Michael Rasmussen is a governance, risk, and compliance (GRC) analyst and commentator. Through GRC 20/20 Research, Rasmussen helps organizations assess GRC technologies and professional services, and writes and speaks about connecting risk, resilience, and AI governance to business decisions.
Buying a platform or completing an audit does not make evidence easy to find.
A pre-launch assessment cannot show what an AI agent is doing while operating.
A red heatmap square cannot tell a business what to do next.
Check first: Confirm format, price, availability, audience data, and commercial scope in writing.
Main ideas
AI governance has to run continuously, not at periodic checkpoints · "Responsible AI" needs evidence behind the adjective · Risk numbers should persuade decisions, not color heatmaps
Michael Rasmussen is a GRC analyst and commentator whose work connects governance, risk, resilience, and AI to business decisions.
Across posts about AI assurance, risk quantification, and GRC strategy, they keep returning to a practical question: what evidence or insight would help an organization decide what to do?
The posts also point to GRC 20/20 Research, GRC Insights, and two podcasts associated with this work.
Ask for the full scope and history of those channels.
Rasmussen makes abstract GRC arguments concrete by naming the gap between activity and useful decisions.
In a post about AI assurance, they argue that buying a platform or completing an audit does not necessarily make evidence easy to find, and that a pre-launch assessment cannot show what an AI agent is doing while it operates.
In their Konnect 2026 notes, they explain why a red heatmap square may attract attention but cannot tell a business what to do next; risk quantification matters when it informs investment, mitigation, or resilience.
Their strategy commentary applies the same test to GRC technology: more features are not the goal if they do not help organizations act around their objectives.
Follow this work for analysis that challenges checklists and product claims by asking whether governance improves evidence, accountability, and decisions.
Their posts show this approach in short-form commentary and describe related talks and editorial channels.
Ask for the full talks, articles, or podcast episodes.
Michael Rasmussen writes as a GRC analyst working through GRC 20/20 Research, briefing technology vendors, appearing at risk conferences, and curating a monthly commentary newsletter.
Read more
Across the five posts reviewed here, a consistent set of arguments emerges: AI governance should be continuous rather than periodic because AI changes while it runs; assurance claims should rest on evidence tied to business events, not assertion; risk should be expressed in numbers that support investment and mitigation decisions, not heatmap cells; and the real difficulty is understanding how risks interact and keeping governance focused on the objectives that matter most.
AI governance has to run continuously, not at periodic checkpoints
Rasmussen argues that AI changes between reviews, so governance limited to periodic assessments leaves the important part uncovered.
Read more
Governance should be ongoing, with visibility into what a system is doing while it runs.
In the GRC Insights newsletter, their contribution is titled "Governing AI Between the Checkpoints," arguing that because AI changes continuously, governance has to as well.
The same idea appears in a vendor briefing on AI assurance.
In a briefing with vendor lextrace, Rasmussen distinguishes a snapshot assessment from understanding what an AI agent is doing as it operates. They compare the two to aviation: a preflight checklist matters, but it is not quite the same as knowing what the autopilot is doing halfway to Jupiter.
"Responsible AI" needs evidence behind the adjective
Rasmussen argues that assurance should start with evidence and attach to business events, not checklist completion.
Read more
Their briefing notes describe a customer reality: finishing an audit or buying a platform does not automatically make the next piece of evidence easy to find.
The opportunity, they say, is to make that work manageable rather than give the same scavenger hunt a new interface.
Assurance questions start with business triggers such as a product launch, a significant change, or entering another market, then ask what an organization must demonstrate to move forward with confidence.
They put it sharply: "Trust me, I'm responsible AI" is not an assurance strategy.
The lextrace briefing covers three linked ideas: gathering scattered evidence, connecting assurance to business triggers, and keeping pace with AI agents as they take on more work. It also contrasts a snapshot with continuous understanding of agent behavior.
Risk numbers should persuade decisions, not color heatmaps
Rasmussen argues that risk quantification should express uncertainty in terms that support decisions about investment, mitigation, and resilience, rather than use visual scales that prompt attention without direction.
Read more
Protection matters, but the business case cannot end at "nothing terrible happened." The same thinking informs how they describe AI: the useful question is not whether AI can analyze more information, but whether that analysis changes decisions and delivers measurable value.
