Onspring

Most AI governance conversations stop at the model. Onspring VP of Platform Ryan Lougheed argues insurers need to look one layer deeper. In his article for Digital Insurance, Ryan breaks down the AI agent harness layer, the architecture that controls what an agent is prompted to do, which tools it can touch, and what it shares with other agents. That layer, not the model, decides how much policyholder data is exposed and how many tokens get burned. Read the full article: https hubs.la/Q04Cbfgm0 #AIGovernance #Insurance #GRC #AgenticAI #onspring

The gap between AI adoption and return on investment is how you deploy it, not technology. In our latest report, we found that 43.7% of organizations don't see returns from their GRC AI investments because they skip critical foundations: standardized processes, high-quality data, connected systems and clear governance. We've created a framework based on how leading teams build the operational foundation required for AI ROI. If you're scaling GRC AI across your organization, this covers what actually moves the needle. Read the full blog: hubs.la/Q04rRVvK0 #GRC #AI #RiskAndCompliance #Governance #DigitalTransformation

Please join us in welcoming Stephen Vellanoweth to the Onspring team! Stephen joins Onspring as Director of Sales, Enterprise Southwest. He brings more than 15 years of enterprise technology sales experience. Stephen will work with enterprise organizations across the Southwest to build and scale their GRC programs on the Onspring platform. Welcome, Stephen. We are glad to have you on board. #Onspring #NewHire #Sales #GRC

Nearly half of GRC programs are still stuck in the AI pilot phase. The problem isn't the technology. It's fragmented data, unclear governance and pressure to prove ROI before the foundation is in place. So what are the 56.3% of organizations successfully scaling AI doing differently? They're building governance from the start, connecting their data and focusing on operational wins that matter to leadership. Read the blog to learn the practices helping GRC teams move from AI experiments to measurable results. ▶️ hubs.ly/Q04rKH0_0 #GRC #AI #Governance #Compliance #RiskManagement

Please join us in welcoming Jake Maggio to the Onspring team! Jake joins Onspring as Sales Director, Enterprise. He brings more than a decade of experience in safety, compliance, and risk management sales. Jake will work with enterprise organizations to build and scale their GRC programs on the Onspring platform. Welcome, Jake. We are glad to have you on board. #Onspring #NewHire #Sales #GRC

Please join us in welcoming Holly Tillett to the Onspring team! Holly joins our Professional Services team as a Consultant. She brings extensive experience implementing and leading Onspring engagements, and she will help our customers build and scale GRC programs on the Onspring platform. Welcome, Holly. We are glad to have you on board. #Onspring #NewHire #ProfessionalServices #GRC

SLED organizations manage critical services—student data, utilities, emergency response. A single vendor failure can take down operations. Yet most assess third-party risk with manual processes. NIST's Risk Management Framework centralizes vendor oversight and reduces downstream risk. Learn how to stop chasing compliance and start managing risk. Read the full blog▶️ hubs.la/Q04rsySg0 #ThirdPartyRisk #NIST #VendorManagement #CyberSecurity

Scattered evidence across siloed tools is why compliance teams panic before audits. Organizations that stay audit ready organize evidence from day one, not audit season. Build a compliance evidence management process that keeps your team confident and auditors satisfied. Read the full blog: hubs.la/Q04rvZn40 #ComplianceManagement #AuditReadiness #GRC #Governance

Proposed HIPAA Security Rule changes are reshaping healthcare compliance. The new amendments shift from periodic exercises to continuous operational discipline, requiring stronger controls, mandatory recurring audits, and documented proof that safeguards work. Key changes: encryption and MFA become required, vulnerability scanning every six months, and tighter business associate oversight. Read Ryan Redman's full analysis on what healthcare leaders need to know ▶️ hubs.la/Q04zdm_Q0 #HIPAA #HealthcareCompliance #Cybersecurity #GRC #HealthcareIT

Managing GDPR, HIPAA, PCI DSS, SOC 2, NIST CSF separately? That's duplicate work, inefficient audits, and compliance fatigue. Control mapping links controls to multiple frameworks at once— one assessment satisfies multiple obligations. Learn how to eliminate redundant testing and build a scalable compliance program. Read the full blog ➡️ hubs.la/Q04rvZyp0 #ComplianceManagement #ControlMapping #GRC #AuditReadiness

