GRC Games

Compliance Theater as a Stable Equilibrium

by Shimon|07 July 202605 August 2026|Control Systems & Failure Modes, GRC Games

The program was ready for audit. Policies were current, control narratives were aligned to frameworks, and evidence repositories were populated with screenshots, logs, and attestations. Control owners had completed their reviews, exceptions were documented, and the audit schedule had been...

Access Reviews as Cheap Talk

by Shimon|23 June 202625 June 2026|GRC Games, Identity Access & Trust Dynamics

The certification campaign closed on schedule. Managers had completed their access reviews, approvals were recorded, and the system reflected near-total compliance. Reports showed high completion rates, minimal overdue items, and a clean audit trail. From a governance perspective, the process...

Vulnerability SLAs as a Repeated Game

by Shimon|09 June 202609 June 2026|GRC Games, Operational Tradeoffs & System Constraints

The dashboard showed progress. Critical vulnerabilities were trending down, SLA adherence hovered in the low nineties, and weekly reports highlighted steady movement across teams. Tickets were created, owners were assigned, and remediation dates were tracked. From a governance standpoint, the...

The Risk Register Is Not a Document

by Shimon|26 May 202626 May 2026|GRC Games, Risk Systems & Decision Economics

By the time the quarterly risk review arrived, the register looked polished. Each entry had an owner, a score, a treatment status, and a target date. The color coding was clean, the categories were complete, and the summary slides translated...

Multi-Factor Authentication

by Shimon|12 May 202626 May 2026|Control Systems & Failure Modes, GRC Games

The organization had already implemented multi-factor authentication across its core systems, at least on paper. Engineering teams had integrated MFA into primary authentication flows, and audit reports reflected broad coverage across in-scope applications. From a distance, the control appeared complete....

Welcome to the Work: What This Site Is, and What It Isn’t

by Shimon|02 October 202522 May 2026|Data Protection Economics, GRC Economics, GRC Games

This site began with a simple goal: to give shape to the kinds of conversations that often unfold outside formal channels—after the meeting has ended, between functions navigating ambiguity, or once the audit has concluded but the discomfort still lingers....