At Riskonnect's Konnect 2026 conference they gave a talk titled "Numbers that Persuade: The Case for Risk Quantification," and described the failure mode directly: a red heatmap cell might get attention, but it does not by itself tell the business what to do next.
AI needs context, clear authority, and human judgment
In a strategy briefing, Rasmussen argues that AI in risk and compliance needs meaningful context, clear authority, and human judgment—and that speed does not fix a bad process.
Read more
Their formulation: making a broken process faster does not make it better.
The wider argument is about orchestration: a trusted system of record connected to systems of intelligence, action, and configuration, allowing an organization to sense, interpret, respond, and adapt around its business objectives rather than document yesterday's uncertainty.
They also raise digital twins as a way to test scenarios and alternative paths to resilience.
The briefing lays out what they call GRC 7.0, or "GRC Orchestrate," and shifts the executive conversation from feature lists to outcomes. That includes how AI-assisted development might change build-versus-buy decisions and what differentiates a provider when features are easy to reproduce.
At Konnect 2026, Rasmussen makes the same point in business terms: the interesting question is not whether AI can analyze more information, but whether that intelligence changes decisions and delivers measurable value.
Reading survey data from a risk conference, Rasmussen argues that the hard part is no longer seeing individual risks but understanding how they combine and what that means for objectives, decisions, and resource allocation.
Read more
Threats are converging rather than queuing up as independent entries on a heatmap. They are listening for how organizations connect AI governance, cyber resilience, geopolitical disruption, and third- and Nth-party exposure to the way resources are actually allocated.
The figures they relay from Riskonnect's 2026 New Generation of Risk Report: economic risk and cybersecurity were each cited by 55% of risk leaders as a top threat; political instability ranked in the top three; and worst-case scenario planning recorded its first year-over-year decline. They also flag that 74% of organizations use AI in their risk programs, while only 17% feel very prepared to govern that risk.
Governance should be about objectives, and about the risks already in the room
Rasmussen curates other GRC voices in the GRC Insights newsletter, and several arguments in this edition are distinct from their own.
Read more
They review Tim Leech's book Mission-Critical Governance, making the case that GRC must move beyond inventories of risks, controls, policies, and assessments to focus on the objectives that matter most.
Renee Murphy argues that organizations keep stumbling over risks that are visible and knowable rather than rare.
Tim Leech argues that the World Economic Forum's risk outlook to 2035 is missing a critical transformation.
Norman J Levine argues that treating AI agents like employees before accountability and oversight have caught up is a governance failure waiting to happen.
Rasmussen presents these contributors' positions alongside their own.
Rasmussen's own piece in the same edition, "Governing AI Between the Checkpoints," is the argument that appears most consistently across the material reviewed here, alongside the guest contributions.
This edition shows Rasmussen in two roles: an author advancing their own AI governance argument and a curator assembling other analysts' positions on governance, risk, and AI.
The briefing shows how Rasmussen works with a vendor: they test the claim, separate evidence from assertion, and ask what assurance must become once AI agents do the work.
Read more
Start here for their method on AI governance, not just their opinion.
In an early briefing with the lextrace team, Rasmussen discusses evidence, AI governance, and tying assurance to business needs.
Their framing is blunt: "Trust me, I'm responsible AI" is not an assurance strategy.
They draw out two practical points.
First, the evidence problem is mundane — completing an audit or buying a platform does not make the next piece of evidence easy to find, so the opportunity is to make that work manageable rather than "give the scavenger hunt a new interface."
Second, they distinguish a snapshot assessment from knowing what an agent is doing while it operates: a preflight checklist is not the same as knowing what the autopilot is doing halfway to Jupiter.
They also note that assurance questions start with business triggers — a product launch, a major change, entering a market — before they become checklists.
For brands planning a campaign
The posts make the clearest case for a gap a GRC software vendor could build a webinar around: continuous, evidence-backed governance rather than periodic review. Rasmussen can lead a session on assurance for AI agents because they state the problem in operational terms — what must an organization be able to demonstrate, and where is the evidence? — questions risk and audit buyers recognize.
This is the most direct view of how Rasmussen turns risk quantification into a talk.
Read more
Read it first to judge whether they can hold a stage and make a technical argument land with a business audience.
