AI Indexes
IT AI Index
September 2026 Edition, published September 17, 2026 · The permanent record of that edition, superseded since. The current standing is on the category page →
Index › Security operations › GRC › Enterprise › September 2026 Edition

GRC platforms for enterprise buyers

Asked as “GRC platform”, and as “governance, risk and compliance tool”, on behalf of an enterprise B2B company. 50 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing · first-choice share
24%
Contested · ServiceNow Integrated Risk Management 12%
24MetricStream12ServiceNow Integrated Risk Management08Vanta56others

24% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01MetricStream24%27%60criticized challenger
02ServiceNow Integrated Risk Management12%28%64criticized challenger
03Vanta8%23%26accepted challenger
04OneTrust GRC6%20%35accepted challenger
05Drata6%22%27accepted challenger
06AuditBoard2%4%23accepted challenger
07IBM OpenPages2%20%30accepted challenger
08Optro2%0%12accepted challenger
09LogicGate2%19%16accepted challenger
10Hyperproof2%10%10accepted challenger
11Archer2%43%51criticized challenger
Show the two products at 0%, ordered by negative rate
13SAP GRC0%50%10criticized challenger
12Diligent One0%0%11accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
All twenty-eight head-to-head pages: the top eight products, each against each

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
13
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01MetricStream24%
02ServiceNow Integrated Risk Management12%
03Vanta8%
04OneTrust GRC6%
05Drata6%
06AuditBoard2%
07IBM OpenPages2%
08Optro2%
09LogicGate2%
10Hyperproof2%
11Archer2%
12Diligent One0%
13SAP GRC0%

What they warned about

Three of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2 and GLM 4.7 FlashX changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Archer
43%
22 of 51 labels negative · 13 of 12 models · 2 hard negative
“**Who should avoid**: Any enterprise without a dedicated in-house Archer administration team and significant integration budget.” DeepSeek V4 Flash, negative prompt
MetricStream
27%
16 of 60 labels negative · 10 of 12 models · 4 hard negative
“Platforms to Avoid for Predictable Costs ... MetricStream | Per-user/module pricing | Unpredictable as user count grows” Kimi K2, budget prompt
ServiceNow Integrated Risk Management
28%
18 of 64 labels negative · 10 of 12 models · 2 hard negative
“**Avoid per-user pricing models** (ServiceNow, SAP) when scaling to thousands of users” Kimi K2, budget prompt
Drata
22%
6 of 27 labels negative · 6 of 12 models
“such as Vanta, Drata, Secureframe, Sprinto, and Thoropass, which are described as better for smaller or mid-market teams” Perplexity Sonar, negative prompt

What they cite

Citations exist only for the models that return a source list: fourteen of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

80 of 84 answers in this category came back with a source list, from 14 of 12 models: citations where the model returns them, or the search results it consulted. 1115 links across 235 sites, every framing counted. Ranked by the number of answers carrying the site or page.

vendor site · MetricStream44 answers · 49 citations · 13 models
vendor site · Vanta33 answers · 46 citations · 10 models
33 answers · 40 citations · 11 models
vendor site · ZenGRC28 answers · 43 citations · 9 models
vendor site · Enzuzo26 answers · 26 citations · 11 models
vendor site · RiskWatch25 answers · 30 citations · 8 models
vendor site · SureCloud22 answers · 34 citations · 9 models
vendor site · Cyber Sierra19 answers · 32 citations · 9 models
vendor site · ComplyJet19 answers · 19 citations · 11 models
19 answers · 19 citations · 9 models
18 answers · 20 citations · 9 models
18 answers · 19 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

