The AI GRC (governance, risk, and compliance) market is growing 35–45% per year, and a significant share of services spend is going to specialist firms most people have never heard of:
Credo AI
Holistic AI
BABL AI
Saidot
Trustible
ModelOp
Sitting alongside the Accentures and IBMs you’d expect. In a market this young and this regulated, that specialist share shouldn’t exist. Fast-growing regulated markets normally consolidate quickly around incumbents who can indemnify enterprise buyers. This one hasn’t, and probably won’t for two or three more years.
We’ve all seen this pattern before.
nimble services specialists capture disproportionate share early
global firms — Accenture, IBM, Deloitte, EY — respond through acquisition and partnership
mid-tier providers struggle to fit their model to the new market
It happened when storage started exploding in the 2000s. At the beginning of the cloud expansion in the 2010s. Payments and the explosive growth of Apple Pay more recently.
What is the common thread?
Geoffrey Moore named this dynamic twenty years ago. “Strategy and Your Stronger Hand,” 2005 HBR. He posited a dichotomy between two fundamentally different business architectures — volume operations and complex systems.
Volume operations: millions of customers, tens or hundreds of transactions a year, a few dollars per transaction. Apple selling iPods is Moore’s example. Build it once, perfect the runbooks, sell millions.
Complex systems: thousands of customers, maybe a handful of transactions a year, six to eight figures per transaction. Boeing selling commercial airliners is another of Moore’s examples. Every engagement is bespoke. Every customer is its own market.
They’re fundamentally different operating models, and most firms can only win at one.
That’s the opportunity in AI GRC. It’s temporary, harder to capture than it looks, and structured to reward a very specific kind of firm.
Here’s the part most people miss.
In the markets I named — storage, cloud, payments — the specialist advantage eventually closed. The technology matured, the incumbents caught up, and the boutiques got bought or passed by. The window shut.
AI GRC isn’t maturing. The models, the regulations, the tooling — all of it keeps moving, with no sign of settling.
That changes the math.
When the ground keeps shifting, the advantage isn’t getting there first. It’s being built to move in sync. The firms that win aren’t the ones with the best methodology today. They’re the ones who can refresh faster than anyone can copy.
That’s the claim.
This series works out what that winning firm looks like, why the giants can’t easily morph into one, and why the mid-tier companies — Cognizant, TCS, Wipro — face a harder problem than either end of the market.
A note on disclosure: I worked at TCS for two years as a consultant. I was treated well. The analysis here is category-level, not company-specific, and applies equally to all mid-tier global SIs.
Where this goes
A few pieces are already taking shape behind this one:
the talent the work actually requires — and why no career path produces it yet
the regulatory ground, and why it won’t settle
the mid-tier’s deeper problem, of which AI GRC is only a symptom
a tactical play the incumbents can’t easily run
I’m publishing this first so you can see the shape of the argument before it’s all written. If one of these is the one you want next, tell me. That’s how I’ll decide what to write.