Klever Compliance: Killing Sacred Cows, Taming Data Hoarders, And Making GRC Actually Work
If you have been in this industry longer than five minutes, you have probably seen this movie before: someone buys a shiny GRC platform, spends a year trying to bend their entire organization around how the tool thinks they operate, then still ends up living in spreadsheets when the auditors show up.
Karina Clever, CEO and founder of Klever Compliance, has politely had enough of that.
In our conversation for Cyber Defense Magazine’s Innovator Spotlight, she put it bluntly:
“The failures I’m seeing in the industry are all associated to being married to a tool which has its limitations and may have not been built for your exact situation.”
That is the core of the Klever Compliance philosophy. They are not selling yet another tool. They are providing tool agnostic compliance management as a service, built on basic GRC fundamentals and tailored to how your organization actually operates, not how your software vendor wishes you did.
For CISOs who are drowning in frameworks, controls, tools and vendor questionnaires, this is a different kind of proposition. It is governance as architecture, not as a shopping list.
The Problem: Tool Worship And Framework Literalism
Most CISOs would never admit they are “married” to a tool, but you can see the patterns everywhere. A platform gets purchased, often by a predecessor or a board member influenced by a buddy in sales. It becomes a sacred cow. The organization bends around it.
Karina has watched how that plays out across industries:
“Frameworks are written by design to be vague and agnostic across all of those limitations that we have in our daily life, and so when you come in with just basic GRC principles and build a GRC program using whatever tools companies already have in house, natively, you’re able to provide a more solid GRC program that is able to see failed controls, do proper risk management and better align to those framework and regulatory requirements.”
In other words, the framework is not the problem. Your expectations of the framework are.
Frameworks are intentionally vague so they can be applied to almost any size, industry or tech stack. Tools, on the other hand, are opinionated. When you lock your program to a single tool’s opinions, you effectively hard code someone else’s assumptions into your risk posture.
Karina’s critique of the traditional approach is familiar but sharp:
“Tools only do what the users tell them to do, right? And so because the tool doesn’t know what you do, it goes off and solutionizes for you, and it might not even be appropriate for you, and it’s probably creating extra work and extra bureaucracy, which is why a lot of people hate compliance.”
That “solutionizing” is where many programs quietly die. You start reshaping evidence, workflows and control mappings around what the platform can easily report on instead of what actually matters. The result is that people are doing huge amounts of work that look like compliance, while risk management quietly gets worse.
Back To Basics: GRC Built On Reality, Not Pretend Operations
Klever Compliance’s answer is refreshingly unglamorous: get back to fundamentals and design GRC around your real operations.
Karina describes the value of a properly grounded program:
“The real benefit of a good GRC program that’s designed for your actual operations, opposed to pretend operations that come with a tool or with a framework, is you become more efficient, and you spot problems faster, and you know how big of a problem it is, because you’ve done proper risk association to those actual controls.”
There are three big outcomes in that one sentence:
- Efficiency: Less noise, less busywork, fewer zombie controls.
- Faster detection: You can see failed controls in the context of how your business actually runs.
- Risk clarity: You understand impact, not just whether a checkbox is red or green.
And this does not start with some magical AI workflow engine. It starts with boring, essential building blocks that many organizations quietly skip or fake.
“That starts with very basic principles, very basic fundamentals, data classification, data mapping, data structuring, right?”
If that sounds simple, good. It should. The hard part is actually doing it in the real, messy environment you inherited.
Access Control: Where Half Of Your Problems Are Hiding
Ask any CISO where they are most nervous, and you will hear variants of “identity” and “access” on repeat. Karina sees the same pattern:
“Access control is a huge fail across many companies, because you have on one axis your titles and your roles and your functions, and then the other axis has your systems and the levels of permissions for those systems.”
You know the theory. Roles meet systems. Least privilege. Separation of duties. In practice, many organizations are still assigning access based on “what the last person in that job had.”
Karina puts it in simple, operational terms:
“When those two axes crosshair, that’s actually where your access control parameters start coming in, meaning my financial analyst, it doesn’t matter if we hire a Bobby or Susie or Paul, that role needs to be associated to very particular levels of access in the SAP system. Maybe they don’t have an approval for checks and the supervisor does so now that’s a different role definition.”
Her baseline: define role-based least privilege as the default, and make deviations individually approved and auditable.
“When you define roles at the bare minimum, needed least privilege permissions, now anything above that least privilege permissions, you can actually have an individual approval for which is auditable. It’s an auditable record now, right? You can show that to the auditors.”
