Topic starter
02/08/2026 11:53 am
TL;DR: Security teams often run 30+ controls, yet default configurations only cover roughly 70% of known threats, leaving a proof gap between expected protection and demonstrated resilience, according to Cymulate. The practical shift is from static coverage and dashboards to continuous validation, remediation, and re-testing against real attacker techniques.
Editorial analysis by NHI Mgmt Group, based on content published by Cymulate: “Security Spent a Decade Finding More. It Should Have Been Proving More.”.
By the numbers:
- The average enterprise runs 30+ security controls, according to Cymulate.
- Default configurations protect against roughly 70% of known threats, according to Cymulate.
Key questions
Q: What is the first thing security teams should do when control coverage is high but proof is weak?
A: Start with one control family that protects a high-value asset, then test it against the attack techniques most likely to matter in your environment.
Q: Why does a strong control inventory still leave organisations exposed?
A: Because inventory shows what is deployed, not what is actually stopped under real conditions.
Q: What are the signs that a validation program is losing control?
A: Common signs include duplicated testing across platforms, findings that never reach an owner, repeated remediation on the same control, and inconsistent results from different tools.
Practitioner guidance
- Implement continuous control validation Test the controls that matter in your environment against real attacker techniques, then re-test after every material change to prove the gap is closed.
- Prioritise technique-level proof for high-risk controls Focus first on EDR, email security, SIEM, and identity controls where a failed assumption creates immediate business risk, and document what each one actually stops.
- Shorten the risk-to-fix window Measure the time between identifying a threat and validating effective protection, not just the time to create tickets or complete reviews.
Bottom line: The central problem is not control absence but proof absence, because many organisations cannot show which attacker techniques their existing controls actually block.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:01 pm
Control proof is becoming the real security currency: the industry has moved far enough beyond simple deployment counts that the next governance question is whether a control demonstrably stops the technique it is supposed to stop. That is a different standard from configuration compliance or tool coverage, and it changes how boards, auditors, and security leaders should assess resilience. The practitioner conclusion is straightforward: evidence of blocked technique matters more than inventory of installed controls.
A question worth separating out:
Q: Should organisations prioritise continuous validation over adding more tools?
A: Yes, when the main problem is uncertainty about what existing controls really stop. Adding tools can expand coverage, but it does not close the proof gap unless the new control is also tested against the techniques that matter. The better sequence is to validate, improve, and only then decide whether a new tool is actually needed.
👉 Read our full editorial: Security teams must prove controls work, not just find more gaps