8. Why invest

• Every organisation already carries the risk. The service does not create a need; it makes an existing, unsigned liability visible and owned. Regulation increasingly assumes residual risk has been judged acceptable by someone accountable.
• It sits beside every GRC platform, not against them. The market for registers and workflow is crowded. The market for connecting those registers to reality, and for running acceptance with names and clocks, is not.
• It is sticky. Once an organisation's material risks run on intervals, the clocks never stop, and the service is how they are kept.
• It compounds. Each client's facts, controls and decisions become a record that makes the next acceptance faster and the next audit cheaper.
• The substrate is open and exists. Vaults for evidence, the Risk Graph Explorer for the chain, and the published method on risks.sgit.ai and RiskMandate.ai. The company competes on running the method well.

What an investor should ask

• How often do executives refuse to accept, and what happens then? (09-risks.md.)
• Is this a consultancy or a product company? (A service first, with tooling built where the service repeats.)
• Why would a GRC vendor partner rather than copy? (04-in-the-gaps-of-grc.md.)