AI
Why Manual GRC Fails at Scale
Organizations with 25,000 to 50,000 employees can throw people at compliance. Most startups cannot. Traditional GRC relies on static products and cyclical audits. Teams scramble every March or April to collect evidence. That creates chaos and eats engineering bandwidth. Spreadsheets with version control issues are still the norm. Rosenlieb called it “spreadsheet hell.” One more column will not save anyone.
Three Open Source Tools for GRC Engineering
Rosenlieb walked through three examples. First, the AWS audit playbook by AJ Den uses Python and Boto3 to gather evidence from S3, RDS, IAM, and CloudTrail. It saves output to JSON. Second, Open Policy Agent (OPA) with Gatekeeper enforces policies in Kubernetes and Terraform. It assigns risk scores to changes and can auto-fail anything touching IAM. Third, an AI coding GRC plugin by Mario Lenado acts as a virtual GRC analyst. It references 72 files across 15 frameworks including NIST, SOC 2, and GDPR. It answers questions, reviews documents, and generates tabletop exercises.
Connecting the Loop: Automated Evidence and Policy Enforcement
Rosenlieb tied the three tools into a single process. A pull request removes a password policy. OPA fails the change because it touches IAM. That triggers the AWS script to snapshot the current configuration. The AI plugin reviews the failure against ISO 27001 and FedRAMP moderate. It recommends blocking the change. A human reviews the ticket, approves the fix, and the AWS script runs again to confirm the policy is restored. The loop generates continuous evidence and a paper trail. Most steps are automatic.
Making GRC a Business Enabler
GRC engineering requires a DevOps mentality, not waterfall. Start with easy checks like encryption at rest or logging. Plan for iteration, not perfection. Align with developers, engineers, and project managers as customers, not just auditors. Reduce friction during audit periods. Quick wins include automated user access reviews, configuration checks, and feeding data into trust centers. The NIST FedRAMP 20x initiative aims to automate 80% of FedRAMP. Start now even if auditors still want spreadsheets. AI agents can convert JSON into PDFs later.
Q&A
Can OPA integrate with an existing risk management framework to auto-approve low-risk changes? Yes, OPA can assign weights based on risk appetite and auto-approve routine changes without human intervention. ▶ 26:04
What are the key steps to implement AI agent audits? Start with evidence collection and use the virtual GRC analyst to map evidence to frameworks. It can handle manual reading and copying, but still needs human review to catch hallucinations. ▶ 27:33
How do you automate user access reviews with GRC engineering? Use role-based access control and programmatically detect changes during onboarding, offboarding, or team moves. The tool highlights what changed so reviewers only check the delta. ▶ 29:19
Notable Quotes
one more column will save us Branden Rosenlieb · ▶ 4:08
it would kind of create this virtual GRC analyst Branden Rosenlieb · ▶ 14:45
the goal for that initiative is to automate about 80% of Fed Ramp Branden Rosenlieb · ▶ 24:06
continuous evidence collection, the continuous analysis, continuously comparing things and analyzing it against your policies is what differentiates yourself between checkbox compliance Branden Rosenlieb · ▶ 24:33
Key Takeaways
- Manual GRC processes cannot scale; automation is required for continuous readiness.
- Three open source tools (AWS audit playbook, OPA, AI GRC plugin) can be combined into a single automated loop.
- Start with easy wins and plan for iteration; auditors will catch up to JSON-based evidence.