Security & GRC Decoded

By Raj Krishnamurthy

How today’s top organizations navigate the complex world of governance, risk, and compliance (GRC). Security & GRC Decoded brings you actionable strategies, expert insights, and real-world stor

... more

Download on the App Store

Download on the App Store

Get it on Google Play

FAQs about Security & GRC Decoded:

How many episodes does Security & GRC Decoded have?

The podcast currently has 37 episodes available.

Security & GRC Decoded episodes:

June 25, 2026The Trust Gap in AI: Why Agents Need a New Certification Model ft Rajiv Dattani & David Meyer @ AIUC
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Rajiv Dattani and David Meyer from Artificial Intelligence Underwriting Company (AIUC) to explore one of the biggest unanswered questions in AI security:
Can organizations actually trust AI agents?
As enterprises rapidly deploy AI-powered products, copilots, and autonomous agents, traditional security assessments, compliance frameworks, and cyber insurance models are struggling to keep pace. Rajiv and David explain why insurers are beginning to exclude AI-related risks, why historical loss data no longer works in the age of AI, and how AIUC-1 was designed to become a trust and assurance framework for AI systems.
The conversation explores AI certification, AI insurance, agent security testing, reliability, safety, accountability, statistical risk modeling, and the growing challenge of securing increasingly autonomous systems.

Key Takeaways:
Traditional cyber insurance models are struggling to underwrite AI risk because historical loss data becomes obsolete as models rapidly evolve.
AIUC-1 combines governance controls, technical evaluations, and large-scale simulation testing to assess AI agent security and trustworthiness.
AI assurance requires more than security controls—it must also evaluate reliability, safety, accountability, privacy, and societal impact.
Statistical testing and large-scale simulations may become the foundation for measuring AI risk in probabilistic systems.
The AI security community will play a critical role in shaping standards, liability models, and best practices for future AI deployments.

What You’ll Learn:
Why many insurance carriers are beginning to exclude AI-generated risks from cyber policies
How AIUC-1 differs from frameworks like NIST AI RMF, OWASP LLM Top 10, and MITRE ATLAS
How AI agents are tested through both black-box and white-box security evaluations
Why reliability and hallucination risks become more important in multi-agent environments
How AI certification may influence future insurance pricing, risk management, and enterprise adoption

This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guests:
Rajiv Dattani | Cofounder | AIUC
David Meyer | GTM | AIUC
Connect on LinkedIn: https://www.linkedin.com/in/rajiv-dattani/
https://www.linkedin.com/in/david-meyer-8586b17b/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683

Apple Podcasts:
https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
39min
June 02, 2026Beyond Checkbox Compliance: Why GRC Must Become an Engineering Discipline ft Sheron Chakalakal, Head of GRC @ UiPath
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Sheron Chakalakal, Head of GRC at UiPath, to explore why the future of GRC looks far more like systems engineering than traditional audit management.
Drawing from his experience at Salesforce, Deloitte, and UiPath, Sheron explains why point-in-time audits and checkbox compliance are failing modern engineering organizations — and why risk-driven, continuously monitored GRC programs are becoming essential. The conversation dives into AI governance, continuous risk monitoring, customer assurance, GRC engineering, AIUC-1, and how security, compliance, and engineering teams must evolve together.
This episode reframes GRC as a technical reliability function that helps companies reduce operational risk continuously instead of simply passing audits once a year.

Key Takeaways:
Modern GRC programs must evolve from audit functions into engineering-driven reliability functions.
Risk—not compliance—should be the central language for communicating with leadership teams.
Continuous controls monitoring is essential because point-in-time audits create “checkbox theater.”
AI governance requires technical evaluations, agent testing, and continuous assurance beyond traditional frameworks.
Future GRC leaders will need technical depth, business context, and the ability to bridge engineering with executive leadership.

