Topic starter
10/07/2026 9:16 pm
TL;DR: Continuous controls monitoring replaces point-in-time compliance checks with executable tests against live environments, and JupiterOne argues that this closes control drift while cutting audit findings by 50 to 70 percent and audit prep from over 200 hours to 20 to 30 hours. The shift matters because organisations can prove controls are working continuously, not just that evidence exists once a year.
Editorial analysis by NHI Mgmt Group, based on content published by JupiterOne: “The Compliance Industry Automated the Wrong Thing”.
By the numbers:
- 79 percent of organizations still report being surprised by security incidents that bypassed their controls.
Key questions
Q: What breaks when compliance is measured only at audit time?
A: Point-in-time compliance misses the gap between evidence collection and real operations.
Q: Why do continuous controls matter more in identity-heavy environments?
A: Identity systems change through groups, roles, and provisioning workflows that can quietly expand access after the last review.
Q: How do security teams know whether their control assessment process is working?
A: A working assessment process produces current documentation, clear remediation ownership, timely closure evidence, and results that match what the environment actually shows.
Practitioner guidance
- Encode controls as live-state tests Turn high-risk requirements into executable checks against current cloud, identity, and data relationships so drift is detected continuously instead of at review time.
- Prioritise access paths to production data Start with controls that validate who can reach sensitive data, how those permissions are granted, and whether group or role changes have altered the intended boundary.
- Map one control across multiple frameworks Build a single control that satisfies overlapping obligations where the control objective is the same, then reuse the evidence record for SOC 2, ISO 27001, or PCI DSS reporting.
Bottom line: Point-in-time compliance checks can miss control drift because the environment often changes faster than the audit cycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:39 pm
Continuous controls monitoring is really identity governance for the live environment. The article shows that the practical problem is not whether an entitlement or configuration once passed review, but whether it still matches the intended control state after automation and change have taken effect. For IAM teams, this reframes governance from attestation to ongoing verification. The practitioner conclusion is simple: if access paths can change continuously, control validation must do the same.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Which compliance frameworks benefit most from reusable continuous controls?
A: Frameworks with overlapping control objectives benefit most, because the same live-state test can generate evidence for multiple obligations. The value is highest where organisations already need the same access, encryption, logging, or configuration outcome to satisfy several standards at once.
👉 Read our full editorial: Continuous controls monitoring exposes the compliance gap audits miss