The paperwork that runs security

GRC — Governance, Risk, Compliance — is how organisations decide what to protect, how much to spend, and whether they meet the law. It's not glamorous, but it's where budgets, scopes and careers are decided. A pentester who speaks GRC writes reports executives act on and lands better-paid, strategic roles.

Governance — who decides, who's accountable, the policies.
Risk — what could go wrong, how likely, how bad, what we do about it.
Compliance — meeting external rules (laws, standards, contracts).

🎯 Challenge (conceptual): Your pentest found an SQL injection exposing customer data. State it once as a technical finding and once as a risk a board would understand.

Show solution

Technical: "Unparameterised query in /login allows UNION-based SQLi, dumping the users table." Risk: "An attacker can steal all customer records, causing a GDPR-reportable breach with fines, legal costs and reputational damage — high likelihood, high impact." Same bug, board-level language.

Liked it? 5 more lessons are waiting.

6 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab

Unlock all courses · CHF 9/month Buy only this course · CHF 19

What's in GRC & Compliance

1. Why Hackers Should Care About GRCFree
2. Risk Management 101🔒 Risk
3. The Frameworks — ISO 27001, NIST, SOC 2🔒 Governance
4. Compliance — GDPR, PCI-DSS & Friends🔒 Compliance
5. Audits, Evidence & the Pentest’s Role🔒 Practice
6. Final — Think Like a Risk Owner🔒 Certification

Continue in the interactive course reader →

Why Hackers Should Care About GRC

The paperwork that runs security

Liked it? 5 more lessons are waiting.

What's in GRC & Compliance