What You’ll Learn:
Why Sheron believes compliance should be designed into products from day one
How UiPath approaches continuous risk monitoring and GRC engineering
Why AIUC-1 introduces a fundamentally different approach to AI assurance
How GRC teams can become the “translation layer” between business and engineering
Why future GRC practitioners must develop technical and systems-thinking skills

This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Sheron Chakalakal | Head of GRC | UiPath
Connect on LinkedIn: https://www.linkedin.com/in/sheronpaulc/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683

Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
54min
May 05, 2026From Compliance Theater to GRC Infrastructure: Why AI Breaks Traditional GRC ft Jasmine Kaur, Principal of Security & Assurance Engineering @ CoreWeave
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Jasmine Kaur, Principal of Security & Assurance Engineering at CoreWeave, to explore how AI-native infrastructure is fundamentally reshaping GRC.
Drawing from her experience at companies like SAP, Google, and now an AI hyperscaler, Jasmine explains why traditional GRC models are failing in high-velocity, ephemeral environments—and what needs to replace them. From “GRC as infrastructure” to the rise of agentic GRC, this conversation dives into how compliance must evolve from a reactive audit function into a real-time assurance capability embedded directly into systems.
Key Takeaways:
Traditional GRC models break in AI environments because systems are ephemeral and disappear before audits can validate them.
Compliance should be treated as a byproduct of strong risk modeling and control design—not the end goal.
GRC must evolve into an infrastructure-level capability that continuously emits assurance signals.
Agentic GRC is the next evolution beyond automation and CCM, enabling decision-capable systems with human oversight.
Future GRC teams must operate more like engineering and reliability functions rather than audit teams.
What You’ll Learn:
Why AI infrastructure makes traditional audits ineffective
What “GRC as infrastructure” actually means in practice
How to move from point-in-time audits to continuous assurance
The difference between automation, CCM, and agentic GRC
How to position GRC as a proactive, business-critical function
This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Jasmine Kaur | Principal of Security & Assurance Engineering | CoreWeave
Connect on LinkedIn: https://www.linkedin.com/in/jask31/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683

Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
55min
April 21, 2026The GRC Illusion: Why Third-Party Risk Is Still Broken ft Val Dobrushkin, Director of GRC @ Tricentis
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Val Dobrushkin, Director of GRC at Tricentis, to challenge one of the most overlooked failures in modern security programs: third-party risk management. Drawing from his experience building GRC programs at ForgeRock, NoName Security, and beyond, Val explains why most organizations are still stuck in compliance theater and how GRC teams can evolve into true business enablers.
This conversation dives into the disconnect between frameworks and reality, the limits of SOC 2, the role of GRC in revenue and M&A outcomes, and why solving for today while building for the future is the key to long-term success.
Key Takeaways:
Third-party risk management is fundamentally broken due to over-reliance on questionnaires and weak enforcement of meaningful controls.
SOC 2 is too flexible and inconsistent to be relied on as a true indicator of security maturity.
GRC has a unique advantage over security in directly demonstrating business value and revenue impact.
“Solve for now, build for later” is critical for startups and fast-growing companies preparing for IPO or acquisition.
Strong GRC programs can directly influence company valuation by identifying contractual and compliance gaps early.
What You’ll Learn:
Why questionnaires and annual vendor reviews fail to capture real third-party risk
How GRC teams can prove revenue impact through customer trust and assurance
The hidden role of GRC in M&A, IPO readiness, and contract validation
Why most GRC metrics fail and what meaningful measurement should look like
How to implement a “solve now, build for future” strategy in fast-growing companies
This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Val Dobrushkin | Director of GRC | Tricentis
Connect on LinkedIn: https://www.linkedin.com/in/dobrushkin/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683
Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
56min
April 07, 2026GRC Is Broken... And Nobody Wants to Admit It ft Dylan O’Dell, AVP Information Risk Officer @ Manulife
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Dylan O’Dell, AVP Information Risk Officer at Manulife, to challenge one of the biggest assumptions in the industry: that GRC is working as intended. Dylan argues that most organizations are stuck in control-centric thinking and missing the true purpose of risk management — translating data into business decisions.
Drawing from his background in Lean Six Sigma and large-scale enterprise risk, Dylan breaks down why GRC needs to evolve beyond audits and control testing into automation, orchestration, and storytelling. This conversation explores how modern GRC teams can reduce operational friction, quantify real risk, and actually influence business outcomes.
Key Takeaways:
GRC today is overly focused on control testing rather than true risk management and decision-making.
Automation should eliminate manual audit friction — not just make existing processes faster.
The future GRC professional must combine technical awareness with storytelling, influence, and business understanding.
Risk management should be rooted in probability and financial impact — not pass/fail compliance.
GRC teams can unlock funding and influence by tying their work directly to revenue, cost savings, and business outcomes.
What You’ll Learn:
Why the “three lines of defense” model often breaks down in practice.
How to translate technical data into meaningful business risk narratives.
What modern GRC automation should actually look like (beyond tools).
How to position GRC as a revenue enabler — not just a cost center.
Why “start with why” is critical for influencing stakeholders and reducing friction.
This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence.
Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Dylan O’Dell | AVP Information Risk Officer | Manulife
Connect on LinkedIn: https://www.linkedin.com/in/dylan-odell-72a06412b/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683

Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
1h 8min
March 24, 2026Security Is a Human Problem, Not a Tool Problem ft Steven Asifo, Director of Security & GRC @ Yahoo
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Steven Asifo, Director of Security & GRC at Yahoo, for one of the most refreshing conversations the show has had on communication, influence, and the human side of security. Drawing on his unusual dual life as both a cybersecurity leader and a stand-up comedian, Steven makes the case that security and GRC are not just technical disciplines — they are fundamentally communication disciplines. From using analogies to explain vulnerabilities, to reframing GRC as the “Draymond Green” of cybersecurity, Steven shows how the best security leaders translate complexity into clarity, help the business make better decisions, and meet people where they are instead of overwhelming them with jargon.
Key Takeaways:
Security and GRC succeed when they communicate clearly to humans, not when they simply present more technical detail.
The best GRC teams act as guides that help the business make reasonable, compliant, cyber-conscious decisions.
Metrics only matter when they drive a clear outcome or decision, not when they exist for their own sake.
Strong GRC teams build trust by doing the hard, cross-functional work that others often avoid.
Storytelling is a core security skill because people act on messages they understand, remember, and relate to.
What You’ll Learn:
Why Steven believes security is ultimately a human communication problem.
How to tailor security messaging for engineering leaders, CISOs, and business stakeholders.
What “guardrails not gates” looks like in a practical GRC program.
How to think about data, metrics, and reporting without overwhelming your audience.
Why AI may change the consumption layer of GRC, but not eliminate the human need for storytelling.

This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Steven Asifo | Director of Security & GRC | Yahoo
Connect on LinkedIn: https://www.linkedin.com/in/asifosays/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683

Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
1h
March 10, 2026The 3 Year GRC Reckoning: Customer Trust, Real-Time Assurance, and the Future of Risk ft Bryan Culp, Senior Director of Customer Trust @ Box
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Bryan Culp, Senior Director of Customer Trust at Box, to explore how governance, risk, and compliance is evolving beyond certifications and into real-time trust.
Bryan shares why the next two to three years will fundamentally change how GRC operates — driven by automation, AI, large financial institutions demanding real-time internal metrics, and growing pressure to translate security posture into business language.
From managing both customer trust and third-party risk at Box, Bryan offers a rare dual perspective: how companies present assurance to customers while simultaneously evaluating vendors themselves. This conversation challenges the idea that certifications alone create security and makes the case for risk being the true language of leadership.

