About Pierre-Paul Ferland
I'm PP.
I work in GRC, teach it, write about it and build things that might make it more useful. The work has taken me from audit evidence to engineering conversations to the messy decisions in between.
I came to this through questions.
A product team wants to ship. An engineer changes the system. An auditor asks for proof. I like the part where someone has to understand all three well enough to help the organization make a good call.
Before security, I earned a PhD in literature with plans to become a writer. I still write, though the plot now tends to arrive as a risk scenario.
What I believe
Curiosity and pragmatism.
Curiosity
Learn how the business runs and what the technology really does. Ask the question you worry might make you look stupid. That question often reveals the assumption everyone else walked past. Technical fluency and human relationships both start here.
Pragmatism
Care about the result more than the ceremony. If a control works, make it easier to explain. If it does not, help fix it. Use AI when it brings the right context into view; keep a person responsible for the call. Compliance follows good work. It is not the prize.
Read and watch
Where I have made the case in public.
GRC is Technical
For anyone who has been told that GRC is the nontechnical side of security.
Read the essay →Inside a growing GRC program
Ayoub Fandi and I talked through how GRC fit with engineering as Coveo scaled.
Read the deep dive ↗AI connected to real GRC data
With Ethan Altman of Anecdotes, I explored what becomes possible when an assistant can use the records a team already has.
Watch the webinar ↗Should you build or buy your GRC tools?
A conversation with Alan Luk, Jeffrey DeNardo and Ayoub Fandi about the trade-offs behind that decision.
Watch the panel ↗What changes when AI knows your GRC context?
At Anecdotes' 2026 summit, I joined a session comparing a general assistant with one connected to GRC work.
Watch the session ↗See what I'm building.
The public demos make some of these ideas tangible with fictional GRC cases and the records behind them.
Explore the demosSpeaking →