The 2025 State of Continuous Compliance Report

66% of security services providers primarily use a GRC or compliance automation platform.

31% of security services providers report an average or lower ability to differentiate.

Spreadsheet usage among security services providers is up 50% year over year (as a secondary tool).

87% of security providers now offer compliance services.

44% of managed compliance providers state that at least a quarter of their compliance revenue is recurring.

28% of consulting-first security services firms report at least a quarter of their compliance revenue is recurring.

16% of security services providers still rely on spreadsheets as their main tool.

90% of security services providers say they face challenges differentiating and standing out in a crowded market.

Just one-in-four security services providers met their recurring revenue targets in 2024.

One in three security services providers struggle to consistently show value and ROI.

87% of security services providers say automation is a high priority.