Key Takeaways:
Customer Trust is not traditional GRC — it translates security and compliance work into business confidence for customers.
Certifications enable market access, but they do not eliminate breach risk.
Risk must be communicated in executive language to influence real business decisions.
Large financial institutions are beginning to demand real-time internal security metrics instead of snapshot audits.
AI is transforming GRC workflows — not to cut people, but to enable deeper, higher-value analysis.
What You’ll Learn:
Why Bryan believes GRC will look materially different in the next 2–3 years.
How Customer Trust functions differently from compliance and audit teams.
Why certifications alone cannot prevent major security incidents.
What “real-time assurance” could look like for large SaaS companies.
How to think about AI and automation as long-term growth enablers in GRC.
This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Bryan Culp | Senior Director of Customer Trust | Box
Connect on LinkedIn: https://www.linkedin.com/in/bryanculp/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683
Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
1h 7min
February 24, 2026When GRC Stops Watching and Starts Working ft Ryan Schoeller, Director of Security & GRC @ Treasure Data
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Ryan Schoeller, Director of Security & GRC at Treasure Data, to challenge one of the most deeply rooted assumptions in the industry: that GRC should stay passive and “independent.” Drawing from his experience across startups, mid-market tech companies, and large enterprises, Ryan argues that the most effective GRC teams are the ones that actively participate in control monitoring, risk management, and operational decision-making. This conversation goes beyond audits and checklists, exploring how GRC can truly drive business value by protecting revenue, enabling growth, and embedding risk thinking into everyday operations.
Key Takeaways:
GRC delivers the most value when it actively participates in monitoring controls, not just validating them after the fact.
Risk is the most critical — and most neglected — pillar of GRC, often confused with gaps or vulnerabilities.
Strong relationships with engineering and business teams are essential for GRC to gain meaningful access to data.
GRC engineering is not just about writing code; it’s about applying an engineering mindset to workflows, tooling, and processes.
Automation alone is not a business case — value comes from how freed-up time is reinvested.
What You’ll Learn:
Why the “three lines of defense” model often breaks down in real organizations
How GRC teams can reduce compliance theater by becoming more operational
The difference between a vulnerability, a gap, and an actual risk
How to build a business case for GRC automation that leadership will support
Why front-ending GRC work (sales assurance, customer trust) often matters more than backend audit prep
This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Ryan Schoeller | Director of Security & GRC | Treasure Data
Connect on LinkedIn: https://www.linkedin.com/in/ryanschoeller/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683
Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
58min
February 10, 2026Does GRC Belongs Outside Security? The Case for an Independent Second Line ft Charles Nwatu - GRC Engineering Leader
What if GRC shouldn’t sit inside Security at all—and what if the bigger problem isn’t automation, but what you do after you automate? In this episode, Raj Krishnamurthy sits down with Charles Nwatu (former Security GRC Engineering & Assurance leader at Netflix) for a candid, systems-level conversation about why “annual audit rituals” fail modern engineering, how GRC can produce high-fidelity signals that strengthen security decision-making, and why the next wave of GRC engineering is about analytics, specifications, and business impact—not just speeding up evidence collection.
Key Takeaways:
GRC is a continuous discipline—point-in-time compliance can help, but it can’t be the end state.
Automation is necessary but not sufficient: the real value is in turning collected evidence into actionable insights.
Specifications enable measurement—without clear expected behaviors, security metrics become inconsistent and hard to compare.
GRC can feed security with high-fidelity signals (like identity/access review metadata) that improve posture beyond audit readiness.
Third-party risk doesn’t “finish”—the goal is visibility, data lineage awareness, and making the mess less messy.

What You’ll Learn:
Where Charles believes GRC should sit org-wise—and why Security should be a “customer” of GRC
What “shift-left GRC” looks like in practice (beyond annual audits)
Why “efficiency savings” don’t automatically equal “security value”
How to think about metrics, specifications, and risk in a shared language
Why third-party risk management is “unsolvable,” and how to build guardrails anyway

This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence.

Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Charles Nwatu | GRC Engineering Leader
Connect on LinkedIn: https://www.linkedin.com/in/cnwatu/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683
Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
1h 1min
January 27, 2026GRC Is an Engineering Discipline. Not a Checklist. ft Akhila Chitiprolu, Head of Security & GRC @ Sierra
GRC has long been seen as abstract, manual, and disconnected from how modern engineering teams actually work, but that narrative is breaking down. In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Akhila Chitiprolu, Head of Security & GRC at Sierra, to explore why GRC must be treated as an engineering discipline, not a compliance afterthought. Drawing from her experience across T-Mobile, Expedia, Stripe, and AI-native companies, Akhila explains how systems thinking, automation, and shared ownership can radically reduce compliance toil while increasing trust. This conversation goes deep into GRC engineering, audit realities, automation tradeoffs, and what the future of compliance looks like in an AI-driven world.

Key Takeaways:
GRC works best when treated as a system with inputs, processes, outputs, and feedback loops
Automation should focus on intent and outcomes, not blindly speeding up broken manual processes
GRC professionals act as a middleware layer between engineers, auditors, and customers
Not all controls should be automated — but 70% can be, with humans in the loop where it matters
The future of GRC depends on engineering mindset, context, and trust, not checklists
What You’ll Learn:
Why GRC is fundamentally a systems engineering problem
How to reduce engineering toil without weakening audit posture
When automation helps — and when it creates false efficiency
How GRC teams should approach AI, agents, and non-deterministic systems
Practical ways to build a GRC engineering function over time
This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Akhila Chitiprolu | Head of Security & GRC | Sierra
Connect on LinkedIn: https://www.linkedin.com/in/akhilachitiprolu/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:

Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683
Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
...more
55min

FAQs about Security & GRC Decoded:

How many episodes does Security & GRC Decoded have?

The podcast currently has 37 episodes available.