By Vinod Kumar
Cybersecurity and AI-governance leader focused on continuous assurance, third-party trust, and accountable technology transformation
Passing an audit can create a dangerous sense of security. An organization may possess a certification, an approved assessment, or a completed compliance review while still carrying risks that have not been adequately tested, documented, or understood.
This gap between appearing secure and proving that security controls operate effectively is one of the most important challenges facing modern enterprises.
Security and compliance serve different but complementary purposes. Security reduces the likelihood and impact of harm. Compliance demonstrates—through credible evidence—that required protections exist and function as intended.
Organizations need both. Strong controls without reliable evidence are difficult to validate, govern, or defend. Comprehensive documentation without effective controls creates confidence without protection.
The future belongs to organizations that can connect security, compliance, and governance through continuous assurance.
Most mature organizations do not lack security controls. They have policies, vendor assessments, monitoring systems, incident-response plans, access reviews, vulnerability-management programs, and compliance frameworks.
What they often lack is reliable evidence that these controls operate consistently across the entire business.
A control may function correctly during an annual assessment but fail several months later because of a configuration change. A vendor may meet requirements at onboarding but introduce new risks through an integration, acquisition, subcontractor, or product update. An access review may be completed on time while failing to identify excessive privileges in a connected cloud service.
The central question is therefore not whether a control existed at a particular point in time. It is whether the organization can demonstrate that the control remains effective as its operating environment changes.
This evidence gap creates two distinct risks:
Evidence must do more than confirm that an activity occurred. It must accurately represent the current state of risk.
Traditional assurance models were designed around periodic reviews. Evidence was collected, assessed, and presented during an annual or quarterly audit cycle.
That model is increasingly incompatible with modern technology environments.
Cloud infrastructure changes continuously. Software is released through automated pipelines. Vendors connect to sensitive workflows through APIs. Employees adopt new services before security teams obtain complete visibility. Data moves between platforms, regions, and organizational boundaries.
If a system changes every day, proof of its security cannot be treated as an annual event.
Organizations need a continuous way to determine:
Continuous assurance does not mean performing a full audit every day. It means creating an operating model in which evidence is generated, evaluated, and maintained as part of normal business and engineering activity.
Continuous assurance combines technical telemetry, governance processes, ownership information, and risk-based decision-making.
An effective model includes several capabilities.
Organizations should identify which controls can be monitored through technical signals. Examples include encryption status, privileged-access activity, endpoint coverage, vulnerability exposure, security-logging configuration, backup completion, and cloud-policy compliance.
The objective is not simply to collect more data. Monitoring should provide meaningful evidence about whether a control is operating within defined expectations.
Evidence should be generated through normal operational processes rather than reconstructed immediately before an audit.
Security approvals, access decisions, vulnerability exceptions, vendor reviews, incident actions, and architecture decisions should produce durable evidence at the time they occur.
This approach improves accuracy because the evidence remains connected to the decision, the system, the owner, and the relevant risk.
Every significant control, risk, and exception should have an accountable owner.
Shared responsibility is necessary in complex environments, but shared responsibility must not become undefined responsibility. When a control fails, the organization should know who investigates it, who remediates it, who verifies the correction, and who accepts any remaining risk.
More evidence does not necessarily create greater assurance. Evidence must be timely, complete, reliable, traceable, and relevant to the control being assessed.
A screenshot may demonstrate that a setting existed at one moment. It may not prove that the setting remained active, covered every applicable system, or could not be changed without detection.
High-quality evidence should answer not only “Was the control present?” but also “Was it effective across the required scope and period?”
Modern organizations no longer operate only within systems they directly build and control. They depend on vendors, partners, cloud platforms, APIs, integrations, managed services, and software supply chains.
Every connection extends the organization’s security boundary.
Third-party risk is therefore not limited to whether a vendor has completed a questionnaire or obtained a certification. Organizations must understand:
Third-party trust must be based on demonstrated behavior, not reputation alone.
An assessment should also reflect the risk created by the specific relationship. The same provider may represent limited risk in one use case and material risk in another, depending on its access, data exposure, operational dependency, and role in critical business processes.
A vendor assessment conducted during procurement provides only a starting point. Risk changes after onboarding.
The vendor may release new features, modify its infrastructure, change data-processing locations, introduce artificial intelligence capabilities, or expand its access to enterprise systems. The organization may also begin using the service for purposes that were not considered during the original review.