CISOs will recognize the dream: simple, defensible access models that map to how work actually gets done. Klever Compliance’s services revolve around codifying that model and embedding it across your environment, using the tools you already have.
Data Hoarding, Tool Hoarding And The Convenience Devil
If there is a villain in Karina’s worldview, it is not auditors or regulators. It is convenience.
She talks about data with the same exasperation many CISOs reserve for shadow IT:
“ISACA says that about 5% of our data is actually the golden egg data. Your sales person, however, will tell you you also need to encrypt publicly available data, because they’re going to want to send you a really big bill for that data storage, right? And so, of course, they’re incentivized for you to data hoard, but you have to be the bigger person and say, you know, this is not necessary for my business.”
Then comes one of the more memorable phrases from our discussion:
“We have so many tools in our environments, and a lot of them are legacy, and they step all over each other, and we’re creating swivel chair operations for our technicians, because, A, you don’t know which is the source of truth. B, they’re giving you conflicting signals many times. C, they’re getting their source from a lot of the same exact areas and spots.”
If you have ever watched an analyst flip between seven screens to answer a simple question, you know exactly what she means by “swivel chair operations.”
Karina does not treat this as a minor annoyance. She sees it as structural technical debt that actively undermines security, operations and auditability:
“It’s too much data, too many tools, too many controls that don’t even apply to us, right? It’s just too much. We’re swimming in this too much and wondering, and now we’re adding AI, right? And now we’re like, Oh, my God, everybody’s overwhelmed. Well, yeah, look at the environments you’ve created, and governance helps all of that.”
Her perspective on AI is equally grounded. It is not magical. It is a vendor that should be treated like any other third party handling sensitive data:
“Ai should be treated like a vendor, undergo due diligence, find out where your data is going. There have been numerous lawsuits where that AI tool is siphoning your data and that data set gets breached because they don’t have controls around it. Nobody’s asking them to have controls around it right on the back end.”
Convenience, she argues, is how you end up with fragile, leaky ecosystems hiding under expensive tools.
Vendor Management And The Quiet National Crisis
Karina’s take on vendor management will resonate with any CISO who has watched their data propagate through an increasingly opaque chain of subprocessors.
She points to the public HHS OCR breach report as one of the clearest indicators of systemic failure:
“The last number there was 307 million individuals in the US whose private health data was breached. That’s over 86% of the entire population in the US.”
For her, this is not an abstract statistic. It is personal and societal:
“This is our kids and our parents and our siblings and our neighbors and our friends and so all of us, 86% of the population. Why this is not a national crisis that everybody’s just livid over, nobody’s talking about it.”
The root cause, in her view, is broken vendor governance:
“The number one failure is vendor management, right? Because what happens when you bring in a vendor and you relinquish your data to that vendor, your contract and your liability stops with that vendor. The reality is that vendor has sub service organizations they’re probably passing your data on to, and then those vendors have sub service organizations they’re passing your data on to. Where it ends in the end, and how many instances of your data are out there, nobody really knows.”
The punchline is ugly:
“Some estimates are 19 different replications of all of your data exist around the world. Because where does the data end up at the very end, the cheapest possible data storage with zero controls imaginable. That’s where it leaks.”
For CISOs, this should sound uncomfortably familiar. You own the reputational blast radius, regardless of how far down the chain the actual breach occurred.
Karina’s position is clear: you cannot tool your way out of this. You govern your way out of it.
“I believe it’s all solved with governance. If you have the right controls around your environment, you have a boatload of controls, but if they have nothing to do with your operations, you’re doing busy work. You’re not protecting your company or your operations.”
Building The House: Klever’s Approach To GRC Design
So what does Klever Compliance actually do for a CISO who calls them in?
Karina uses a physical analogy that every executive can understand:
“The hardest part about building a house is not hanging the picture on the wall. It’s having the blueprint and having the architect and deciding where the plumbing is and the electricity and the window frame and the door, what side the house is facing for the sun or no sun, right? So your hardest part of building any house is the design.”
Klever Compliance positions itself in that architect role.
“Coming into a company, inventorying where they are, the health of their published documents, the validity of some of the controls and the inapplicability of other controls, the alignment of regulations and frameworks, looking at their tech stack, looking at their inventory, that is the heaviest lift. It usually takes about half a year.”
