AV CEO Spotlight: Redefining the GRC Function

Security Awareness Training was built for compliance, not resilience, and attackers were exploiting gaps that legacy models could not cover. GRC (Governance, Risk, and Compliance) leaders were being asked to prove real risk reduction, not just training completion.

Dune Security and Alumni Ventures hosted a virtual conversation featuring Dune Security CEO David Dellapelle, along with Meghan Hunt from The University of Vermont Health Network, Jake Wesenberg from Koch, and Sam Pena from Tetra Tech, focused on why traditional Security Awareness Training falls short and how GRC teams can close the gap between compliance activity and resilience.

The session explored how attackers bypass standard training, what user layer risk looks like today, how GRC leaders can shift toward a risk-based strategy, and which metrics truly demonstrate readiness to executives and regulators.