Reporting from Riskonnect's Konnect 2026 in Denver, Rasmussen describes the opening — CMO Andrea Brody introducing in costume and CEO Jim Wetekamp's session "Unstoppable: Risk Supercharged" — then sets out their two talks: "AI and Risk & Resilience: Your Supercharged Advantage" and "Numbers that Persuade: The Case for Risk Quantification."
They argue that risk and resilience should strengthen decisions and enable performance, not just defend, and that "the business case cannot end at 'nothing terrible happened.'" On quantification, they pinpoint the failure mode: "A red heatmap cell might get attention.
It does not, by itself, tell the business what to do next."
They also say the useful question about AI is not whether it can analyze more information, but whether it changes decisions and delivers measurable value.
For brands planning a campaign
The quantification argument is close to a ready-made webinar spine, and the post shows Rasmussen already presenting it at a vendor conference, alongside podcast recording and customer conversations. A GRC software company could book them for a session that ties quantification to investment, mitigation, and resilience decisions rather than dashboard features.
Here, Rasmussen turns survey findings into an argument a buyer can act on — converging threats, AI use outpacing governance confidence, and scenario planning in decline.
Read more
Read it for the data points and their interpretation.
From day two of Konnect 2026, Rasmussen relays findings from Riskonnect's 2026 New Generation of Risk Report: economic risk has caught cybersecurity as a top threat, both cited by 55% of risk leaders, with political instability now in the top three; 74% of organizations use AI in their risk programs while only 17% feel very prepared to govern that risk; and worst-case scenario planning recorded its first year-over-year decline.
They read the numbers as converged rather than independent: "These are not independent entries waiting patiently for their turn on a heatmap."
They say they are listening for how organizations connect AI governance, cyber resilience, geopolitical disruption, and third- and Nth-party exposure to objectives, decisions, and resource allocation.
Their conclusion: the challenge is not seeing more risks but understanding how they interact.
For brands planning a campaign
For a webinar brief on AI governance, the 74% versus 17% split is a usable opening statistic, and Rasmussen supplies the interpretation that makes it a governance argument rather than a scare line. The post also positions them as someone who works from report data and executive conversations at a risk-technology conference, a fit for sponsors seeking credible third-party framing.
The post shows what Rasmussen does beyond commenting: a risk-technology company brings them in as an outside analyst to test its strategy.
Read more
Read it to see how they discuss AI, orchestration, and build-versus-buy with a vendor's executive team.
Rasmussen describes joining the Battleground executive team's annual strategic planning day in Australia by video call, presenting an outside-in analyst perspective that connected market direction, client needs, and technology change to the company's strategic choices.
They lay out three shifts.
From records to orchestration: GRC 7.0 — "GRC Orchestrate" — as a system of record connected to systems of intelligence, action, and configuration, helping organizations sense, interpret, respond, and adapt around business objectives.
From impressive answers to governed action: AI needs meaningful context, clear authority, and human judgment, and "making a broken process faster does not make it better," with digital twins raised for scenario analysis.
From features to outcomes: the executive discussion turned to build-versus-buy and what differentiates a provider when features are easy to reproduce, returning to practitioner experience rather than more software.
For brands planning a campaign
The post shows Rasmussen holding a strategy-level conversation with a vendor's leadership, not just delivering a keynote — useful for campaigns involving an executive roundtable or analyst-style session. Their framing of governed action and orchestration maps directly onto agentic AI governance, and the build-versus-buy question is a strong prompt for a webinar on where GRC platforms add durable value.
The post shows the wider editorial channel Rasmussen runs or contributes to and names the ideas they are promoting.
Read more
Read it to see the range of voices they curate and where their own argument sits among them.
This post introduces an edition of GRC Insights, a curated round-up of commentary from GRC voices.
The topics include Michael Rasmussen's review of Tim Leech's book Mission-Critical Governance, on why GRC has to move beyond inventories of risks, controls, policies, and assessments toward the objectives that matter most; Renee Murphy on why obvious risks still destroy organizations; Tim Leech on a transformation missing from the World Economic Forum's risk outlook to 2035; Norman J Levine on treating AI agents like employees before governance and accountability catch up; and Rasmussen's own piece, "Governing AI Between the Checkpoints," arguing that AI changes continuously, so governance has to operate continuously rather than at periodic reviews.
