Are You Too Reliant on Being Compliant?

Some call it lazy journalism, but I’m always drawn to a news story with a surprising statistic in it. So imagine my complete lack of intrigue when I happened upon a recent piece claiming that 52% of US enterprises consider themselves defenceless against APTs.

The obvious first reaction is: how on earth can any organization, in any vertical, with any kind of security posture, describe themselves as “defenceless”? The answer, I suspect, lies less in the technology stack and more in an over-reliance on the security equivalent of a foot spa — buying it once, using it briefly, then putting it in the attic to rot forever.

Far too many enterprises treat information security as a box-ticking exercise. A standard is identified, an auditor is engaged, a policy is written, and the security programme is declared “compliant”. Tick. Next item on the agenda.

Compliance vs. security posture

Compliance frameworks are valuable. They give shape to a programme, set a baseline, and provide a common language for executives, auditors, and regulators. But compliance is a snapshot. It measures whether the controls in place at the time of the audit meet a defined standard — it does not, and cannot, guarantee that those controls will hold up against a determined adversary.

An enterprise can be fully compliant on paper and still be unable to detect, contain, or respond to an intrusion in progress. That gap between the audit report and the actual security posture is where breaches take root, and where CARM matters.

So what’s the alternative?

Rather than treating compliance as the destination, treat it as a starting point. Layer ongoing detection, regular drills, tested response procedures, and integrated remediation capabilities on top. Build the muscle memory that an audit alone cannot give you.

If you would like to get involved with CARM or explore how an integrated remediation and mitigation ecosystem can strengthen what compliance alone cannot, we’d be glad to hear from you.