Search against answers

Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best grc platform”, “grc platform”, “grc platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
Company and productsShareOwn site citedName searches, GoogleAI search demand, est.Organic visitsPaid search a month, est.Google ads, last 30 daysBest Google position
MetricStream metricstream.com
MetricStream 24%, MetricStream Connected GRC 2%, MetricStream GRC 2%
28%1741,0003594,301$21183
ServiceNow parent site
ServiceNow Integrated Risk Management 12%
12%190135,00013,451
Vanta vanta.com8%50040,5001,21972,260120
OneTrust onetrust.com
OneTrust GRC 6%
6%6314,80062454,294 company58
Drata drata.com6%3909,90025736,41354
ZenGRC zengrc.com6%62480429,6039
Riskonnect riskonnect.com4%492,9007655,995414
AuditBoard auditboard.com2%998,1002201290
IBM parent site
IBM OpenPages 2%
2%100201,00034,098
Optro optro.ai2%472,90039126,117$4,59975

Google's top ten for the three searches hold 20 sites; 2 of them are among the sites the models cited here (cybersierra.co, metricstream.com). The first result for “best grc platform” is reddit.com.

How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHide
ModelDirect“What is the best GRC platform for an enterprise B2B company?”Paraphrase“Which governance, risk and compliance tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade GRC platforms and how do they differ?”Budget-constrained“What is the best GRC platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a GRC platform. What should we look at?”Negative“Which GRC platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5Riskonnect
Five alternativesCentraleyes, Drata, IBM OpenPages, MetricStream, ServiceNow Integrated Risk Management
MetricStreamChanged
Three alternativesArcher, IBM OpenPages, ServiceNow Integrated Risk Management
no first choice
Five alternativesDrata, LogicGate, MetricStream, SureCloud, Vanta
against: Riskonnect
Cyber Sierra
One alternativeLogicGate
against: MetricStream
no first choiceagainst: Archer, MetricStream, OneTrust GRC, SAP GRC
GPT-5.4 miniMetricStream, ServiceNow Integrated Risk Management
Two alternativesAuditBoard, LogicGate
ServiceNow Integrated Risk ManagementChanged
Four alternativesAuditBoard, MetricStream, Optro, Workiva
ServiceNow Integrated Risk Management
Five alternativesDiligent One, IBM OpenPages, MetricStream, OneTrust GRC, Riskonnect
against: Archer
Hyperproof
Four alternativesArcher, IBM OpenPages, RSA, ServiceNow Integrated Risk Management
no first choicenothing named
Gemini 3.5 FlashOptro
Four alternativesDrata, MetricStream, ServiceNow Integrated Risk Management, Vanta
Drata, VantaChanged
Five alternativesAuditBoard, Diligent One, MetricStream, OneTrust GRC, ServiceNow Integrated Risk Management
Optro
Three alternativesDiligent One, LogicGate Risk Cloud, MetricStream
against: Archer, ServiceNow Integrated Risk Management
ZenGRC
Four alternativesArcher, Centraleyes, LogicGate Risk Cloud, Workiva
Drata, Vanta
Three alternativesAuditBoard, LogicGate, ServiceNow Integrated Risk Management
against: Archer, Drata, IBM OpenPages, Jira, MetricStream, Secureframe, ServiceNow Integrated Risk Management, SharePoint, Sprinto, Vanta
Perplexity SonarRiskonnect
Five alternativesDrata, MetricStream, Secureframe, ServiceNow Integrated Risk Management, Vanta
against: Archer
MetricStreamChanged
Two alternativesIBM OpenPages, ServiceNow Integrated Risk Management
against: Archer, AuditBoard
IBM OpenPages, MetricStream
Six alternativesArcher, AuditBoard, LogicGate, Resolver, SAP GRC, ServiceNow Integrated Risk Management
ComplyJet
Two alternativesIBM OpenPages, MetricStream
against: ServiceNow Integrated Risk Management
no first choiceagainst: Archer, Drata, IBM OpenPages, MetricStream, SAP GRC, Secureframe, ServiceNow Integrated Risk Management, Sprinto, Thoropass, Vanta
Grok 4.20MetricStream
Four alternativesArcher, IBM OpenPages, LogicGate Risk Cloud, OneTrust GRC
MetricStreamHeld
Four alternativesArcher, AuditBoard, IBM OpenPages, ServiceNow Integrated Risk Management
MetricStream
Five alternativesArcher, AuditBoard, IBM OpenPages, OneTrust GRC, ServiceNow Integrated Risk Management
Archer
One alternativeServiceNow Integrated Risk Management
against: LogicGate, MetricStream, OneTrust GRC
no first choice
Four alternativesDrata, Hyperproof, OneTrust GRC, ServiceNow Integrated Risk Management
against: Archer, Drata, MetricStream, ServiceNow Integrated Risk Management, Vanta
Mistral SmallMetricStream Connected GRC, OneTrust GRC
Two alternativesDrata, ServiceNow Integrated Risk Management
MetricStreamChanged
Three alternativesOrbiq, RSA, ServiceNow Integrated Risk Management