The post also points to episodes of the Risk Is Our Business Podcast and the Hitchhiker's Guide to the GRC Technology Galaxy Podcast, and to discussions with Optro and RegScale.
For brands planning a campaign
The newsletter and podcast references suggest a multi-channel audience a sponsor could reach, and Rasmussen's "governing AI between the checkpoints" line pairs naturally with the assurance argument in the lextrace post. Before building a proposal around them, ask for the podcast and article formats and audience figures; the post does not provide them.
Continuous AI governance, not checkpoint compliance4
Keynotes, podcasts, briefings, and curated commentary3
Outside-in analyst perspective for executive decisions2
Assurance starts with evidence, not adjectives1
Risk quantification that persuades decision-makers1
From GRC records to GRC orchestration1
Converging risks and the interaction problem1
Mission-critical governance and the risks already in the room1
Continuous AI governance, not checkpoint compliance
Rasmussen treats AI governance as an operating discipline rather than a periodic review.
Read more
In the GRC Insights roundup, the argument is that AI changes continuously, so governance has to operate continuously too.
In the lextrace briefing, that theme appears in the difference between a preflight checklist and knowing what an autopilot is doing mid-flight: a snapshot assessment is not the same as understanding what an AI agent is doing as it operates.
The Konnect 2026 report discussion adds a practical gap: 74% of organizations use AI in risk programs, but only 17% feel very prepared to govern that risk.
Uses flight and science-fiction analogies to make governance points concrete and memorable.
For brands planning a campaign
For a thought-leadership webinar on AI governance, avoid a generic “responsible AI” session.
Build the conversation around continuous evidence, agent behavior, authority, and oversight.
The distinction between checkpoints and operations gives the webinar a concrete frame that a GRC software audience can map to product capabilities.
Rasmussen describes how completing an audit or buying a platform does not automatically make the next piece of evidence easy to find; the opportunity is to make that work manageable, not give a scavenger hunt a new interface.
They connect assurance to business triggers such as launching a product, making a significant change, or entering another market.
The key question is what an organization must demonstrate to move forward with confidence.
Frames assurance around the business questions an organization must answer before moving forward, not checklist completion.
For brands planning a campaign
Position a GRC or assurance product as the layer that connects business triggers to assurance workflows and evidence. Open with the audit-scavenger-hunt problem and show how evidence supports “responsible AI” claims.
Risk quantification that persuades decision-makers
At Konnect 2026, Rasmussen describes a keynote on “Numbers that Persuade: The Case for Risk Quantification.”
Read more
The argument is to move beyond colored squares and express uncertainty in terms that support decisions about investment, mitigation, and resilience. A red heatmap cell can get attention, but it does not tell the business what to do next.
For brands planning a campaign
A webinar on risk quantification should demonstrate decision-support numbers, not heatmap migration. Use the heatmap critique as a contrast and ask speakers to show how quantification changes an investment or mitigation choice.
In the Battleground strategic planning briefing, Rasmussen presents GRC 7.0 — GRC Orchestrate: a trusted system of record connected to systems of intelligence, action, and configuration.
Read more
The opportunity is to help organizations sense, interpret, respond, and adapt around business objectives instead of documenting yesterday’s uncertainty.
The briefing also argues that AI needs meaningful context, clear authority, and human judgment, and that making a broken process faster does not make it better.
The discussion covers digital twins for scenario analysis and a shift from features to outcomes.
For brands planning a campaign
For a product-oriented webinar, frame the platform as an orchestration layer tied to business objectives. Include AI context, authority, and human judgment as governance requirements, and use outcome-based examples rather than feature lists.
The Konnect 2026 Day 2 post reports findings from Riskonnect’s 2026 New Generation of Risk Report: economic risk and cybersecurity are each cited by 55% of risk leaders as a top threat, political instability is in the top three, and worst-case scenario planning recorded its first year-over-year decline.
Read more
Rasmussen says the challenge is not seeing more risks but understanding how AI governance, cyber resilience, geopolitical disruption, and third- and Nth-party exposure interact—and what that means for objectives, decisions, and resource allocation.
Combines report data with event-listening questions to shift the discussion from risk inventory to risk interaction.
For brands planning a campaign
Use the convergence finding in a webinar or roundtable to move beyond siloed risk registers. Ask Rasmussen to link AI governance, cyber, geopolitical, and third-party exposure, and show how resource allocation changes when risks are treated as interacting rather than independent.