Six months to actually understand your environment, your controls, your tools and your regulatory landscape might sound expensive. For many CISOs, it is cheaper than another three years of pretending the spreadsheets are under control.
After that initial design phase, something counterintuitive happens:
“Then things get operational and they get beautifully operational without a bunch of confusion. And on the tail end, people have no idea what to do with themselves because it’s not as hard as they think it is. The only thing that’s made it hard for them is they were stuck in a maze, and we removed the maze.”
The outcome is a compliance framework and set of GRC controls that are applicable to your true operations, your actual tech stack, your real business model and maturity, and your real locations and constraints. Evidence collection becomes a byproduct of how you work, not a special event.
“Now, when we build controls around what you really are as a company, we can grow it from a maturity perspective while we’re passively gathering evidence for when that auditor shows up expectedly or unexpectedly.”
If you have ever had your weekend wrecked by a “surprise” audit request, that word “passively” should catch your attention.
Why This Matters For CISOs Right Now
The macro environment around CISOs is not getting gentler. You are juggling:
- Expanding regulatory expectations
- Ever more enthusiastic regulators and plaintiff attorneys
- Board-level scrutiny
- Tool sprawl and overlapping platforms
- AI everywhere, often without adult supervision
In that environment, the default reaction is often more: more tools, more dashboards, more reports, more controls. Karina’s work with Klever Compliance is a reminder that effective governance is often about less, but better.
- Fewer tools that actually map to your operations
- Fewer, clearer controls that actually manage risk
- Less data, carefully minimized and purposeful
- Less vendor opacity, more contractual and operational clarity
It is not minimalism for its own sake. It is security and compliance that are intentionally designed rather than accidentally accumulated.
A Call To Action For CISOs
If you are a CISO or senior security leader, here is a pragmatic way to take this from theory to action:
- Take inventory of your “sacred cows.”
Which GRC, security or compliance tools are you effectively married to because “we have always used it” or “the last CISO loved it”? Write them down. Then ask Karina’s question: does this align to our true operations, or to some pretend version of us? - Ask where your controls have nothing to do with your business.
That goat milk analogy Karina uses is funny because it is true:
“There’s a 21 CFR control that says, if you make goat milk ice cream, you have to use goat milk. But if I’m a pharmaceutical company that doesn’t make goat milk, why do we need to have four consultants walking around the hallway saying, Okay, show me proof that you’re really using goat milk.”
Somewhere in your environment, you are “proving” a goat milk control. Find it.
- Rebuild one domain around true operations.
Start with access control or data classification. Map the work as it is, not as the framework diagram says it should be. This is precisely the sort of project Klever Compliance leads for their clients. - Treat AI as a vendor, not a miracle.
Build a real due diligence and vendor management approach around your AI usage. Find where your data is going, what controls exist at each hop, and where the cheap storage with zero controls is lurking. - Bring in architects, not just tool vendors.
Whether it is Klever Compliance or another partner, the key question is: who is helping you design the house, not just sell you more furniture?
If the way you are running GRC today feels like running in a maze with a spreadsheet in one hand and a vendor roadmap in the other, it might be time to bring in someone whose business is literally removing the maze.
Author’s Note
The author sat down with Karina Clever, CEO and founder of Klever Compliance, during the 2026 RSAC Conference in San Francisco, held March 23rd to 25th, 2026, to discuss how governance, rationalization and a brutally honest look at tools and data can reset the way CISOs think about compliance and risk management.
For more information, please visit www.klevercompliance.com.
About the Author
Pete Green is the CISO / CTO of Anvil Works, a ProCloud SaaS company and co-author of “The vCISO Playbook: How Virtual CISOs Deliver Enterprise-Grade Cybersecurity to Small and Medium Businesses (SMBs)”. With over 25 years of experience in information technology and cybersecurity, Pete is a seasoned and accomplished security practitioner.
Throughout his career, he has held a wide range of technical and leadership roles, including LAN/WLAN Engineer, Threat Analyst, Security Project Manager, Security Architect, Cloud Security Architect, Principal Security Consultant, Director of IT, CTO, CEO, Virtual CISO, and CISO.
Pete has supported clients across numerous industries, including federal, state, and local government, as well as financial services, healthcare, food services, manufacturing, technology, transportation, and hospitality.
He holds a Master of Computer Information Systems in Information Security from Boston University, which is recognized as a National Center of Academic Excellence in Information Assurance / Cyber Defense (CAE IA/CD) by the NSA and DHS. He also holds a Master of Business Administration in Informatics.
