Boards demand proof: security controls need live testing

Boards, customers and regulators are asking for proof that security controls are working in real time. Security teams are shifting from annual audits and sampling to automated continuous control monitoring to provide current evidence of control effectiveness. When asked whether controls are working now, many CISOs respond, “we think so.”

Security leaders point to control drift as a reason for the change. Firewall ports opened for short integrations can remain open for months, vendors can change configurations after a review, and new systems can come online between audit windows. A 2025 study by Dell found 69 percent of IT professionals believe leadership overestimates their organisation’s readiness for a cyber event.

Continuous control monitoring replaces periodic sampling with ongoing checks against live data. Teams run daily or more frequent tests to identify changes in the environment and to assess whether those changes affect contracts, regulatory obligations or customer commitments.

Common targets for continuous monitoring include identity and access controls, cloud configuration drift, the remediation status of critical vulnerabilities and the security posture of third-party vendors. Security teams feed those automated checks into governance, risk and compliance records so the state of controls reflects current conditions rather than past snapshots.

Some security staff raise concerns about increased alert volume. Proponents describe a different approach: prioritize signals by the business impact of a control failure so low-risk misconfigurations can be deferred while failures that affect customer contracts or regulatory requirements receive immediate attention.

Standards bodies have adjusted guidance to reflect continuous measurement. In 2024, the National Institute of Standards and Technology updated its Cybersecurity Framework to add a Govern function that treats cybersecurity as enterprise risk to be managed with continuous, measurable outcomes.

Organisations do not always need to replace existing governance, risk and compliance systems. Many can keep their system of record and change the inputs by replacing manual attestations and sampled snapshots with automated feeds that report the daily state of controls.

Industry sources report the shift is changing how security teams allocate resources and report to senior management, with a greater emphasis on providing current evidence of control effectiveness rather than reporting effort or the absence of incidents. The trend toward continuous control monitoring is intended to provide verifiable, real-time evidence of whether controls are working.