This feels like something that Vanta, Drata, or Iru may just patch into their existing platforms that already have mass market adoption. Maybe if you get some traction a company like that would be willing to buy it, but most people using a GRC are pretty entrenched and likely won't want to add another platform like this.

I think an open-source self-hosted angle with optional paid cloud plans is becoming more common these days. Might work here

Anyway, the conventional answer would be that you need an investor at this point -- an angel, even. If that won't work, you probably ought to do outreach and look for partners.

I don't think that selling it right now is a viable strategy, or an optimal one. You'd be better off whipping up a website and forcing a bootstrapped GTM.