Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Sam Jones (00:00):
OK, let's, let's dive
right in.
So right now, july 15th 2025,atlanta's buzzing, you've got
the 95th MLB All-Star Gamehappening.
Ori Wellington (00:09):
That's right,
big day for baseball fans.
Sam Jones (00:11):
Exactly Celebrating
top talent.
You know strategic plays.
But interestingly, while that'sgoing on at Truist Park,
there's another kind of all-starroster making news here in
Atlanta too.
Ori Wellington (00:23):
And that's what
we're digging into.
Sam Jones (00:24):
Yeah, that's our
focus today.
Ori Wellington (00:25):
Because today
Wheelhouse Advisors, also based
right here in Atlanta, justdropped their 2025 IRM 50 report
.
Sam Jones (00:33):
OK, IRM 50.
Ori Wellington (00:34):
Yeah, and this
isn't about batting averages,
obviously.
It's about identifying the 50most influential players
technology providers,consultants in integrated risk
management or IRM.
Sam Jones (00:45):
Gotcha, the ones
really shaping the future of how
companies handle risk.
Ori Wellington (00:49):
Precisely.
They're the heavy hitters inthis field.
Sam Jones (00:51):
So our mission here
for you listening, is really to
give you that shortcut you know,to quickly get you up to speed
on this really crucial and fastmoving industry.
Ori Wellington (00:59):
We'll break down
what IRM actually means, why
this report is such a big deal.
Sam Jones (01:03):
And maybe uncover
some surprising things about
who's leading the charge andwhat trends are driving this
whole thing.
You get those aha momentswithout you know getting bogged
down.
Ori Wellington (01:14):
Sounds good.
So maybe start with the basics.
Why IRM?
Why now?
What's the big deal?
Sam Jones (01:19):
Yeah, what's driving
this?
Ori Wellington (01:20):
Well, the first
thing is just the sheer speed of
this market.
It's accelerating like crazy.
Sam Jones (01:25):
How fast are we
talking?
Ori Wellington (01:26):
We're talking
projections hitting something
like $147 billion by 2032.
Sam Jones (01:33):
Wow Okay, $147
billion.
That's not just growth, that'san explosion.
Ori Wellington (01:38):
It really is,
and it signals a pretty
fundamental shift in howbusinesses are thinking about
risk.
It's not just a back officefunction anymore.
Sam Jones (01:45):
So who's really
feeling that pressure?
Who needs this clarity?
Is it boards, CISOs?
Ori Wellington (01:50):
It's all of them
really yeah Boards, definitely
CISOs, chief risk officers, evenleaders driving big
transformations.
Sam Jones (01:57):
Right.
Ori Wellington (01:57):
They're all
looking for.
You know who's actually leading.
Who can they rely on in thisincreasingly complex landscape?
They need trusted partners.
Sam Jones (02:05):
Makes sense, and
that's where this IRM 50 report
comes in handy, I guess.
Ori Wellington (02:08):
Exactly, it
provides that clarity.
Wheelhouse looked at I think itwas over 220 providers globally
220 to get down to 50.
Yeah, quite the filteringprocess.
And they used three maincriteria.
Sam Jones (02:20):
Okay, what were they
looking for?
Ori Wellington (02:22):
So first was
solution breadth Basically, how
comprehensive are theirofferings?
Do they cover different typesof risk?
Second, integration capabilityhow well does their stuff plug
into everything else a companyuses?
Can you get that unified viewCritical.
Avoid those silos Absolutely.
And third was market influence,which is interesting.
(02:42):
It's not just about size, ohhow.
So it's more about are theyshaping the conversation,
pushing best practices?
Are peers and analysts actuallyciting them?
That kind of impact?
Sam Jones (02:54):
Right.
So it's about thoughtleadership and, well, actual
influence, not just market share.
Ori Wellington (02:58):
Exactly A really
important distinction.
Sam Jones (03:00):
And these top 50
providers.
They operate across what?
Five core areas, five domainsof IRM?
Ori Wellington (03:06):
That's right,
Five main buckets.
You've got your enterprise riskmanagement ERM that's the big
picture across the whole company.
Then governance, risk andcompliance, GRC that's rules,
regulations, policies, makingsure you're compliant the
classic stuff, Pretty much.
Then operational riskmanagement ORM that's about the
risks in your day-to-daybusiness processes, things going
(03:28):
wrong internally.
Sam Jones (03:29):
Right.
Ori Wellington (03:30):
Fourth is
technology risk management, trm.
So cyber risk, itvulnerabilities, all that tech
stuff obviously huge now.
Sam Jones (03:38):
Hugely important yeah
.
Ori Wellington (03:39):
And then the
fifth one is actually a game
changer for this year's reportRisk management consulting RMC.
Sam Jones (03:47):
Ah, okay, so
consultants are now officially
part of the IRM 50 mix.
That is a big deal.
Ori Wellington (03:52):
It's a really
significant evolution.
Yeah, First time they'reincluded as like full-fledged
contributors.
Sam Jones (03:57):
What does that signal
?
