Modernizing Enterprise GRC for Continuous Assurance - with Craig Unger of Hyperproof

Daniel Faggella (0:12)

Welcome everyone to the Emerge AI in Business Podcast. Today's guest is Craig Unger, CEO and founder at Hyperproof. Hyperproof provides a unified platform for managing risk, compliance and security workflows across complex enterprises. Its software helps organizations stay ahead of regulatory change, quantify and connect risk to controls and maintain continuous assurance across business units, vendors and emerging AI driven operations. Craig explains why fast stop-start regulatory change is pushing enterprises to treat compliance as a continuous state rather than an annual audit and why risk and compliance teams can no longer operate in separate silos. He also discusses standardizing one set of controls across multiple frameworks connecting those controls to the organization's risk profile and expressing risk in download terms so boards can see how much risk each compliance activity reduces. Today's episode is sponsored by Hyperproof. In this episode, we cover why breaking down the silos between risk compliance and AI governance is essential. To go deeper on this topic and learn how leading organizations approach AI investments more like a venture portfolio and why interdisciplinary collaboration is critical to defining the right data for AI success, download our free PDF report Beginning with AI at emerge.com/aik1.

That's emerj.com/aik1 to download your copy. Now the conversation with Craig.

A very interesting conversation waiting for us and for our listeners. Something that we keep noticing, especially this year, is that the AI in Business Podcast is a podcast that is about the AI in Business Podcast is a podcast that is about the So, I think that's a really good thing to do, to be able to have a conversation with our listeners. Something that we keep noticing, especially this year, I think 2026 is definitely the year of all things changing, is that the rules also keep on changing, and they don't sit still. But as much as they're changing, they're also re-changing, if that's even a word. We've seen a big security rule for defense supplies being paused just before it was supposed to start. We've seen Europe push back its main AI deadlines by, what is it, almost a year. And at the same time, inside companies, there is this very different culture around risk compliance and AI, where everything is still in separate corners and not working together. So I guess that's where I want to start with all of this going on. What's creating the most friction points for GRC and risk leaders right now?

Craig Unger (2:43)

Gilad, I would say there are three main things that I would talk about with respect to that question. The first is absolutely the pace of regulatory change that's going on, and that's a phenomenon that's going on across the EU and the United States as well. In the EU, you have the AI Act, which is concerning itself with how you document your usage of AI, how you monitor to make sure the AI isn't suggesting things that we wouldn't want to happen to real people. How you manage the overall risk portfolio that is touched by the AI, being transparent and just overall oversight.

The Cyber Resilience Act is another one I would call out in the EU.

This is more on the manufacturing side, this is really around the first phase being exploited vulnerabilities need to be reported. That particular mandate has actually come into being and is enforceable on September of this year. So we're about a month into that right now. And then in about a year from now, there's a newer mandate around full application security, secure by design, a secure bill of materials, how you handle vulnerabilities, and that's going to be enforced by each of, I think, 12 member countries. And the penalties are pretty significant. It could be 15 million or as much as 2.5% of your global revenue or your global turnover. So those are a couple of examples. But those are just the most recent. I mean, even nine months ago, if you would have asked me this question, I would have talked to you about NIST 2

That came due October 2026, and that's really pretty pervasive in terms of a requirement across Europe that has to do with minimum risk management measures that you have to take. So risk analysis, how you handle incidents, and of course, a very large and increasing concern in the industry around third-party risk and security. So that would be your supply chain security. And it turns out that NIST 2 has to be enforced for organizations of 50 or more employees or organizations that have more than 10 million turnover, which is 100,000 different organizations. Quick note on DORA for resiliency. Maybe we'll talk more about that later. That's just the EU. And then in the US, you've got a whole set as well. The ones that I'll touch on here fairly quickly are the ones that are related to government. I think you touched on them before. But you look at like the CMMC, which is really a set of requirements around how security is handled for all suppliers to the Department of Defense, right? And there's a kind of progressive set of requirements and audit requirements that are being kind of re-looked at right now, which we'll touch on in a minute. But there's been a lot of effort already in the base of companies in the United States to meet CMMC.