Strategic Alliances: How GRC Teams Empower Offensive Security Efforts

Darryl MacLeod, a GRC adviser, argues that governance, risk and compliance teams can strengthen offensive security work well beyond their usual role of writing policy, assessing controls and tracking risk. He opens by contrasting the two disciplines: penetration testing and red teaming on one side, and regulatory alignment, risk management and policy development on the other. He frames GRC as a partner that helps organizations rather than a checklist-driven obstacle.

The middle of the talk walks through ways the two teams can cooperate. GRC can tie testing to frameworks such as PCI DSS and NIST 800-53, shape test scope around regulated data and high-value systems, and review penetration test reports for compliance gaps. Risk assessments can set priorities, and red team results can feed back into risk registers and policy updates. He also covers focusing testing effort on the highest-risk systems, shared metrics, cross-training through internal exercises, threat modeling with GRC data, and keeping a central repository of documentation that both groups can use.

He closes with practical steps: set joint goals, hold regular meetings, share tools and processes, and involve offensive security in tabletop exercises and incident response planning. The takeaway for practitioners is that continuous feedback between the two teams produces a more unified security posture and makes results easier to explain to executives.