Recent Breaches and the Evolving Role of GRC

by Kelvin Baez, Head of Cybersecurity Operations, Defensible Technology

Governance, risk, and compliance (GRC) is not the most exciting part of cybersecurity, but may be the most important.

We often see how a lack of a well-defined cybersecurity strategy leaves organizations vulnerable to devastating breaches and security incidents, as well as regulatory failures.

Such was the case with the ransomware attack on LoanDepot earlier this year, which exposed sensitive customer data and highlighted critical gaps in their risk management and compliance readiness.

In this post, I will go over exactly why GRC plays such a big role in the overall security posture of an organization and how the latest breaches are shaping how companies approach governance, risk management, and compliance to mitigate threats and avoid costly security failures.

Why GRC Matters

At its core, GRC is the foundation of a company’s ability to manage risks, meet regulatory demands, and support key business objectives and requirements. 

Imagine handling a data breach from a highly sophisticated threat actor without a strategy or policies to guide your response, risk assessment, and compliance obligations.

GRC matters because it enables businesses to:

• Anticipate and manage risks: Risk assessment is a major part of GRC. It guides many of the policies and processes designed to support the business, resulting in significant improvements in risk management.
• Maintain regulatory compliance: Your GRC efforts should align to meet relevant requirements, such as HIPAA for healthcare, GDPR, PCI DSS, etc.
• Protect financial and reputational health: GRC minimizes the risks of security breaches, improving the resilience of the company’s finances, reputation, and overall operations.

The Role of Recent Breaches in Shaping GRC

GRC is not a set-in-stone framework. The threat landscape, environment, and latest attacks greatly impact how it evolves to address emerging vulnerabilities and regulatory demands.

Recent high-profile breaches have demonstrated that organizations can no longer protect themselves using outdated governance and risk management practices. Instead, they must adjust their GRC strategies to remain adaptable and resilient.

Take, for example, the UnitedHealth Group ransomware attack earlier this year. With over 100 million records compromised, this breach exposed critical gaps in healthcare data management and reinforced the importance of stringent compliance with frameworks like HIPAA. The incident has driven a renewed focus on improving health sector GRC practices to safeguard sensitive patient information and mitigate operational disruptions.

Similarly, the National Public Data breach, which impacted 2.9 billion records, emphasized the risks associated with poor data aggregation practices. This massive breach has amplified calls for stronger risk management strategies and stricter enforcement of data privacy regulations to protect individuals' personal information.

These breaches are not isolated events. They reflect an evolving cyber threat landscape that directly influences GRC priorities. 

Regulators are responding by introducing stricter requirements, while businesses face growing pressure to adopt governance and compliance frameworks that proactively address these vulnerabilities.

For example, many U.S. states have upcoming laws enforcing tighter controls over how personal data is collected, processed, and stored (similar to GDPR in Europe).

How Can Organizations Adapt?

Organizations must learn from recent incidents and integrate lessons into their GRC programs to remain resilient. The main points of emphasis should be:

• An agile GRC framework that keeps pace with the changing threat landscape and regulatory environment. Policies should reflect the business's specific, current threats and follow the latest industry standards and best practices.
  
  
• Business continuity and incident response plans must be well defined so that a security or other IT incident has minimal impact on the core business operations. A data breach has the biggest impact when it significantly affects core business processes. The immediate costs (such as a ransom payment) are just the tip of the iceberg.
  
  
• Fostering a culture of security across the entire organization should be the end goal. UpGuard found that over 90% of security incidents are due to human error. Security awareness training should be a standard feature of every modern GRC program.

Optimize Your GRC Strategy With Defensible

At Defensible, we specialize in creating and enhancing security programs that are fully integrated with industry-standard frameworks and regulations. Whether starting from scratch or refining your existing GRC practices, we ensure that your organization remains secure, compliant, and resilient.

The rest of the team and I have extensive experience implementing the most widely recognized GRC frameworks and standards, including SOC 2, NIST, HIPAA, and ISO 27001.

Contact me today to learn how Defensible can help you build a resilient GRC strategy that protects against advanced threats and ensures compliance.