A scalable third-party assurance program should therefore include:
The goal is not to eliminate every third-party risk. The goal is to make each material risk visible, understood, owned, and proportionate to the business value of the relationship.
Artificial intelligence introduces questions that traditional vendor-risk frameworks were not designed to answer.
Conventional assessments generally focus on access control, data protection, availability, incident response, vulnerability management, and business continuity. These areas remain important, but AI systems introduce additional concerns involving data use, model behavior, explainability, intellectual property, human oversight, and accountability.
Organizations evaluating an AI provider should consider:
AI risk cannot be understood exclusively through a generic questionnaire. It must be evaluated within the specific operating environment and business decision in which the system will be used.
Shadow AI occurs when employees use AI tools outside established approval, security, privacy, or governance processes.
The immediate concern is often data leakage. However, the wider issue is the loss of evidence and accountability.
If an unapproved AI service influences a business decision, the organization may have no reliable record of:
Organizations should not address shadow AI solely through prohibition. They need approved alternatives, practical usage standards, employee education, technical visibility, and risk-based pathways for evaluating new tools.
Governance should make responsible adoption easier than unmanaged adoption.
Standards and frameworks such as ISO/IEC 27001, SOC 2, the NIST AI Risk Management Framework, and ISO/IEC 42001 provide valuable structures for security and AI governance.
They establish a shared language, define control expectations, and help organizations organize complex programs.
However, a framework cannot prove that the required work is occurring.
A framework can identify what should be demonstrated. Proof must come from how teams design systems, make decisions, record evidence, monitor controls, resolve exceptions, and maintain accountability.
Organizations should avoid treating frameworks as substitutes for engineering and operational discipline. The objective is not simply to map controls to requirements. It is to translate those requirements into repeatable activities that operate under real production conditions.
Technology can automate evidence collection, detect configuration drift, monitor vendor exposure, and identify anomalous activity. These capabilities are important, especially at enterprise scale.
But tools cannot compensate for weak accountability.
A platform cannot determine whether leadership genuinely owns cyber risk. It cannot resolve unclear decision rights, create trust between teams, or ensure that business priorities include responsible AI adoption.
Security and governance are leadership responsibilities before they are technology responsibilities.
Leaders must establish:
Tools can support discipline. They cannot create discipline in a culture that refuses to own the work.
Organizations moving toward continuous assurance should begin with a focused, risk-based approach.
Start with the business processes, systems, vendors, and AI use cases where incorrect assumptions could cause material harm.
Determine what evidence would credibly demonstrate that each important control is operating effectively.
Every evidence source should connect to a control, system, business process, and accountable person.
Prioritize controls where automation can reduce manual effort, improve coverage, detect change, or shorten exposure.
High-impact security and AI decisions require human judgment. Automation should provide context and consistency without removing accountability.
Organizations should test whether their evidence survives realistic scrutiny. Tabletop exercises, control validation, penetration testing, incident simulations, and audit-readiness reviews can reveal gaps between documented processes and operational reality.
Continuous assurance is not a single implementation project. It is a management system that should evolve alongside technology, regulation, business operations, and emerging threats.
The future of enterprise trust will not be defined by the organizations with the most polished policy documents or the largest collection of compliance reports.
It will be defined by organizations that can demonstrate what is true as conditions change.
Cloud security, third-party trust, and AI governance are converging around a common requirement: reliable, current, and accountable evidence. Organizations must be able to show that controls operate in production, that risks have owners, that exceptions are governed, and that security decisions can withstand scrutiny.
Research, frameworks, standards, and technology all matter. Their value, however, is realized only when they become part of the way real systems operate at scale.
Trust is not earned by passing one audit. It is earned continuously.
Vinod Kumar is a cybersecurity and technology leader with extensive experience across cloud security, third-party risk, enterprise governance, artificial intelligence, healthcare, manufacturing, high technology, and software-as-a-service environments.
He is an IEEE Senior Member and has authored peer-reviewed publications covering security, AI, and information-technology management. His professional interests include continuous assurance, third-party trust at scale, responsible AI governance, and translating security frameworks into operational practices that work in complex enterprise environments.
CDR is the runtime, real-time half of cloud security: while CSPM tells you what’s misconfigured,…
Your SaaS estate M365, Salesforce, Workday, Slack, hundreds of others is a sprawl of misconfigurations,…
DSPM finds sensitive data you didn’t know you had, classifies it, maps who can reach…
Open-source packages are meant to save developers time. In the GemStuffer campaign, that trust became…
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology…