Author: Dan Gregory

For more than a decade, organizations have been taught the following:

  • Equate cybersecurity maturity with compliance
  • Align to the right framework
  • Pass the audit
  • Close the findings
  • Repeat

And yet, breaches continue to increase in frequency and in less time.

Industry breach research consistently shows that most organizations suffering material breaches were technically compliant with at least one major security framework at the time of the incident. Compliance status alone has not proven to be a reliable predictor of breach avoidance.

Ponemon Institute Studies

The global average breach now costs $4.44 million, with U.S. breaches exceeding $10 million, even among organizations with mature security and compliance programs.

IBM – Cost of a Data Breach 2025 

Often at organizations that are technically compliant. This isn’t a failure of execution. It’s a failure of intent.

Compliance was never designed to stop attackers. It was designed to establish a “minimum, auditable baseline”.  Somewhere along the way, that baseline quietly became the goal.  Security programs shifted from reducing risk to producing evidence.

The result is a dangerous illusion: organizations that look strong on paper while remaining fragile in reality.

The Compliance Illusion

Compliance frameworks are static by design. Attackers are not.

Frameworks define what should exist. Attackers test what actually works. When security programs optimize around audit cycles, evidence collection, and formal closure of findings, they unintentionally deprioritize the conditions attackers exploit most:

  • Gaps between controls
  • Identity sprawl and excessive privilege
  • Misconfigurations that aren’t explicitly tested
  • Inconsistent ownership and accountability
  • Weak coordination during incidents

Multiple breach studies show that compliance alignment has little correlation with whether an organization detects or contains an attack early—only whether controls existed on paper.

The paperwork may be pristine. The attack paths remain.

Many breaches occur in environments where formal security controls were already in place.

Verizon’s 2025 DBIR

We routinely see organizations that pass audits struggle during incidents to answer basic questions:

  • Who has authority to contain?
  • What systems matter most right now?
  • What data is actually exposed?
  • Which controls failed, and were they ever tested outside an audit?

Compliance creates confidence. Incidents test competence. Those are not the same thing.

When “More Compliance” Means Less Security

Most compliance programs reward coverage, not effectiveness.

Controls are implemented broadly but shallowly, just enough to satisfy requirements, not enough to withstand adversarial behavior. Over time, this creates familiar patterns:

  • Controls that exist but aren’t monitored
  • Tools that are deployed but not operationalized
  • Risk registers that describe issues but don’t influence decisions
  • Metrics that track closure instead of risk reduction

In many organizations, compliance work consumes the same resources required to improve real security: senior staff time, engineering focus, and leadership attention.

According to industry breach analysis, organizations that over-index on compliance activities often experience longer breach lifecycles, not shorter ones—largely due to unclear ownership, under-tested controls, and delayed decision-making during incidents.

Mandiant M-Trends Report 2025

This isn’t because teams don’t care, it’s because incentives matter, and compliance incentives rarely align with attacker behavior.

Attackers Don’t Care What You’re Certified In

Threat actors don’t target frameworks. They target conditions.

They look for:

  • Weak identity controls and token abuse
  • Over-privileged accounts
  • Poor segmentation and lateral movement paths
  • Exposed or poorly monitored edge systems
  • Forgotten SaaS integrations
  • Backup and recovery processes that haven’t been tested under pressure

Stolen credentials as an initial access vector rose to 16% of intrusions in 2024, up from roughly 10% the year before.

Mandiant M-Trends Report 2025 

They don’t ask whether a control exists. They ask whether it works, and whether anyone will notice when it fails.

Certification doesn’t slow attackers down. Operational friction does.

Most organizations discover the difference only after an incident, when compliance reports offer little guidance on what to do next.

Modern breach data shows that roughly 70–80% of successful attacks involve compromised credentials, identity misuse, or privilege abuse—areas where compliance controls frequently exist but are poorly enforced or monitored.

Verizon 2025 DBIR Report

Why Compliance Still Matters, Just Not the Way Most Organizations Use It

This isn’t an argument against compliance.

Compliance is essential for governance, accountability, and baseline hygiene. But it is foundational, not transformational. Treating it as the finish line distorts priorities and masks risk.

High-performing security programs understand this distinction:

  • Compliance defines what must exist
  • Security ensures what must work
  • Resilience determines what survives failure

When compliance leads, security drifts toward documentation. When security leads, compliance becomes a byproduct of disciplined execution.

What Effective Security Programs Do Differently

Organizations that withstand modern threats don’t start with frameworks. They start with reality.

Ask yourself:

  • How would we actually be attacked?
  • Where would detection or response fail?
  • What assumptions are we making about control effectiveness?
  • Who makes decisions under pressure, and with what information?

Then prioritize:

  • Identity over perimeter
  • Context over severity labels
  • Visibility over volume
  • Practiced response over documented intent

Frameworks inform decisions; they don’t dictate them. Audits are passed because the program works, not because it was built to pass audits.

That shift, from evidence-first to outcome-first, changes everything.

The Question Leaders Rarely Ask

The most important question isn’t:

“Are we compliant?”

It’s:

“If we were breached tomorrow, would we be surprised by where it happened, or by how we responded?”

If the answer is yes, compliance has become camouflage.

Post-incident reviews show that more than half of organizations experience confusion around decision-making, ownership, or authority during the first 24 hours of a major incident—exactly when speed matters most.

IBM – Cost of a Data Breach 2025 

That question exposes gaps no checklist can and forces leaders to confront whether security is a living capability or a static report.

Questions Worth Asking Your Team

These questions are meant to challenge assumptions.

  • If our compliance requirements disappeared tomorrow, which controls would we still fund and defend?
  • Which controls exist primarily to satisfy audits rather than reduce real-world risk?
  • Do we measure success by findings closed, or by attack paths eliminated?
  • When was the last time we validated our most critical controls outside an audit or tabletop?
  • If an attacker gained access today, would our teams agree on what matters most in the first 24 hours?
  • Where do we rely on assumptions instead of evidence?
  • Which security decisions are driven by fear of audit findings rather than threat reality?
  • If we had to explain our security posture to the board without referencing frameworks, could we?

If these are hard to answer clearly, that’s not failure, it’s insight.

A Different Conversation About Security

Most cybersecurity conversations revolve around tools, frameworks, and compliance status. Very few focus on operational truth.

At Astro, our work often starts by pressure-testing assumptions:

  • What do you believe is protecting you?
  • What evidence supports that belief?
  • Where would reality break under stress?

This isn’t about dismantling compliance programs. It’s about ensuring they don’t become substitutes for security.