Hey all,

hope this is okay to post here. I checked the rules beforehand, but if I overlooked something and research surveys aren’t allowed, apologies. I’ll happily remove it.

We’re a small early-stage team with a background in cybersecurity, currently doing research around ISO 27001 and the way GRC work actually happens inside companies.

Before making too many assumptions about what should be automated or improved, we’re trying to learn from people who actually deal with this stuff: Where does the work become painful? What takes way too much time? What is still highly manual? Where do existing tools or consultants help and where don’t they?

We made a short 8–10 minute survey covering the ISO 27001 process, risk management, documentation/evidence, audits, software/AI support and a few related topics.

If you work in GRC, security, ISMS, compliance, audit or ISO consulting, a few minutes of your experience would be a huge help to a young team like ours. We’re at a stage where good feedback can still genuinely change what we build.

And criticism is very welcome. We’d much rather hear “this isn’t a real problem” now than spend months building something nobody needs.

Survey: https://tally.so/r/b5RAro

Really appreciate anyone who takes the time — or passes it along to someone with relevant experience. Thanks!