Mission-critical governance and the risks already in the room
The GRC Insights roundup reviews Tim Leech’s book Mission-Critical Governance.
Read more
Its argument is that GRC ultimately has to move beyond inventories of risks, controls, policies, and assessments to focus on the objectives that matter most. The same edition covers Renee Murphy’s challenge to Black Swan fascination and the visible, knowable risks organizations still stumble over, as well as Tim Leech’s view that the World Economic Forum’s risk outlook is missing a fifth transformation.
For brands planning a campaign
Consider an objective-centric GRC theme that contrasts long risk inventories with the mission-critical few. The Gray Rhino angle offers a second hook: obvious risks that are visible but ignored.
Outside-in analyst perspective for executive decisions
Rasmussen describes joining Battleground’s annual strategic planning day remotely from Phoenix to present an objective, outside-in analyst perspective.
Read more
The session connected market direction, client needs, and technology change with the strategic choices facing a risk and resilience provider.
It focused on what changes, what endures, and where value comes from.
Similar formats appear at Konnect 2026, where Rasmussen keynotes, records podcast conversations, and listens to customer and prospect realities.
For brands planning a campaign
Book Rasmussen for an executive workshop or fireside that challenges roadmap assumptions rather than a standard product demo. Use the outside-in framing to test build-versus-buy, differentiation, and practitioner-experience questions.
Keynotes, podcasts, briefings, and curated commentary
The posts show a working mix of formats: conference keynotes and panel sessions, podcast recording, executive strategy briefing, vendor product briefing, and the GRC Insights newsletter.
Read more
GRC Insights curates other leading GRC voices, including book reviews and expert commentary, around a monthly theme. Rasmussen's posts also point readers to GRC 20/20 Research, GRC Report, and the Risk Is Our Business and Hitchhiker's Guide to the GRC Technology Galaxy podcasts.
The posts here are not the full articles, podcast episodes, or book contents they describe.
For brands planning a campaign
Plan more than a guest article: combine a keynote or fireside, a podcast interview, and a newsletter or briefing contribution. The curated commentary format also offers the option of a sponsored edition or expert roundup.
Rasmussen's posts show two kinds of brand connection: the GRC 20/20 Research outlet that carries their commentary, newsletter, and podcasts, and analyst or speaking engagements with GRC technology vendors.
Read more
Ask whether vendor relationships involve sponsorship, affiliate arrangements, or investments.
GRC 20/20 Research
Disclosed partnership
Rasmussen's commentary, the monthly GRC Insights newsletter, and the Risk Is Our Business and Hitchhiker's Guide to the GRC Technology Galaxy podcasts are published under the GRC 20/20 Research name.
Read more
Each post closes by pointing readers to "Ask GRC 20/20 Research," described as mapping GRC technologies and professional services for organizations. Ask whether Rasmussen owns the firm or is employed by it.
Rasmussen describes an initial briefing with the lextrace team on its developing approach to gathering scattered information, AI governance, and connecting assurance work to business triggers such as product launches or market entry.
Read more
They say they look forward to following the team's progress.
Rasmussen joined Battleground's executive team for its annual strategic planning day in Australia, presenting remotely from Phoenix on GRC in the age of AI, GRC 7.0 orchestration, and governed action for AI agents.
Read more
They frame the session as an outside-in analyst perspective building on ongoing strategy discussions and conversations with Battleground clients.
Rasmussen keynoted Riskonnect's Konnect 2026 conference in Denver, with sessions on AI, risk, and resilience and on risk quantification, and recorded podcast conversations with Riskonnect customers and prospects between sessions.
Read more
They also reported the conference's 2026 New Generation of Risk Report findings on converging threats and AI governance confidence.
Michael Rasmussen is worth exploring for an analyst's running commentary on governance, risk, and compliance rather than a how-to feed.
Read more
Start with the posts where the argument does the work: the lextrace briefing on evidence and AI assurance, the Battleground strategy session on GRC orchestration, and the two Konnect 2026 dispatches on risk quantification and converging risk.
Together, they show a pattern: vendor and executive briefings first, conference reporting second, and the GRC Insights newsletter third, where their argument about governing AI between checkpoints sits alongside guest contributions from other analysts.
