Topic starter
06/11/2026 6:37 pm
TL;DR: Passing PCI DSS, ISO 27001, SOC 2, or HIPAA proves controls existed at a point in time, not that they kept working, as Admin By Request’s analysis argues, with Target’s 2013 breach as an example. Audit evidence is a baseline, not a guarantee; when scope gaps, vendor access, and ignored alerts persist, compliance can coexist with compromise.
Editorial analysis by NHI Mgmt Group, based on content published by Admin By Request: “Compliant but Still Breached: Why Security Doesn’t Stop at the Audit”.
Key questions
Q: How should teams handle access that sits outside compliance scope?
A: Treat it as unmanaged access and bring it into the control set quickly, even if the access is outside a formal compliance boundary.
Q: Why do organisations pass audits and still suffer identity-related breaches?
A: Because audits usually confirm that controls were documented and performed, not that access was actually safe at runtime.
Q: Why do third-party accounts create disproportionate breach risk?
A: Third-party accounts often connect external operators directly to production systems, support tools, or sensitive data with wider scope than internal users need.
Practitioner guidance
- Enforce continuous access review outside audit windows Review privileged and vendor access on an operating cadence that is shorter than your certification cycle, and require proof that removals actually took effect at the endpoint and directory level.
- Map third-party access to an owner and expiry condition Maintain a living inventory of external credentials, support accounts, and contractor paths, then tie each one to a named owner and a revocation trigger.
- Test whether monitoring triggers real response Run tabletop and live-response checks that start from an alert, then verify who triages it, who approves containment, and how quickly action begins.
Bottom line: This breach pattern shows that compliance evidence can coexist with weak real-world enforcement when access and monitoring drift after the audit.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Compliance is a control snapshot, not a security guarantee. A certification can confirm that a control existed when sampled, but it cannot prove that the control survived drift, change, and operational neglect. That distinction matters because attackers exploit live state, not audit state. Practitioners should treat compliance as evidence of baseline discipline, not proof of current protection.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: What should teams do when alerts are generated but not acted on?
A: They should investigate why the alert was generated, determine whether it is a false positive or a missed escalation, and route it into an accountable response process. That usually means triage rules, severity thresholds, ticketing, analyst ownership and playbooks for containment, eradication or closure. Repeatedly unhandled alerts are a detection gap, not just an operations issue.
👉 Read our full editorial: Compliance snapshots fail when access and monitoring drift