If there is one theme that has emerged from CoreStream GRC’s news and insights coverage throughout 2026, it’s this: Risk is becoming more interconnected, more technology-driven, and more business-critical than ever before.
As preparations begin for Risk Expo Europe 2026 and XapienXchange London 2026, many of the questions dominating boardrooms today are the same issues CoreStream GRC has been tracking throughout the year:
- AI-driven cyber threats
- Growing third-party dependencies
- Operational resilience
- Evolving regulatory expectations
- The increasing pressure to connect risk management directly to business outcomes
The result is growing pressure on risk, compliance, cybersecurity, and assurance teams to do more with less while continuing to support business growth.
At the same time, organizations are discovering that many of their biggest challenges are no longer isolated risks. Cybersecurity impacts operational resilience. Third-party risk influences compliance exposure. AI creates both opportunity and uncertainty. Decisions made in one area of the business can quickly create consequences elsewhere.
These themes sit at the heart of two upcoming industry panels featuring Paul Cadwallader, GRC Strategy Director at CoreStream GRC, at Risk Expo Europe 2026 and XapienXchange London 2026.
Drawing on more than 25 years of experience in governance, risk, compliance, controls, and assurance, Paul will explore how organizations can simplify complexity, strengthen decision-making, and create more value from their GRC programs.
Meet the panelist speaker: Paul Cadwallader, GRC Strategy Director at CoreStream GRC
Paul leads GRC strategy at CoreStream GRC, helping organizations transform governance, risk, compliance, controls, assurance, and operational resilience programs into measurable business value.
A former Deloitte Partner Paul works with organizations across multiple industries to simplify complexity, improve visibility, and strengthen decision-making.
His work has also helped shape one of CoreStream GRC’s most significant innovations: the integration of BRAVE’s Objectives@Risk methodology into the CoreStream GRC platform.
Rather than treating risk as a standalone exercise, Objectives@Risk enables organizations to understand how risks, controls, opportunities, and strategic objectives are connected. It provides leaders with a clearer view of the decisions that matter most and the factors that could impact business outcomes.
Because ultimately, GRC should not be about creating more reports.
It should be about helping organizations make better decisions.
What to expect from CoreStream GRC at Risk Expo Europe 2026
Event details
Event: Risk Expo Europe 2026
Date: November 10, 2026 (day 1)
Session: Cybersecurity Meets GRC: Aligning Security Controls with Enterprise Risk
Time: 10:00 AM – 10:30 AM
Stage: #RISK Stage
Why Risk Expo Europe 2026 matters for cyber and risk leaders
One of the clearest themes emerging from 2026 is that cybersecurity is no longer just an IT problem.
It’s a governance, resilience, and board-level business challenge.
Throughout the year, CoreStream GRC has explored how cyber incidents have evolved from isolated technical events into prolonged business crises affecting operations, supply chains, customers, reputation, and executive decision-making.
In our recent analysis of the latest cyber shocks affecting business leaders, we highlighted how cyber risk now flows across ecosystems rather than departments, making visibility and accountability critical to effective governance.
Meanwhile, our coverage of the Carnival data breach demonstrated a reality many organizations still struggle with: the human layer remains one of the most significant attack surfaces. The incident reinforced a fundamental lesson for risk leaders. Employee awareness matters, but resilience depends on governance, ownership, layered controls, effective escalation paths, and tested response plans.
At the same time, AI is accelerating both sides of the cybersecurity equation.
Over 2026, CoreStream GRC has tracked a growing consensus among governments, regulators, and technology providers that AI is making cyber threats faster, more scalable, and more sophisticated. As we explored in our analysis of AI-driven cyber risk, the issue is no longer whether AI will reshape cyber risk. It already is.
Regulators are paying attention too.
From the EU Cyber Resilience Act and NIS2 requirements to increasing expectations around cyber governance and operational resilience, organizations are being asked to demonstrate more than compliance. They must be able to prove ownership, accountability, evidence, and control effectiveness.
Read more:
From controls to outcomes: What organizations are still getting wrong
This is where many cyber programs continue to struggle.
- Organizations measure controls.
- Boards measure outcomes.
The gap between those 2 realities often creates a disconnect.
At Risk Expo Europe 2026, Paul will explore several key themes shaping the future of cyber governance.
The disconnect between risk registers and security controls
Many organizations can demonstrate control activity but struggle to show how those controls support business objectives.
Today’s boards are increasingly asking:
- Which risks threaten our strategic objectives?
- Which controls matter most?
- Where should we invest resources next?
- How do we prove value from our cyber investments?
Moving beyond compliance-driven cybersecurity
Passing audits does not automatically create resilience.
The latest Cyber Essentials updates demonstrate a clear regulatory trend. Organizations are expected to show controls are operating consistently in practice, not simply document that they exist.
This is where BRAVE’s Objectives@Risk methodology becomes particularly relevant.
Instead of asking:
“What security controls do we have?”
Organizations can ask:
“Which business objectives are most at risk, and what actions will have the greatest impact?”
This creates a far more meaningful conversation between cyber leaders, risk professionals, and boards.
What GRC professionals can learn at XapienXchange London 2026
Event details
Event: XapienXchange London 2026
Date: October 7, 2026
Location: IET London, Savoy Place
Panel: The future of workflow in the age of AI
How AI is transforming due diligence and third-party risk management
The next generation of AI-powered technologies has the potential to fundamentally transform how risk intelligence is gathered, assessed, monitored, and acted upon.
