Passing an audit and being secure are two different achievements

One of the questions I am often asked is whether achieving a certification such as ISO 27001, Cyber Essentials or PCI DSS means their business is secure. It is a reasonable question, and the honest answer is:

not necessarily.

Compliance is valuable, and I would never suggest otherwise, but it is easy to assume that a successful audit and a resilient organisation are the same thing. In my experience, they are related, but they are not interchangeable.

Why the two diverge

Most compliance frameworks were never designed to guarantee security. Their purpose is to establish minimum standards, create consistency and reduce risk across an industry. Frameworks such as ISO 27001, Cyber Essentials, PCI DSS and SOC 2 give organisations governance structures and operational discipline they might otherwise overlook.

The difficulty emerges when certification becomes the end goal rather than one component of a wider security strategy. A system can pass an audit while still containing unpatched vulnerabilities, access controls can satisfy a documented requirement while remaining far too permissive, an incident response plan can exist on paper and never have been tested under realistic conditions. In those situations, an organisation has become compliant without becoming resilient.

Key considerations

Audits assess evidence, not adversaries

A compliance assessment asks whether the required controls can be demonstrated. An attacker asks whether those controls can be bypassed, the perspective and the objective are fundamentally different. An auditor may confirm that a security policy exists, while an attacker tests whether people follow it. An auditor may verify that access reviews take place, while an attacker looks for a dormant account that was never switched off.

Security is dynamic, compliance is periodic

Most audits are a snapshot in time. An organisation might certify in January and then make substantial changes to its architecture, its people, its software and its suppliers by June. Threat actors exploit today’s weaknesses, not last quarter’s compliance status. Organisations that rely solely on scheduled assessments can develop blind spots between audit cycles, and those gaps tend to widen in periods of rapid change.

Documented controls are not always effective controls

Many organisations hold extensive documentation covering processes, governance and risk management. The important question is whether those controls work under pressure. An incident response procedure that has never been exercised may look robust. During a real incident, decision making bottlenecks, communication failures and operational dependencies often become visible for the first time and that is a difficult moment to discover them.

Real resilience requires testing

Security improves when assumptions are challenged. Penetration testing, phishing simulations, backup restoration tests, disaster recovery exercises and incident response rehearsals all reveal gaps that a compliance assessment is unlikely to find. They measure whether controls are effective, rather than whether the paperwork is complete.

Attackers do not respect compliance boundaries

Threat actors do not care which framework an organisation follows. They look for weaknesses wherever they exist: a third party supplier, a misconfigured cloud environment, exposed credentials, a legacy system or simple human error. A certificate may offer reassurance, but it provides little protection against weaknesses that sit outside the scope of the assessment.

An example from online gift cards

I see this distinction regularly in the gift card platforms we build. PCI DSS compliance is an important baseline. It governs how card data is processed, stored and transmitted, and we recommend secure payment gateways and regular security audits as a matter of course. However, a fully compliant payment process does not stop a fraudster using a stolen credit card to buy eGifts. The transaction can be technically valid and the controls can all be operating as documented, yet the business still loses money and a genuine cardholder is still harmed.

Addressing that risk requires measures that go beyond the standard. These include fraud screening that analyses patterns in transaction data, shared fraud intelligence, and a short delay before eGifts are released, which gives banks and payment providers time to flag compromised cards. None of these is a certification requirement. They exist because someone asked a different question: not “are we compliant?” but “how would someone abuse this?”

The business implications

Treating compliance as the primary measure of security can create assumptions that are hard to spot until they are tested. The consequences can include:

• Overconfidence in existing controls
• Underinvestment in resilience testing
• Delayed identification of vulnerabilities
• Reduced preparedness when a real incident occurs

A greater operational and financial impact when a breach happens

By contrast, organisations that combine compliance with ongoing validation, testing and improvement are generally better placed to detect, respond to and recover from security events.

Practical considerations

For founders and leadership teams, a few questions are worth asking:

• Do our security objectives extend beyond our compliance requirements? If the honest answer is that we only do what the standard asks, that is worth knowing.
• When did we last test our critical controls? Documentation tells you what should happen. Testing tells you what does.
• Have we exercised our incident response and disaster recovery plans realistically? Restoring from a backup is a very different experience from believing you could.
• Do we reassess after major change? A new platform, a new supplier or a significant change of team should prompt a fresh look.
• What do we report to the board? Operational resilience measures sit usefully alongside compliance status.

Reflection

Compliance reduces risk, but it does not eliminate it. Controls should be judged on whether they are effective, not simply whether they exist, and risk continues to change regardless of what is on the certificate. The companies I have seen demonstrate the strongest resilience treat compliance as a foundation to build upon rather than a finish line to cross. They value the discipline an audit brings, and then they keep testing, learning and adapting.

The question organisations should consider is not only “have we passed?” but “how confident are we that this would hold up on a bad day?” Hopefully these reflections help.