Why Security Testers Should Care About GRC

The paperwork that runs security

GRC — Governance, Risk, Compliance — is how organisations decide what to protect, how much to spend, and whether they meet the law. It's not glamorous, but it's where budgets, scopes and careers are decided. A security tester who speaks GRC writes reports that executives understand and act on.

• Governance — who decides, who's accountable, the policies.
• Risk — what could go wrong, how likely, how bad, what we do about it.
• Compliance — meeting external rules (laws, standards, contracts).

Solution (try the challenge first)

Technical: "Unparameterised query in /login allows UNION-based SQLi, dumping the users table." Risk: "An attacker can steal all customer records, causing a GDPR-reportable breach with fines, legal costs and reputational damage — high likelihood, high impact." Same bug, board-level language.