Last day to hit the jackpot of knowledge and connections! Don't miss the Innovation Showcase, final sessions, and tonight's one-of-a-kind experience at Sphere. Make it count. View the agenda: hubs.la/Q04zk7Rk0 #Connect2026 #OnspringConnect #LasVegas #GRC

Serge Stines takes the stage in just a few hours at InfoSec World (Tech Theater 1, 1:05 PM ET) to talk about strategies for successfully Integrating AI into your GRC program. If you're at the event, we'd love to see you there.  We'll be around all day. Stop by booth 616 to say hello! #InfoSecWorld #GRC #Compliance #Governance #Live

Security leaders present compelling data, yet struggle to secure executive buy-in. The gap isn't in the data. It's in the story. Executives think in business outcomes. Security teams think in risk. When those worlds don't connect, even the strongest business case falls flat. Discover how to translate security into business value. Read the full blog: hubs.la/Q04rs_4L0 #SecurityLeadership #ExecutiveAlignment #RiskCommunication #SecurityCulture

We're live at Onspring Connect 2026! Welcome to Vegas. Ready to learn, connect, and level up your GRC game? The agenda is packed. What's first on your list? View the agenda: hubs.la/Q04zk6Yt0 #Connect2026 #OnspringConnect #GRC #lasvegas

Security and compliance teams want the same thing-- a resilient, secure organization. So why do they so often work at cross-purposes? The gap is structural. Compliance prioritizes documentation and audit readiness. Security prioritizes speed and threat response. Add siloed tools, conflicting timelines and different languages, and you get duplicated workflows, coverage gaps, slower breach response and audit surprises. According to KPMG, only 26% of organizations have strong cross-functional collaboration between these teams. The path forward? Shared workflows, centralized data, integrated GRC technology and a culture of collaboration. We just published a detailed guide on exactly how GRC leaders can close this gap. Read the full blog ➡️ hubs.la/Q04pSXWV0 #GRC #GovernanceRiskCompliance #SecurityAlignment #RiskManagement #CyberSecurity

One week until Onspring Connect 2026 hits Las Vegas. Explore the agenda, and lock in your must-see sessions for high-stakes learning, real connections, and insights that move the needle. ➡️hubs.la/Q04zk5S10 #Connect2026 #OnspringConnect #LasVegas #GRC

Data silos are expensive. When compliance, risk and security teams work in disconnected systems, they duplicate effort, lose visibility into how risks connect across the organization and waste time reconciling conflicting records. Shared data breaks down departmental silos by centralizing GRC records, enabling real-time collaboration and automating manual work. Teams gain a holistic view of their risk posture and respond to regulatory changes faster. Read the full guide on shared data as the foundation of modern GRC: hubs.la/Q04pSQWY0 #GRC #ComplianceManagement #DataGovernance #RiskManagement #CyberSecurity

Join us at Infosec World. Registration closes September 4th. Don’t miss Serge Stine’s presentation on October 13th, “Successfully Integrating AI into Your GRC Program.” Lock in your spot, and save 20% with code ISW26-ONSPRING20. Register here: hubs.la/Q04wKZQ00 (hubs.la/Q04wKZQ00) #InfoSecWorld #GRC #Compliance #Governance

The Pentagon suspended CMMC Phase II third-party audits, but the baseline cybersecurity requirements are still in place. NIST 171 compliance isn't paused. Federal data protection isn't paused. What changed is the assessment method and timeline. During the next 60 days, the Department of Defense will review the program and issue recommendations. Organizations that use this time to strengthen their compliance programs, not pause them, will be ready for whatever comes next. Read the full blog on why your compliance program shouldn't hit pause just because Phase II did ➡️ hubs.la/Q04pSSkY0 #CMMCCompliance #DefenseContractors #Cybersecurity #Compliance #FederalData

Don't miss us! Onspring is at booth #1945 at EDUCAUSE 2026 in Denver at the Colorado Convention Center. Stop by to see live demos, speak with our team, and learn how higher ed leaders are transforming their GRC programs. We look forward to connecting with you. Register today: hubs.ly/Q04vYpJx0 #EDUCAUSE2026 #HigherEdTech #GRC #Onspring