Do you think about howcompanies are tackling risk now?
Ori Wellington (04:04):
Well, there are
10 consulting firms on the list
this year that's 20%, 20%, wow.
Yeah, I think it reallyacknowledges that the technology
is vital, but the strategy andthe execution that requires
expert guidance.
Sam Jones (04:14):
So it's not just
buying a tool, it's about making
it work effectively.
Ori Wellington (04:17):
Exactly,
companies want outcomes,
tangible results, and theseconsultants, they're kind of
like the coaches or maybe theclosers in baseball terms.
Sam Jones (04:27):
Huh, I like that.
The coaches and closers of IRM.
Ori Wellington (04:30):
Yeah, they bring
that advisory strength drive,
the maturity, help actuallyimplement things properly.
Sam Jones (04:35):
Makes total sense.
Ok, so, speaking of top talent,the report also calls out
market leaders, but you saidthis group is smaller this year.
Ori Wellington (04:42):
Much smaller,
very exclusive club.
Now Only six providers madethat cut.
Sam Jones (04:46):
Six Down from what
potentially over 20 in the past.
Ori Wellington (04:50):
Yeah, exactly,
it used to be a broader category
.
Now it's much more rigorous.
Sam Jones (04:54):
So what does it take
to be a market leader in 2025,?
Ori Wellington (04:57):
according to
this, it means demonstrating
really top-tier performanceacross well everything Core
capabilities, how deeplyintegrated their solutions are
and their ability to work acrossdifferent risk domains.
Sam Jones (05:09):
So they're the
dependable all-rounders, the
starting lineup, as the reportcalls them.
Ori Wellington (05:14):
That's a good
way to put it Reliable across
any risk inning.
The fact that there are fewerjust shows the bar is getting
higher as the market matures.
Sam Jones (05:20):
Right, higher
standards for leadership, but OK
, every lineup needs its strongrookies too right.
Ori Wellington (05:28):
Are there new
players breaking in?
Absolutely.
The report highlights five newentrants to the IRM 50 this year
the rookies to watch.
Sam Jones (05:34):
OK, what got them
onto the list?
Ori Wellington (05:36):
Generally it's
standout innovation or maybe
really strong market momentum orbringing some genuinely new
capability to the field.
Sam Jones (05:44):
Like.
What kind of innovation are weseeing?
Ori Wellington (05:45):
Well, they give
examples like AI-native TRM
platforms.
Sam Jones (05:49):
AI-native meaning.
Ori Wellington (05:51):
Meaning built
with AI at the core from the
start, not just AI sprinkled ontop of an old system.
It allows for much morepredictive and continuous risk
monitoring in the tech space.
Sam Jones (06:03):
Proactive, not just
reactive.
Ori Wellington (06:04):
Exactly, and
another example was digital twin
advisory models.
Sam Jones (06:08):
Digital twins for
risk.
How does that work?
Ori Wellington (06:10):
Yeah, Think of
creating like a virtual replica
of your organization's risklandscape.
Okay, Then consultants can usethat model to simulate different
scenarios market shifts, supplychain breaks, cyber attacks and
test out strategies before youimplement them in the real world
.
Sam Jones (06:25):
Wow, okay, that's
like having a risk flight
simulator lets you see potentialimpacts beforehand pretty much.
Ori Wellington (06:31):
It provides a
level of foresight that's quite
new.
So real game-changing stufffrom these new entrants
definitely sounds like it now.
Sam Jones (06:40):
We've mentioned
Atlanta a couple of times
because of wheelhouse and theAll-Star Game.
Is this primarily a US-centricmarket or is it global?
Ori Wellington (06:49):
Good question,
While the US does still have the
most company headquarters onthe list the 2025.
Irm50 is actually the mostglobally representative it's
ever been.
Sam Jones (06:58):
Oh really, when else
are these companies based?
Ori Wellington (07:01):
We're seeing
firms from Canada.
Sam Jones (07:09):
Norway, the UK,
France, Switzerland, the
Netherlands, even.
Ori Wellington (07:10):
India, okay, so
pretty diverse geographical
spread.
Definitely it really underlinesthat IRM is a mature global
market.
Now these challenges areuniversal.
Sam Jones (07:16):
That makes sense.
And something else that jumpedout at me from the outline was
the ownership structure of thesecompanies.
It's not what you might expect.
Ori Wellington (07:23):
Right, it's
actually fascinating.
You might think giants likeMicrosoft, ibm, servicenow would
dominate this list.
Sam Jones (07:30):
Yeah, the big public
tech companies.
Ori Wellington (07:31):
But nope, over
80% of the IRM50 are privately
held 80% Seriously Backed byprivate equity VCs.
Yeah, or still founder-led.
But, and this is the key point,private does not mean small or
niche in this space.
Sam Jones (07:47):
Okay, how so?
Ori Wellington (07:48):
Well, get this
One of these private IRM50
companies used by 75% of theFortune 500.
Sam Jones (07:55):
75% what.
Ori Wellington (07:56):
Another one
powers over 40% of the Fortune
500 list.
