Reported Breach Rates
Summary
Hyperproof’s survey of 1,002 respondents found reported 2025 breach rates of 50% for ad-hoc risk management versus 27% for integrated, automated approaches. Manual compliance work remains widespread despite strong AI adoption.
Key points
- The survey gathered 1,002 responses in November and December 2025; 63% came from the United States, 30% from the United Kingdom, and 7% from Canada.
- Among respondents managing IT risk ad-hoc, 50% reported a breach in 2025, compared with 27% using integrated, automated tools; the survey establishes an association, not causation.
- 76% reported spending at least 30% of their risk and compliance time on repetitive administrative tasks, nearly unchanged from 77% in the previous report.
- Although 58% used software to continuously monitor controls, only 25% collected evidence continuously as part of a continuous compliance program.
- 97% used AI to streamline workflows, including documentation review and research; 27% used it to respond to security questionnaires.
- 34% still used spreadsheets to identify and manage third-party risks, highlighting continued reliance on manual inputs alongside dedicated tools.
- 70% reported 2026 GRC budgets of at least $1 million; the report cautions that planned investment can diverge from actual spending.
Article Details
- Publisher
- Hyperproof
- Report Period
- 2026 benchmark; survey conducted in November and December 2025
- Scope
- Survey of IT risk, compliance, governance, budgets, staffing, and third-party risk management across organizations in the United States, United Kingdom, and Canada.
- Sample Size
- 1,002 survey responses
- Key Statistics
- Respondents reported 2025 breach rates of 50% for ad-hoc risk management versus 27% for integrated, automated approaches; this is an observed association, not evidence of causation.
- 76% of respondents spend at least 30% of their risk/compliance time on repetitive tasks, compared with 77% in the previous year's results.
- 34% of respondents use spreadsheets to identify and manage third-party risks.
- 70% of respondents reported 2026 GRC budgets of $1M or more, including staffing, software, and external services.
- 97% of respondents use AI to streamline workflows.
- Recommendations
- Automate evidence collection, standardize ownership and approvals, and keep evidence continuously updated.
- Use a common controls framework to rationalize requirements, reuse evidence, and maintain consistent reporting across jurisdictions.
- Connect recurring risk assessments to remediation tracking, control evaluation, and leadership reporting.
- Centralize vendor risk records, standardize evidence requirements, and automate collection, follow-ups, and remediation tracking.
- Define measurable, enforceable AI supplier risk criteria and validate supplier evidence through ongoing reviews.
Vendors
Products
Industries
Bankingmanagement. Manufacturing, Banking,Financial ServicesFinancial Services stands out as the industry enforcementHealthcareand Healthcare, by contrast, appearManufacturingBudgets in the ManufacturingRetailManufacturing Retail All OthersTechnologytraditional security and compliance risks, but the rapidly evolving risks associated with AI-enabled technology.