I ran security, GRC and IT at Decagon. This is where I write about it.
Decagon builds AI customer support for enterprise. I handled the enterprise-readiness side there: redlines, vendor reviews, audits, and the diligence that decides whether a young AI company gets to sell to a careful buyer.
Traditional GRC assumed controls and policies moved at human pace. That assumption is broken. This site documents how AI-native GRC operations actually work in production: coding agents, LLM-assisted audit prep, live deal flow, and contract negotiation.
By Ben Draffin · Director of Security, GRC and IT at Decagon
On a recent stretch of enterprise deals I was working on, the volume of redlines we were making to contracts started dropping. Customer counsel hadn't gotten easier; our engineering team had shippe...
Email when I publish. Deal patterns and tradeoff tables from enterprise security work, usually about once a week.
I post when I have something worth sharing from deals, audits, or vendor work during my time at Decagon.
What I've published lately.
GRC Certifications SOC 2 Strategy
Every security leader has seen the same slide: a maturity ladder with SOC 2, ISO 27001, PCI, FedRAMP, and half a dozen acronyms arranged in a sensible-looking order. Consultants sell the ladder. Fr...
GRC Policies Governance AI-native
Every GRC framework describes the same pyramid: policy sets intent, standards narrow it, procedures tell people what to do, and controls prove it happened. The model is sound. The cadence it assume...
GRC Contracts Enterprise security Negotiation
On a recent stretch of enterprise deals I was working on, the volume of redlines we were making to contracts started dropping. Customer counsel hadn't gotten easier; our engineering team had shippe...
GRC Vendor management Contracts Compliance
While your security team can spend a long time designing how to credibly answer an enterprise customer's questionnaire, someone else has probably already provided you a framework. Foundation-model ...
When I'm answering a security review for a large enterprise customer, the question isn't really *what does your policy say?* It's *what do your systems actually do, and can you show me?* That's whe...
Auditor interviews reward a simple outcome: a coherent story about how controls work, backed by evidence the auditor can actually follow. The interview itself usually isn't the hard part. The work ...
GRC Policies Controls Governance
Most governance writing describes a single direction: policy defines what should be true, standards narrow it, procedures operationalize it, and controls prove it. That's clean and useful, but for ...
We can't find the internet
Attempting to reconnect
Something went wrong!
Attempting to reconnect