DigitalXForce expands X-ROC risk operations platform as benchmark finds hidden control gaps
DigitalXForce has announced the continued global rollout of X-ROC (XForce Risk Operations Center), an AI-powered approach to continuous enterprise risk operations. The company also published a benchmark of 2,112 companies that, it says, shows a disconnect between high compliance scores and real security exposure.
- DigitalXForce continues the global rollout of X-ROC, an AI-powered risk operations model.
- Its benchmark of 2,112 companies found a 98.9% median control implementation, yet only 26.7% reported full implementation.
- X-ROC offers enterprise-operated and managed service models, with cloud and hybrid deployment.
- The company cites Leader positions in two IDC MarketScape assessments and 2026 Cyber Defense Magazine honors.
What X-ROC is meant to do
DigitalXForce describes itself as an AI-native Enterprise Trust, Risk, Security and Compliance Management (TRiSCM™) platform provider. According to the company, X-ROC differs from traditional Governance, Risk and Compliance (GRC) platforms, which it says primarily document risks and manage periodic assessments.
X-ROC combines Continuous Control Assurance (CCA), Continuous Control Monitoring (CCM), Cyber Risk Quantification (CRQ), AI-powered risk intelligence and remediation orchestration in one model. The stated aim is to help enterprises move beyond knowing whether controls are documented to continuously understanding whether controls operate effectively, which exposures matter most, and what action to take next.
The company defines a Risk Operations Center as an operating model that continuously identifies, assesses, prioritizes, monitors and reduces enterprise risk. A traditional Security Operations Center focuses on threats and incidents, while a Risk Operations Center looks at broader exposure, control effectiveness, business impact and remediation, according to DigitalXForce.
Benchmark points to gaps behind high scores
The DigitalXForce Security Posture Benchmark 2026 analyzed published security control responses from 2,112 companies. The company says the results show a significant gap between high-level compliance scores and underlying exposure. Key findings include:
- 98.9% median control implementation: the median company reported 98.9% of applicable controls in place, yet significant gaps remained.
- 54.9% reported at least one missing control in the Data Protection and Encryption domain.
- 52.0% reported at least one encryption and key management control not in place, among 2,098 responding companies.
- 42.3% reported configuration and asset management gaps.
- 26.7% reported full control implementation under the benchmark's assessment model.
Responses were evaluated against DigitalXForce's proprietary model of 94 controls across 12 domains, mapped to NIST SP 800-53, NIST Cybersecurity Framework 2.0 and CIS Controls v8.1. The company argues that a high score does not reveal which remaining control failures could cause the greatest business impact, and says it developed X-ROC to address that problem.
How the platform works and how it is deployed
DigitalXForce lists six elements of X-ROC. It ingests security posture changes, control failures, third-party risk events and other risk signals, and links them to evidence. CCA validates control effectiveness through evidence collection, automated testing and ongoing monitoring, with CCM tracking control conditions and risk signals.
The company's AI engines, AI JedAI and XForce GPT, analyze signals, correlate findings, support prioritization and generate business-oriented risk narratives and executive reporting, with analyst review. Instead of ranking findings only by technical severity, X-ROC factors in quantified financial exposure and business impact.
For remediation, X-ROC assigns risk ownership, tracks progress against timelines and supports integration with workflow platforms such as ServiceNow and Jira. Findings are validated through control retesting before closure. A final element connects operational findings to trust, security, compliance and resilience reporting for CISOs, CROs, compliance leaders and boards.
X-ROC supports two operating models. In the enterprise-operated model, organizations run X-ROC themselves. In Managed Risk Operations, DigitalXForce runs the risk operations layer as a managed service, while customers keep ownership of remediation actions. The platform supports cloud and hybrid deployment, which the company says helps with regional data residency requirements.
Recognition and platform scope
DigitalXForce says it was positioned as a Leader in two IDC MarketScape reports: Worldwide Governance, Risk, and Compliance Software Vendor Assessment, 2025 (Doc #US53615325, June 2025), and Worldwide Third-Party Risk Management Software 2026 Vendor Assessment (Doc #US53007725, September 2026). It also received innovation honors in the 2026 Cyber Defense Magazine Global InfoSec Awards, tied to AI TRiSCM, Automated GRC with Continuous Control Assurance, and X-ROC.
The Enterprise TRiSCM™ platform integrates 15 modules on a unified data layer, supporting more than 50 compliance frameworks and 250 technology integrations, according to the company. Founder and CEO Lalit Ahluwalia said: "X-ROC is redefining enterprise risk operations."
What it means for enterprise risk teams
The announcement reflects a push in the GRC market from periodic assessments toward continuous monitoring and quantified business risk. For security and compliance teams, the company's pitch is a single operating layer that links control failures to evidence, financial impact and owned remediation. The benchmark figures are DigitalXForce's own research, and the product claims come from the company, so buyers would need to test them against their own environments.