Many are deeply embedded inhighly regulated industries,
critical infrastructure, hugemultinational corporations.
Sam Jones (08:07):
Okay, so these aren't
small boutique shops.
They're major players, just notpublicly traded.
Ori Wellington (08:12):
Exactly, it
seems like in this particular
market that private structure,maybe the agility, the focused
innovation, the strategicfunding it allows, drives growth
and influence faster, or atleast as fast as going public.
Sam Jones (08:23):
That's a really
interesting insight into this
sector, and the size varieswildly too, right from small
teams to massive organizations.
Oh, absolutely.
Ori Wellington (08:31):
You've got some
IRM50 vendors who are quite lean
, maybe 60 to 100 employeesreally focusing their innovation
on specific niche areas.
And then you have others,especially on the consulting
side, employing well over370,000 people globally, like
the big four consulting firmsfor example.
Sam Jones (08:49):
That's an incredible
range.
So what's the total workforcerepresented here If?
Ori Wellington (08:53):
you add it all
up across the 50 firms, it's
over 1.5 million people.
Sam Jones (08:58):
One and a half
million.
Ori Wellington (08:59):
Yeah, Enough
people to fill Truist Park,
where the all-star game is morethan 36 times over.
Sam Jones (09:04):
Good grief.
That really puts the scale ofthis industry into perspective.
It's massive.
Ori Wellington (09:09):
It absolutely is
, and that diversity in size
kind of mirrors the real world.
Right Organizations needdifferent solutions, sometimes
highly focused, sometimesglobally integrated.
Sam Jones (09:18):
True, so let's bring
it back to the listener.
What's the big takeaway here?
Why does this lineup, thiswhole IRM 50 report, matter to
you if you're dealing with riskin your job?
Ori Wellington (09:27):
Well, the report
isn't just a list of names.
It really captures afundamental shift happening.
Sam Jones (09:33):
A shift in how
companies approach risk.
Ori Wellington (09:35):
Exactly, it's
showing a move away from you
know, having lots of separate,fragmented tools just for
compliance.
Sam Jones (09:41):
Right, the old,
siloed approach.
Ori Wellington (09:42):
Towards truly
integrated risk platforms
getting that holistic complianceRight.
The old siloed approach Towardstruly integrated risk platforms
getting that holistic view.
Sam Jones (09:46):
OK, integrated
platforms.
What else?
Ori Wellington (09:48):
We're also see a
shift from just doing, say,
periodic assessments in silostowards something they're
calling autonomous IRM.
Sam Jones (09:57):
Autonomous IRM.
That sounds futuristic.
What does that actually mean?
Ori Wellington (10:00):
Yeah, it's a big
concept.
Think of it as moving beyondjust manual data gathering and
reporting.
It's about systems that canmore proactively and
continuously identify risks,correlate data automatically
from different parts of thebusiness, maybe even suggest or
automate responses.
It brings more prediction, lessreaction.
Sam Jones (10:19):
So smarter, more
automated risk management.
Ori Wellington (10:21):
Kind of Right,
and linked to that is another
shift, moving away from a purelygovernance-first mindset.
Sam Jones (10:27):
Meaning just ticking
the compliance boxes.
Ori Wellington (10:29):
Pretty much
Shifting from did we follow the
rule towards an outcome-firstapproach.
Sam Jones (10:34):
Okay, outcome-first.
How does that look in practice?
Ori Wellington (10:36):
It means asking
how is our risk management
actually helping us achieve ourbusiness goals?
You know, is it enabling us toenter a market faster?
Is it making us more resilientwhen disruption hits?
Is it reducing friction?
Sam Jones (10:50):
So connecting risk
management directly to business
performance and strategy, notjust seeing it as a cost center.
Ori Wellington (10:55):
Precisely, it's
about showing real value, real
ROI, not just adherence.
These vendors, the IRM50, arethe ones enabling organizations
to make that shift.
Sam Jones (11:05):
They're helping
reframe risk, not as just a
defensive necessity, but aspotentially a strategic function
.
Ori Wellington (11:12):
Absolutely
Helping shape that next
generation of performance,resilience, assurance and
compliance.
It's all becominginterconnected.
Sam Jones (11:19):
Okay.
So this deep dive really showsa transformation underway in
integrated risk management,driven by this diverse, all-star
group of companies who arechanging the game.
Ori Wellington (11:28):
It's a powerful
snapshot yeah.
Sam Jones (11:30):
Yeah.
Ori Wellington (11:30):
Moving beyond.
Just you know basic blockingemerging threats, ai driven
cybercrime, climate risksaffecting supply chains, you
name it.
Sam Jones (11:51):
New challenges
constantly popping up.
What new capabilities, what newlayers of risk management do
you think will become mostcritical for organizations to
master next, and how might thatchange?
Who the all stars are in thisfield down the road?
Ori Wellington (12:03):
That's the
multibillion dollar question,
isn't it Definitely something tothink about?
What comes after autonomous IRM, what's the next frontier for
managing risk effectively?
Good place to leave it.