Annual Audits Leave Organisations Blind to Drifting Cyber Risk

Security and compliance assessments based on annual audits and sampling may no longer give organisations a reliable picture of their current cyber risk, according to SecurityWeek contributor Sravish Sridhar, founder and chief executive of TrustCloud. He cites a 2025 Dell study in which 69% of IT professionals said their leadership overestimates the organisation’s readiness for a cyber event.

The article argues that controls can drift soon after an audit: temporary firewall changes may remain in place, suppliers may alter configurations and new systems may be deployed between review periods.

Sridhar recommends continuous control monitoring, which tests controls against live data rather than reconstructing evidence on an audit timetable. Areas to monitor include identity and access, frequently changing cloud configurations, remediation timelines for critical vulnerabilities and suppliers with access to sensitive data.

He says this approach does not require replacing existing governance, risk and compliance systems; instead, organisations should replace manual, point-in-time and sample-based inputs with automated, comprehensive evidence. The article acknowledges concerns that continuous monitoring could increase alert volumes, but argues that prioritising failures according to affected contracts, customers, regulatory obligations and business-critical systems should reduce unproductive noise.

It also points to the Govern function added to the NIST Cybersecurity Framework in 2024 as evidence of a broader shift towards treating cybersecurity as measurable, continuously managed enterprise risk.