Engineering our way out of tool fatigue, together

Security teams today are not short on tools. They are drowning in them. Across many organisations, practitioners and leaders continue to add tools in response to new threats, audit findings, and vendor promises. Over time this creates crowded tool stacks, fragmented data, inconsistent coverage, and limited confidence that risk is genuinely being managed. 

Even when tools come from the same vendor, teams often face duplicated effort, control gaps, and a growing disconnect between what governance documentation claims and what systems actually enforce. What if we slowed down and took a different approach? 

This session challenges the assumption that more tools are the solution and instead explores how GRC Engineering can be applied as an innovative, engineering-led approach to restore clarity, reduce busy work, and create real security value. Rather than treating governance, risk, and compliance as static artefacts or compliance checkpoints, GRC Engineering applies systems thinking, automation, and design principles to build workflows that continuously answer meaningful risk questions. 

Peter will share a practical methodology developed through a combination of academic work and real-world application, demonstrating how common frustrations such as manual reviews, opaque coverage, and reactive assurance can be transformed into contextualised, risk-based, and automated outcomes using existing platforms. 

Examples will be drawn from approaches applied to modern security tools and traditional platforms, showing how best-practice guidance can be operationalised without adding new tools or increasing operational load. 

The session is aimed squarely at security practitioners, engineers, and architects who want to innovate within constrained environments, while also offering leaders insight into how creating space for engineering-led approaches enables teams to focus on what matters most. Improving both operational effectiveness and long-term cyber resilience, together