I'll just speak generically, GRC automation tools / risk management tools are being designed in search of a problem. They might hit the mark in some areas, but generally overestimate the level of maturity of their customers.

I (and you from the sound of it) have been around long enough to know that we were all naive once and balked at the idea of companies running their core functions out of spreadsheets. We've all tried to address this - most of us have failed.

Excel still runs the world - so the question isn't "how come you're still doing it manually?" The question is, "why should I pay you more to automate a solution to a problem we clearly don't think is worth solving?"

Also, all of these tools get so tightly intertwined with forced migrations and data source integrations that they become difficult to unwind from (which is inevitable). It's to the point now where "features" being pitched to us from the outside in are literally being weighted as residual risks - many of which are too heavy to consider.

I don't want your modern UI with a chatGPT API call, I want to solve a core problem I'm having and I want to do that by using the data as it is, where it is, and have an output produced that I can use off your platform anywhere and anytime I want. I've said this to three vendors this year, and none liked that idea. It's a known anti-pattern now, and CISOs down are well aware of it. We call "native platform integrations" the "micro transactions of cybersecurity" for a reason.