The Control Worked Yet The Company Still Got Breached - Episode 229

Passing an audit doesn't mean you're secure. In this episode of Compliance Unfiltered, Todd Coshow and Adam Goslin expose the critical gap between compliance and real cybersecurity. Learn why controls can pass every audit yet still fail to stop modern attacks, and why continuous validation is replacing point-in-time evidence. Discover how organizations should test resilience through penetration testing, red teaming, tabletop exercises, backup recovery, and control effectiveness—not just documentation. If you think "audit passed" equals "risk reduced," this episode will change the way you measure security forever.

Episode Transcript:

Today’s topic, Adam, is one that I feel like too many folks are familiar with, and that is the company still got breached despite all of your controls working.

So what happens when every box is checked, every control passes the audit, and the attacker still gets in?

Adam Goslin:
Controls can operate as designed, but still end up failing to protect the organization.

Compliance is measuring whether or not a control exists and if that control was executed. Security measures whether that control actually reduced the risk.

One of the earlier euphemisms that you would hear a lot is compliance doesn’t equal security.

What those people were getting at is that just because I have checked this box that says this thing’s in place doesn’t mean I’m actually secure.

The control working doesn’t necessarily mean the organization’s protected.

We need to make a shift from control execution to control effectiveness so that we can gain risk mitigation.

There’s also the possibility, and this happens to fewer of those organizations, but there’s a possibility that you’ve got a zero day out there.

But even in the case of a zero day, you’ve got a myriad of other controls that ought to be effective, where those detection mechanisms still have the ability to identify, “Hey, Houston, you got a problem.”

Whether it’s identifying control bypass through monitoring of central logging, unusual user activity with behavioral analytics, file integrity monitoring if you’re seeing files changing within the environment, failed attempts from inside the network as attackers are trying this, trying that, and trying the other thing.

There’s a reason why, even with zero days, it ends up seeing the light of day.

It’s about mitigating the amount of time between, “Houston, we got a problem,” and knowing that you have a problem.

Todd Coshow:
What’s the difference between a control operating as designed and a control actually being effective?

Adam Goslin:
When it’s operating, you’re checking the box. This thing happened.

But when a control is effective, it means that the risk was meaningfully reduced.

You can have every single person in your organization going and attending security awareness training and seeing their quarterly security reminders and the piece of paper that’s taped up on the inside of the bathroom door, and yet employees still fall for phishing attempts.

Maybe you’ve got a situation where an organization went in, ran their vuln scans, but they left vulnerabilities unpatched for a period of time.

There’s gonna be some period of time between recognition that I have a vulnerability and getting it cured, and depending on how long of a span that is.

It doesn’t necessarily have to be just critical vulnerability. A lot of people will obviously focus in on critical vulnerabilities.

But what they seem to miss in their vulnerability management is that oftentimes I can take two or three medium-level vulnerabilities and conjoin them to create something that’s far more impactful.