Keep the voices separate: the newsletter gathers other people's positions, while their own piece is the one to track for changes in thinking.
For the subject rather than the person, the two Konnect posts and the AI governance posts are where the repeatable ideas live; the conference posts show which questions they bring to a room.
AI governanceGovernance, risk, and complianceRisk quantificationOperational resilienceAssurance and evidenceThird-party and Nth-party riskCyber riskRisk technology market analysisRisk quantification methodsAnalyst briefings and strategy sessionsConference keynotes and panelsPodcast conversationsCurated newsletter commentaryGRC and risk practitionersRisk and compliance technology vendorsCompliance and audit leaders
Waseem Samaan, CPA, CIA
Samaan works across audit, risk, governance, and controls, arguing that AI, cybersecurity, third-party risk, and regulatory change are reshaping assurance.
Read more
In a post marking Internal Audit Awareness Month, they describe a shift from pure assurance toward helping organizations build trust, navigate risk, and connect risk to strategy — close to Rasmussen's view that governance should serve objectives rather than accumulate inventories.
Samaan writes as a practitioner and professional-body leader, drawing on board service with the Austin chapter of the Institute of Internal Auditors and conference attendance.
Their posts focus on profession advocacy and conference takeaways, not vendor briefings or an analyst framework.
Readers seeking market-level analysis and continuous-governance arguments may find Rasmussen more directly on that ground; Samaan is closer to day-to-day audit and controls practice.
Mand covers AI governance and compliance as rules lag adoption, the same tension Rasmussen identifies.
Read more
In an article discussion with a CIO, Mand argues that organizations cannot wait for perfect clarity and need governance frameworks flexible enough to adapt — a view that parallels Rasmussen's checkpoint-versus-continuous argument. Both also use interview or briefing formats rather than relying only on short commentary.
Mand interviews executives and writes up their perspectives, with a side interest in data architecture as a precondition for AI success.
Rasmussen takes more of an analyst's role, briefing and curating: supplying the frame, the market read, and the newsletter roundup.
Readers who prefer first-person executive case detail may favor Mand; those who want the structuring argument may prefer Rasmussen.
Brooks argues for continuous verification over static checklists, asking who owned the risk, which safeguards failed, and what evidence supported confidence — the same evidence-and-accountability line Rasmussen takes on assurance and AI governance.
Read more
Their Pentagon breach posts ground the argument in a single concrete failure and ask whether controls are implemented correctly and can be proven.
Brooks writes from cybersecurity assessment and military experience, focusing on one discipline and the risks of treating assessments as paperwork.
Rasmussen ranges across the GRC market, AI governance, quantification, and vendor strategy, typically framing the discussion around business objectives and technology choices.
Readers seeking security-assessment specifics will get more from Brooks.
Michael Rasmussen’s posts make them a potentially relevant voice for a GRC software company’s AI governance and risk-quantification webinar.
Read more
They discuss AI assurance, accountable use of AI agents, and using risk analysis to inform business decisions. Before choosing a sponsored placement, request recent audience data and results for comparable GRC and AI-governance content, including professional-role or audience-survey information.
No public partnership or sponsorship program, rate card, media kit, or application route for Michael Rasmussen or GRC 20/20 Research appears in the posts, so format, price, and availability remain unconfirmed.
Read more
The posts show how they work with GRC technology and services vendors: taking an analyst briefing with a vendor team (lextrace), bringing an outside-in analyst perspective to a vendor's annual executive strategy day in Australia (Battleground), delivering conference keynotes and recording podcast conversations at a vendor event (Riskonnect's Konnect 2026 in Denver), and publishing commentary that ties that market contact back to business decisions.
The posts do not say whether these engagements are paid, sponsored, or open to inbound requests.
A GRC software company proposing a thought-leadership webinar should ask directly about scope, deliverables, exclusivity, rights, timing, and fee; the posts do not support quoting a specific package.
A campaign for a GRC or risk-technology software company sponsoring a thought-leadership webinar on AI governance and risk quantification fits, with Rasmussen as the outside analyst rather than a product presenter.
Read more
Decision: book the session, but define the commercial scope in writing first.
Rasmussen’s posts support the pairing on three counts.
First, they argue the exact problem a GRC vendor sells against.
