"The GRC manager is not being replaced by AI. They are being replaced by the GRC manager who learned to use it." — Yair Kuznitsov, Co‑Founder & CEO, Anecdotes.
Yair Kuznitsov on the GRC skill shift
In a sponsored essay published on BleepingComputer, Yair Kuznitsov argues that the threat to governance, risk and compliance (GRC) jobs is not artificial intelligence itself but the failure to adapt to it. Kuznitsov, who co‑founded Anecdotes in 2020 and previously led R&D in the IDF’s 8200 unit and the Innovation Group at Intsight, frames the change as a structural shift: "AI agents are already doing the control testing, the evidence collection, and the framework mapping that used to fill a manager's week, and they get better at it every quarter."
Skill One — Context and data literacy
Kuznitsov puts data literacy first. He warns that agents produce "confident, well‑formatted nonsense" when fed poor sources — screenshots, stale exports, or hastily rebuilt spreadsheets — and that managers who cannot distinguish trustworthy feeds will be "blindsided by an agent's output in front of the board." To guard against that, he prescribes tracing control evidence back to its origin: "past the screenshot, down to the API or the configuration that produced it."
He describes the architecture he favors as "data‑first" — platforms like Anecdotes, he says, prioritize the data engine ahead of agents because "agents without trustworthy data are just fast mistakes." The practical upshot: a GRC manager need not become a data engineer, but must "become the person nobody can fool with a pretty dashboard."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSkill Two — Agent governance and measurable KPIs
The second pillar Kuznitsov identifies is governance. The old GRC role gathered evidence; the new role sets objectives, hard boundaries, and accountability for agents that act at machine speed. He draws a clear line between managers who perform tasks and managers who "run the workforce that does the task, and answers for every call it makes."
Before agents reach production, he advises, write down numeric definitions of success: the business outcome owned, the efficiency gained, cost reduction, the accuracy bar, and the escalation rate — "how often it is allowed to kick a decision back to you." Then "watch those KPIs like a manager, not a spectator." An unmanaged agent that drifts, escalates everything, or meets accuracy by doing less is a signal that governance is failing.
Skill Three — Communication, traceability, and runbooks
Finally, Kuznitsov elevates communication from soft skill to a control surface: if you "can't see what the agents do, you don't govern them. You hope." He recommends insisting that every agent interaction be visible and time‑stamped, and that handoffs between agents leave a trail humans can review and reverse.
Concretely, that means writing instructions so precise that an agent cannot "reasonably misread them" — runbook‑grade directions rather than email‑style notes — and demanding that every agent interaction land somewhere a human can see it. Where agents hand work to each other "with no human in between," he warns, a black box becomes a liability, not an automation win.
What this means for GRC managers, technologists, and procurement leaders
- GRC managers: Kuznitsov's prescription is direct — retrain on context, agent governance, and communication now, because "the agents are not slowing down and the budget pressure is not letting up." Your skillset, not your title, will determine whether you stay in the room when something breaks.
- Technologists and security teams: The task shifts toward building credible, traceable data pipelines: integrations, structured feeds, data quality and operations so that agents have trustworthy inputs rather than merely available ones.
- Procurement and enterprise buyers: Kuznitsov points to "enterprise platforms that actually hold up" as those built data‑first; Anecdotes is offered as an example. Buyers should expect vendor claims about agentic GRC to come with evidence of data provenance and governance tooling.
Conclusion — a concrete choice framed by the author
Kuznitsov's central argument is blunt and operational: the work of GRC is moving to AI agents, and the residual value will flow to people who can direct, govern and explain those agents. "The GRC manager is not being replaced by AI. They are being replaced by the GRC manager who learned to use it," he writes. His roadmap is narrow and actionable — learn to judge data, build and monitor agent KPIs, and force visibility into agent actions — and his timing is urgent: "start reskilling now, while the choice is still yours to make." For those responsible for controls, audits, and compliance programs, the decision he lays out is simple to state and harder to execute; it is a managerial talent problem as much as a technology one.
