GRC Uncensored is an experimental podcast designed to elevate real conversations with GRC professionals, auditors, regulators, and those building programs around it. Your hosts are Troy Fine and Elliot Volkman.
Hosted on Acast. See acast.com/privacy (https://acast.com/privacy) for more information.
The Pentagon just slammed the brakes on CMMC Phase II
Phase II was supposed to begin November 10, 2026 and would have required many contractors handling CUI to obtain third-party CMMC assessments before contract award. Instead, DoD suspended the rollout, paused future implementation milestones, and launched a 60-day review. For now, Phase I self-assessments remain in force. The response window closes mid August (https://sam.gov/workspace/contract/opp/89ef9bfb0834473791e991c712698d94/view).
Hosted on Acast. See acast.com/privacy (https://acast.com/privacy) for more information.
31 Dec 2025
AMA: GRC, SOC 2, and the State of Audits
It’s the last day of 2025, which means it’s time to wrap season one. When Troy and I piloted this series, we didn’t expect thousands of you to tune in, and certainly didn’t expect to pickup the wonderfully smart Kendra to join our crew.
With that, we want to thank you for encouraging us to keep this series going. We’ll be back for season 2 soon, and are taking in new pitches for episodes now. To wrap the year, we conducted a AMA on the current state of GRC. We pulled questions from Reddit (https://old.reddit.com/r/cybersecurity/comments/1ppqcwg/ama_about_the_current_state_of_grc_conversation/) and LinkedIn (https://www.linkedin.com/posts/elliotv_join-troy-fine-and-kendra-cooley-of-grc-uncensored-activity-7407434398687703041-xrHw?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJkq7oB5vp964tKu45smLzBSwV9ZnBhRPA) and tackled them live in conversation.
What we covered
Are we “anti–GRC automation tools”?
Short answer: no. Long answer: automation isn’t the problem. It’s misuse, blind trust, and compromised audit integrity are.
Cheap SOC 2s and bundled audits
Why budget startups often don’t have a real incentive to avoid low-cost, bundled auditors, and what you give up when you go that route.
SOC 2 pentesting vs PCI DSS
Why SOC 2 allows weak or missing pentests, why PCI doesn’t, and how automated scans differ from real manual testing.
Conflicts of interest in the GRC ecosystem
Platforms, auditors, and vCISOs all partner, so where does objectivity break down, and is it even possible to keep it clean?
Who’s really at fault: tools or auditors?
A blunt discussion on incentives, accountability, and why low-quality audits keep winning.
Offshoring and the race to the bottom
When cost-cutting leads to offshoring, what should clients actually be worried about and what’s just noise.
The future of audits and AI
Will AI replace auditors? Where automation helps, where humans still matter, and what happens if we stop caring about independent assurance altogether.
Hosted on Acast. See acast.com/privacy (https://acast.com/privacy) for more information.
20 Nov 2025
Do Ethical GRC auditors really exist?
In this episode, the crew digs into a messy but necessary topic: what does ethical auditing even mean in a market overrun with automation shortcuts, low-effort SOC 2 audits, and firms that self-declare “quality” without proving it?
With Troy actively auditing today and Kendra working with auditors in real time, the team breaks down where rigor actually shows up, where the system is broken, and why SOC 2’s value is slipping as fast as demand for speed is rising.
03:00 – “Quality theater” and firms self-labeling as high quality
04:10 – Who defines quality—auditors or customers?
05:00 – The four-hour SOC 2 audit example
06:00 – The danger of “better than the worst” logic
07:00 – What thorough auditing actually looks like (Kendra’s experience)
09:30 – SOC 2 inconsistency across auditors and firms
11:00 – Should audit firms be objectively measured?
15:00 – Kendra’s “secret shopper auditor” idea
19:20 – Automation platforms producing shallow “green checkmark” results
22:00 – Drive-by auditors rubber-stamping automated data
26:00 – Peer review and “enhanced oversight” gaps
33:00 – Why the industry isn’t incentivized to fix the quality problem
39:00 – Ethical auditors exist—but the system doesn’t reward them
Hosted on Acast. See acast.com/privacy (https://acast.com/privacy) for more information.
Who has been a guest on GRC Uncensored
Names identified in recent episode analyses. Showing up to five guests.
Richa
Shruti Mukherjee
Pete Strouse
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
YouTube views
868
Score snapshot 15 Sept 2025
Apple Podcasts (US)
4.0 / 5
7 ratings
Spotify
5.0 / 5
2 ratings
Podcast Authority Score: 38 / 100
A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.
Quality
36
Social presence
0
YouTube
66
Engagement
32
Host of GRC Uncensored?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
