Malt Tech Trends 2026
Deep-dive Cybersecurity

Today, over half of cybersecurity projects concern Governance, Regulation and Compliance (GRC), showing organizations are investing heavily in cybersecurity governance frameworks and risk assessment programs.

The latter represent 20% of overall cybersecurity projects, usually triggered by regulations, certification projects or previous security incidents and require specific methodological expertises (EBIOS, MEHARI, ISO 27005, OCTAVE). 

The characteristics of GRC projects highly depend on the nature of the client companies, with large enterprises running complex, multi-faceted GRC programs, and mid-market companies seeking to enhance their existing security programs (ISO certification projects, GDPR gap analysis…). 

The significant growth in GRC demand — +31% ISO-27001, +229% ISO 7816, coupled with slower growth in the number of freelancers, has led to strong market tension and a scarcity of talent in the cybersecurity domain, and more specifically in GRC.

The rise of AI is forcing a rapid evolution of both the discipline and the required profiles. 

As an example, AI is introducing entirely new compliance obligations with the EU AI Act creating a new compliance system alongside traditional frameworks, requiring GRC professionals to master AI-specific concepts like high-risk system classification, algorithmic transparency, fundamental rights impact assessments, and model governance that didn't exist in their traditional ISO 27001 or GDPR toolkit.