Point-in-Time Audits Don't Prove Controls Work

Summary

 

In a recent SecurityWeek column, TrustCloud CEO Sravish Sridhar argues that point-in-time audits and sampled assessments no longer prove that security controls work. His central point is control drift. A firewall port gets opened "temporarily" and never closed. A vendor pushes a configuration change. New systems go live between audit windows. None of these shows up until the next assessment, if it shows up at all.

 

He cites a 2025 Dell study in which 69% of IT professionals said their leadership overestimates the organization's readiness for a cyber event. He also points to the 2024 update of the NIST Cybersecurity Framework (CSF 2.0), which added a "Govern" function focused on measurable outcomes rather than checklists. His recommendation is to replace calendar-based, manual evidence collection with continuous monitoring, so that security leaders report on current risk instead of past snapshots.

 

 

The InfoSight take: monitoring tells you a control exists. Testing tells you it works.

 

We agree with the diagnosis. Passing an audit in March says very little about your exposure in October. But continuous monitoring answers only half the question. It can confirm that a control is configured. It can't confirm that the control will stop, or even detect, a real attacker.

 

Proof beats assumption.  Here's how InfoSight delivers it:

 

Purple Team SOCaaS runs real adversary techniques against your environment while our SOC watches. Each exercise tests whether a control fired, whether an analyst saw it, and whether it was escalated. You get evidence that your defenses work, not just a record that they exist.

Mitigator® gives you continuous visibility into vulnerabilities and risk, so drift gets caught when it happens rather than at the next audit.

 

24/7 monitoring, Powered by AI, Fueled by Experts. AI brings the high-risk signals to the surface, and experienced analysts confirm what matters. That cuts the alert noise experts warns about.

 

For our clients in financial services, healthcare and manufacturing, this matters beyond security. Examiners and auditors increasingly want proof that controls perform as intended, which is the direction CSF 2.0 is pushing.

 

Not sure your controls would hold up against a real attack?