At XapienXchange London 2026, Paul will join fellow industry experts to discuss how organizations can move beyond automation and unlock genuinely transformational outcomes through AI.
Why organizations are rethinking due diligence
Several trends are driving this shift.
Increasing regulatory expectations
Governments and regulators globally are continuing to refine their approach to AI governance.
Organizations now need to consider explainability, accountability, transparency, data quality, and oversight alongside traditional compliance requirements.
Relevant reading:
Growing third-party ecosystems
Organizations depend on more suppliers, technology platforms, AI providers, and external services than ever before.
This creates significant dependency risks.
Recent discussions around AI vendor concentration demonstrate that organizations must understand not only the capabilities of technology providers but also the risks they introduce.
Relevant reading:
Faster business decision cycles
Business leaders need answers in hours, not weeks.Traditional due diligence approaches were never designed for the speed modern organizations require.
Demand for better risk intelligence
Organizations need more than information, context, trusted insight and earlier visibility of emerging threats and opportunities.
Topics expected to be explored include:
- AI augmentation versus replacement
- Human judgment in critical business decisions
- Governance and accountability
- Explainability and transparency
- Building trust in AI-enabled workflows
This is a topic that has repeatedly surfaced across CoreStream GRC’s discussions with risk, compliance, and governance leaders, including conversations on our Spotlight on Women in GRC series.
Because while AI may accelerate analysis, humans remain accountable for outcomes.
Bringing AI-powered due diligence into the GRC ecosystem
This is where the partnership between CoreStream GRC and Xapien becomes particularly relevant.
Risk intelligence only creates value when it drives action.
Organizations increasingly want:
- Faster onboarding
- Smarter third-party assessments
- Better visibility into emerging risks
- Reduced operational effort
- Stronger governance and auditability
- Better decision-making
By connecting external intelligence directly into governance, risk, compliance, and third-party risk workflows, organizations can reduce friction while improving oversight.
As both organizations share a common belief:
“AI should help organizations make better decisions, faster. It should never become another layer of complexity.”
The bigger picture: What these discussions mean for GRC leaders
Although the topics may appear different, both panels ultimately explore the same challenge: How do organizations make better decisions in an increasingly complex and interconnected world?
The answer increasingly comes down to four principles.
#1 Alignment
Connecting risk activities directly to business objectives and risk appetite.
#2 Visibility
Understanding how risks, controls, suppliers, obligations, incidents, and actions connect across the enterprise.
#3 Intelligence
Using technology to improve decision quality, not simply generate more data.
#4 Simplicity
Reducing complexity for the people responsible for managing risk every day.
Join the conversation
Cybersecurity, enterprise risk, AI governance, third-party risk, and due diligence are no longer separate conversations.
They are becoming part of a single discussion about organizational resilience, strategic decision-making, and business performance.
Aligned with Objectives@Risk and value-based GRC, the focus should not be on managing risks in isolation.
It should be on understanding how risks, controls, opportunities, and actions affect the objectives that matter most.
If you’re attending Risk Expo Europe 2026 or XapienXchange London 2026, join Paul Cadwallader and fellow industry leaders as they explore how organizations can build more connected, resilient, and outcome-focused GRC programs for the future.
Meet the CoreStream GRC team at Risk Expo Europe 2026 and XapienXchange London 2026.
Frequently asked questions
Risk Expo Europe 2026 is one of Europe’s leading events focused on risk management, governance, compliance, operational resilience, cybersecurity, and enterprise risk. The event brings together practitioners, technology leaders, and industry experts to discuss the challenges and opportunities shaping the future of risk.
Paul Cadwallader, GRC Strategy Director at CoreStream GRC, will join the panel discussion “Cybersecurity Meets GRC: Aligning Security Controls with Enterprise Risk” on September 10, 2026, from 10:00 AM to 10:30 AM on the #RISK Stage.
Modern cyber incidents impact business operations, customers, suppliers, regulatory obligations, reputation, and strategic objectives. As a result, boards and senior leaders increasingly view cyber risk as an enterprise governance challenge rather than purely a technical security issue.
XapienXchange London 2026 is Xapien’s flagship event, bringing together due diligence, compliance, risk, governance, and technology professionals to explore the future of risk intelligence, AI, and due diligence transformation.
AI-powered due diligence uses artificial intelligence to gather, analyze, monitor, and assess risk intelligence on organizations, individuals, suppliers, and third parties. It helps organizations improve efficiency, gain faster insights, and support more informed decision-making.
AI can help organizations identify emerging risks faster, automate intelligence gathering, monitor external changes continuously, and improve visibility into supplier relationships. At the same time, it introduces new challenges around governance, explainability, accountability, and vendor dependency.
Objectives@Risk is a methodology developed by BRAVE that helps organizations connect risks, opportunities, controls, and strategic objectives. It enables leaders to understand how uncertainty may affect business outcomes and where management attention will create the greatest value.
Value-based GRC focuses on enabling better business decisions and supporting organizational objectives rather than simply managing compliance activities. It emphasizes outcomes, accountability, visibility, and measurable business value.
CoreStream GRC provides an intuitive, flexible, no-code platform that helps organizations connect risks, controls, incidents, actions, suppliers, compliance obligations, evidence, and strategic objectives in one place. Through integrations such as its partnership with Xapien, organizations gain a more connected view of governance, risk, compliance, cybersecurity, and operational resilience.
