Many organisations invest significant time, effort, and budget into building an Information Security Management System (ISMS).
Standards are translated into policies, procedures, and eventually controls.
At that point, most organizations can answer a familiar question:
“Are we compliant?”
But there is a far more interesting question.
How quickly would we know if a control stopped working?
As frameworks such as ISO 27001, NIS2, BIO and sector-specific regulations continue to mature, organizations often find themselves managing hundreds of controls.
Testing those controls generally follows one of three approaches:
1. Audits
Independent and valuable.
But ultimately a sample-based and retrospective view of reality.
2. Manual control testing
Provides context and professional judgement.
However, it often requires skilled specialists to perform repetitive evidence collection and assessment activities.
3. Automated control testing
This is where the discussion changes:
Not just because it improves scalability and coverage;
but because it dramatically reduces the time between a control failure and its detection.
That leads to a metric we rarely discuss:
Mean Time To Detect Control Failure
MTTD-C
In simple terms:
How long does it take before an organization realizes that a security or compliance control is no longer effective?
Think about the implications.
If a control fails today:
- An audit-driven approach may discover it months later.
- Periodic manual testing may identify it after weeks or months.
- Automated monitoring may identify it within minutes or days.
The real value of automation is therefore not simply reducing operational effort.
The real value is reducing the period during which risks remain undetected.
Perhaps the future of governance, risk and compliance is not about asking:
“Are we compliant?”
but rather:
“How quickly do we know when we are no longer in control?”
That feels much closer to the real definition of cyber resilience.
Discuss on LinkedIn