In the briefing with the lextrace team, they describe “Trust me, I'm responsible AI” as an inadequate assurance strategy and distinguish a preflight checklist from knowing what an agent is doing mid-flight: a snapshot assessment is not the same as governing an agent as it operates.
The GRC Insights edition makes the same point in its title: AI changes continuously, so governance has to operate continuously rather than at periodic checkpoints.
Second, Rasmussen can reach a decision-level audience.
At Riskonnect's Konnect 2026, they keynoted on AI, risk and resilience and presented “Numbers that Persuade: The Case for Risk Quantification,” arguing that a red heatmap cell gets attention but does not tell the business what to do next.
They also turn survey data into an argument, citing that 74% of organizations use AI in risk programs while only 17% feel very prepared to govern that risk, rather than leaving the numbers as a scare line.
Third, the formats match.
Rasmussen briefs vendor teams, joins executive strategy sessions such as Battleground's annual planning day as an outside-in analyst, speaks at vendor conferences, records podcast conversations, and produces a curated commentary newsletter.
A sponsor-hosted webinar fits the work they already do.
Build the session around Rasmussen’s strengths: testing a claim and reframing it in business terms, not narrating a feature set.
Give them a real customer situation and a business decision — a product launch, a market entry, a material change — and let the discussion start with what an organization must be able to demonstrate.
That is where the assurance framing lands.
Ask for audience and webinar-performance information before committing budget.
Attendance, audience composition by role or industry, and results for comparable sponsored sessions are unconfirmed.
The posts do not provide a rate card, media kit, or inquiry route, so fee, exclusivity, rights, and deliverables also need to be agreed.
When to choose a specialist
A performance-marketing campaign does not fit if the vendor wants Rasmussen to produce conversion-oriented assets — paid ad creative, trial or demo sign-ups, coupon or lead-form promotions — and judges the campaign on cost per qualified pipeline within a fixed flight.
Read more
Decision: do not build the campaign this way or treat Rasmussen as an interchangeable creator to slot in because the topic matches.
Their posts show analyst and editorial work: vendor briefings, an executive strategy session, conference keynotes, podcast recording, and a curated commentary newsletter.
The posts contain no promotional assets, testimonial or endorsement work, short-form conversion creative, or measured results for comparable campaigns.
They also state no sponsorship program, rate card, or application route, so price, format, and availability cannot be quoted from them.
The gap that blocks a performance-marketing campaign is audience information, not subject fit.
The posts describe what Rasmussen writes and says, not who follows them by job role, seniority, or industry, or how their work converts.
Ask for recent audience demographics with a dated source and results for sponsored content showing what the sponsor received and what changed.
Without that information, a budget committee would be treating a topic match as proof of pipeline.
If the vendor can provide conversion results and fund a smaller test with defined measures, Rasmussen could support a different experiment, such as a gated analyst session judged on qualified registration rather than broad performance targets.
That is a separate proposal, not a repair of the original performance-marketing campaign.
A worked campaign example
Worked campaign angle for the good-fit brief: a 45-minute sponsor-hosted webinar built on Rasmussen's framing, “Governing AI between the checkpoints,” with the risk-quantification argument as its second half.
Session shape.
Open with the adoption-versus-confidence gap — 74% of organizations using AI in risk programs against 17% feeling very prepared to govern that risk — and the converging-risk finding that economic risk and cybersecurity are now tied at 55% among risk leaders.
Rasmussen supplies the interpretation: these are not independent entries waiting for their turn on a heatmap.
Move to the assurance question: what must an organization be able to demonstrate before it launches a product, makes a significant change, or enters a market.
Use the checkpoint-versus-operation distinction to show why periodic review fails once AI agents do the work.
Close on quantification: what uncertainty looks like when expressed in terms of investment, mitigation, and resilience decisions rather than a colored cell.
The sponsor's product enters as the layer that keeps evidence findable and connects business triggers to assurance workflows, not as the subject of the talk.
What to hand Rasmussen before the session.
One anonymized customer scenario with a real trigger and a real decision.
The sponsor's evidence-retention and agent-oversight capabilities stated as plain claims, not feature lists.
The report data the session will quote, with its provenance, so the numbers are cited accurately.
Deliverables beyond the live session. A recording, a short companion briefing that restates the checkpoint-versus-operation argument, and one follow-up asset the sponsor can send to registrants.