no first choiceagainst: ArcherServiceNow Integrated Risk Management
Two alternativesArcher, MetricStream
ServiceNow Integrated Risk Management
Five alternativesArcher, Diligent One, IBM OpenPages, MetricStream, OneTrust GRC
against: Archer, Drata, MetricStream, Scrut Automation, Scytale, Secureframe, ServiceNow Integrated Risk Management, Sprinto, Thoropass, UpGuard, Vanta
DeepSeek V4 FlashAuditBoard, OneTrust GRC
Six alternativesDiligent One, Drata, IBM OpenPages, MetricStream, ServiceNow Integrated Risk Management, Vanta
MetricStreamChanged
Two alternativesArcher Integrated Risk Management, IBM OpenPages
against: ServiceNow Integrated Risk Management
MetricStream
Five alternativesAuditBoard, LogicManager, OneTrust GRC, Riskonnect, ServiceNow Integrated Risk Management
against: Archer
Onspring
One alternativeSmartSuite
against: Archer, MetricStream, OneTrust GRC, ServiceNow Integrated Risk Management
no first choice
Five alternativesDrata, Hyperproof, Secureframe, ServiceNow Integrated Risk Management, Vanta
against: Archer, IBM OpenPages, MetricStream
against: Archer, IBM OpenPages, MetricStream, ServiceNow Integrated Risk Management, UpGuard
Llama 4 Maverickno first choiceMetricStream GRCChanged
Two alternativesIBM OpenPages, Orbiq
no first choiceno first choiceno first choicenothing named
Qwen 3.7 FlashMetricStream
Four alternativesDrata, OneTrust GRC, ServiceNow Integrated Risk Management, Vanta
MetricStreamHeld
Two alternativesArcher, ServiceNow Integrated Risk Management
MetricStream, Optro
Four alternativesArcher, LogicGate, OneTrust GRC, ServiceNow Integrated Risk Management
Eramba
One alternativeSimpleRisk
against: LogicGate, OneTrust GRC, ServiceNow Integrated Risk Management
Drata, Vanta
Three alternativesSecureframe, Sprinto, Whistic
against: Archer, LogicManager
against: Appian, Kissflow, Mendix, OneTrust GRC, Oracle E-GRC, SAP GRC, ServiceNow Integrated Risk Management, Wolters Kluwer
Kimi K2IBM OpenPages
Two alternativesOneTrust GRC, ServiceNow Integrated Risk Management
MetricStreamChanged
Two alternativesArcher, ServiceNow Integrated Risk Management
MetricStream
Six alternativesArcher, AuditBoard, LogicGate Risk Cloud, OneTrust GRC, SAI360, ServiceNow Integrated Risk Management
6clicks
One alternativeCyber Sierra
against: Archer, MetricStream, SAP GRC, ServiceNow Integrated Risk Management
no first choice
Five alternativesAuditBoard, Drata, Hyperproof, OneTrust GRC, ServiceNow Integrated Risk Management
against: Archer, ServiceNow Integrated Risk Management
GLM 4.7 FlashXMetricStream, OneTrust GRC
Three alternativesAuditBoard, Mitratech Alyne, ServiceNow Integrated Risk Management
ServiceNow Integrated Risk ManagementChanged
Three alternativesArcher, IBM OpenPages, MetricStream
MetricStream
Six alternativesAuditBoard, Drata, OneTrust GRC, ServiceNow Integrated Risk Management, SureCloud, Vanta
LogicGate, ZenGRC
One alternativeServiceNow Integrated Risk Management
against: Archer
no first choicenothing named
MiniMax M2.5no first choiceno first choiceHeldArcher
Three alternativesIBM OpenPages, MetricStream, ServiceNow Integrated Risk Management
CoreStream GRC, ZenGRC
Two alternativesEramba, OpenGRC
against: Archer, IBM OpenPages, MetricStream, ServiceNow Integrated Risk Management
no first choiceagainst: Archer, MetricStream, ServiceNow Integrated Risk Management
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-10-01 08:24yes98 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-01 09:48yes56 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-10-01 11:21yes1122 s
Direct recommendationPerplexity Sonarsonar2026-10-01 12:07yes236 s
Direct recommendationGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex2026-10-01 12:39yes249 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-10-01 13:39yes118 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-01 10:40yes2327 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-01 12:52yes54 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-01 13:47yes837 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-10-01 08:28yes1522 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-01 08:12yes1596 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-01 09:50yes720 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-10-01 08:57yes98 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-01 13:45yes65 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-10-01 09:35yes718 s
ParaphrasePerplexity Sonarsonar2026-10-01 09:03yes244 s
ParaphraseGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex2026-10-01 10:41yes226 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-10-01 10:52yes53 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-01 09:03yes2520 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-01 12:46yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-01 12:26yes933 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-10-01 08:32yes2021 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-01 12:42yes15165 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-01 11:53yes527 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-10-01 13:45yes108 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-01 11:48yes810 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-10-01 13:38yes1228 s
ComparativePerplexity Sonarsonar2026-10-01 13:22yes195 s
ComparativeGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex2026-10-01 07:51yes2011 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-10-01 07:27yes139 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-01 09:04yes2436 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-01 13:06yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-01 13:22yes1595 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-10-01 07:52yes1526 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-01 11:38yes2333 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-01 11:34yes2027 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-10-01 12:46yes168 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-01 11:46yes35 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-10-01 12:44yes1827 s
Budget constrainedPerplexity Sonarsonar2026-10-01 10:31yes203 s
Budget constrainedGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex2026-10-01 11:22yes199 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-10-01 10:31yes53 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-01 08:47yes2429 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-01 09:06yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-01 13:18yes1058 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-10-01 11:25yes2229 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-01 10:25yes2281 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-01 10:21yes1944 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-10-01 10:32yes1812 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-01 09:02no07 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-10-01 09:15yes1030 s
Scale constrainedPerplexity Sonarsonar2026-10-01 09:21yes247 s
Scale constrainedGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex2026-10-01 10:57yes1310 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-10-01 13:24no09 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-01 12:59yes2360 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-01 13:34yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-01 07:55no037 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-10-01 11:08yes1416 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-01 08:01yes1523 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-01 13:35yes513 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-10-01 07:28yes1510 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-01 08:53yes56 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-10-01 13:14yes2631 s
Negative framingPerplexity Sonarsonar2026-10-01 09:02yes203 s
Negative framingGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex2026-10-01 08:23yes228 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-10-01 12:18yes55 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-01 10:08yes2441 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-01 11:25yes51 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-01 12:23no039 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-10-01 10:26yes2519 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-01 08:23yes2170 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-01 07:28yes1836 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

ShowHide
Category-scoped readings
Diligent read as Diligent One
Diligent (Diligent One Platform) read as Diligent One
IBM read as IBM OpenPages
Mitratech read as Mitratech Alyne
OneTrust read as OneTrust GRC
SAP read as SAP GRC
ServiceNow read as ServiceNow Integrated Risk Management
Unresolved, counted raw
Archer Integrated Risk Management (RSA)
Cybersierra
Mendix
MetricStream Connected GRC
Oracle E-GRC
Sayari
ServiceNow Governance, Risk and Compliance / Integrated Risk Management
ServiceNow Integrated Risk Management - IRM, formerly ServiceNow GRC
Wolters Kluwer (CaseWare)
Discontinued, still offered
No shut-down product was recommended here.
← XDRInsider risk →