One control mapped across multiple frameworks? Great. Less duplicate work. But mapped doesn’t mean working. Skip the repeat work, not the testing that proves your controls do their job. SimpleRisk keeps test results attached to each control, so the proof is there when asked.

We’re taking GRC beyond the office and into the wilderness! Meet the contestants of GRC in the Wild, our six-episode game show premiering 10/23. Follow along for risk assessment, friendly competition, and plenty of outdoor adventure! 🎬 Watch here: na2.hubs.ly/H08zMg40

Knowing what’s vulnerable and agreeing what to fix first are two different meetings. Join SimpleRisk’s Josh Sokol at LASCON: “47,000 Vulnerabilities and Nobody Knows What to Fix” Oct. 29 | 11–11:50 a.m. CT | Red Oak Ballroom, Austin na2.hubs.ly/H08r5Vb0.

Email tracking isn’t just a newsletter issue. Our blog looks at the CRM, sales and support tools that may sit outside the review, and how to bring them into scope. Read the article: na2.hubs.ly/H08r5RY0.

The GRC review was on time. The supplier, budget and launch date were already committed. Approval speed matters. So does reviewing while choices still exist. Getting risk input in before decisions lock is the problem we built SimpleRisk to solve.

“High” is a fine risk rating until your CFO asks what it means in dollars. Then you need frequency, magnitude, and the assumptions behind both. A dollar sign on a guess is still a guess. SimpleRisk lets you answer both questions on the same risk.

47,000 vulnerabilities. Which 10 are you actually fixing? At #LASCON2026, Josh Sokol is digging into the gap between finding more security issues and knowing what actually deserves action. 📅 Oct. 29 | 11–11:50 AM 📍 Red Oak Ballroom

Upgrading SimpleRisk just got a lot smoother: several upgrade-blocking defects fixed, older PHP instances carried forward as far as supported, automatic backups on the Backups page, and Extras that check compatibility before installing.

Audit in 43 days. One analyst. No new headcount. Not every gap is equal. Triage what could stall the audit, fix what's urgent, roadmap the rest. Don't start a tool migration mid-crunch. Good GRC is knowing what can wait. An audit that starts ready is why we built SimpleRisk.

SimpleRisk AI is now grounded in a context graph built from your actual GRC data: proposed control tests, human approval required, individual feature controls, and support for local providers like Ollama. AI that knows your environment, not a generic one.

Two chances to connect with SimpleRisk creator Josh Sokol at #SecTor2026: 📅 Oct. 7 | 2:30 PM ET Presentation: SimpleRisk: Governance, Risk Management & Compliance 📅 Oct. 8 | 11:30 AM ET Live demos + Q&A 📍 Arsenal — Station 3

The SimpleRisk Connectivity Visualizer just got rebuilt on a much wider entity graph, now including exceptions, audits, vulnerabilities, and the risk and threat catalogs. Search it, click through it, actually see how your program connects.

Security tests the control. Compliance reviews it. Audit asks for the same evidence later. Three teams proving the same control works isn't an assurance problem. It's a coordination problem. One shared record: SimpleRisk. Free 30-day trial: na2.hubs.ly/H07Xb7S0

Risk management shouldn’t require an enterprise-sized budget At #SecTor2026, SimpleRisk creator Josh Sokol will show how open-source GRC help teams move beyond spreadsheets without the cost & complexity of bloated enterprise platforms 📅 Oct. 7 | 2:30 PM 📍 Arsenal, Station 3

SimpleRisk frameworks and tests just got a full rebuild: auto-generated Statements of Applicability, one test covering many controls, scheduled test cadences, and audit approval workflows. Self-Assessments now run on the Secure Controls Framework too.

Still managing risk in spreadsheets? At #SecTor2026, SimpleRisk creator Josh Sokol will show how open-source GRC can help teams move beyond manual processes without enterprise-platform cost or complexity. 📅 Oct. 7 | 2:30 PM 📍 Arsenal, Business Hall, Station 3

New in SimpleRisk: a Home dashboard that shows exactly where your program stands the moment you log in. No more digging through modules to find what needs attention. Configurable, fast, and it finally makes sense on day one.

A control can look perfect on paper and still fail in practice. Good testing asks two things: does it address the risk, and does it actually work consistently? Design matters, but operating effectiveness is what SimpleRisk helps you actually rely on.

GRC teams shouldn't prove the same control repeatedly. Mature programs collect evidence at the control level, govern its freshness, and reuse it across frameworks and audits. Less chasing. More consistent assurance. SimpleRisk makes evidence reusable.

Heading to #SecTor2026? Join SimpleRisk creator Josh Sokol on Oct. 7 at 2:30 PM for a look at how open-source GRC can help teams move beyond spreadsheets without the cost and complexity of enterprise platforms. #GRC #RiskManagement