Measures to agree in advance. Qualified registrations by role, attendance and completion, questions asked in session, and follow-up meetings booked from the attendee list.
Open items to resolve before booking. The fee and rights to the recording, whether the session is exclusive to this sponsor for a set window, whether Rasmussen presents alone or alongside a sponsor customer, and the audience and performance evidence requested above.
Book Waseem Samaan instead when the webinar is aimed at internal audit, SOX, and fintech or payments risk teams, and the sponsor wants a practitioner who can speak from inside audit, risk, and governance functions rather than from an outside analyst's market view.
Read more
Samaan's posts connect internal audit's evolving role to AI, cybersecurity, third-party risk, regulatory expectations, and business transformation.
They also draw lessons from a payments and RegTech forum about real-time risk visibility, AI as control and risk, and compliance working with product rather than as a checkpoint.
Samaan is a better fit if the sponsor's product story is about audit transformation, integrated assurance, or controls across financial services.
The tradeoff is market-level thesis and quantified risk framing.
Michael Rasmussen's posts carry the argument a sponsor needs for AI governance and risk quantification: continuous governance between checkpoints, evidence behind responsible AI claims, and expressing uncertainty in investment, mitigation, and resilience terms.
Samaan's posts offer profession-facing commentary and conference takeaways, not a developed risk-quantification method or vendor-briefing analyst practice.
A sponsor choosing Samaan should bring more of the research spine, survey data, and market interpretation, rather than expect the session to rest on an established analyst platform.
Book Jess Mand instead when the webinar is closer to an editorial interview or article-led discussion, and the sponsor wants a host who can draw out a customer CIO or data leader rather than deliver an analyst keynote.
Read more
Mand's posts show them interviewing Arron Lamp, CIO of Tokio Marine HCC, about AI governance when rules are still being written, and Pierre Bourgeix, CEO of ESI Convergent, about why data architecture determines who wins the AI race. Mand is a better choice if the campaign's value is in structured conversation with a sponsor's customer or technical guest, and the audience needs AI governance and data readiness explained through those voices.
The tradeoff is the main-stage voice.
Rasmussen's posts show them presenting their own arguments at vendor conferences, briefing vendor teams, joining executive strategy sessions, and producing a curated GRC commentary edition.
Mand's posts offer two examples of interviewing and synthesizing other experts; they show interview production and editorial range, but not a GRC analyst practice, keynote record, or risk-quantification framework.
If the sponsor expects the creator to supply the session's governing thesis and numbers, Rasmussen is the safer choice.
Book Michael Brooks instead when the webinar is centered on cybersecurity assessment, control effectiveness, and accountability after a breach, especially for a public-sector, defense, or critical-infrastructure audience, and the sponsor sells assurance, validation, or continuous monitoring.
Read more
Brooks's posts argue that continuous cyber resilience must be proven with continuous evidence that controls work; that a breach involving unencrypted personal data raises questions about ownership, safeguards, authorization, and verification; and that exposed information cannot be made secret again. They also show Brooks writing as a veteran potentially affected by the Pentagon breach, giving the session a personal accountability frame that a market analyst cannot replicate.
The tradeoff is topic concentration.
Rasmussen's posts frame AI governance and risk quantification as business decisions: what an organization must demonstrate before a launch or market entry, why periodic review fails when AI agents operate continuously, and how uncertainty supports investment and mitigation choices.
Brooks's posts focus on cybersecurity assessment and breach accountability, not GRC software market direction or quantified risk in business terms.
A sponsor choosing Brooks would need to build the AI governance and quantification angle around security assurance and control evidence, rather than expect the same analyst-led discussion.
This profile draws on five complete LinkedIn posts by Rasmussen, observed on 8 October 2026.
The posts describe 2026 GRC conference sessions and a 2026 risk report, and they point to the GRC 20/20 Research newsletter and two podcasts.
The full articles, talks, and podcast episodes those posts reference are not covered here, so any description of them rests on Rasmussen's own summaries, and the posts do not show individual post dates.
Brand relationships are limited to what the posts state; no sponsorship, affiliate, or commercial terms appear in the posts.
Similar-creator comparisons are based only on posts available for those accounts, and the posts do not establish audience composition or campaign results.
