Compliance Theater: Why Audits Pass and Breaches Happen

Key Takeaways

• Multiple companies held valid certifications when attackers got in. A clean report and a working security program are two different things.
• Audits test a sampled slice of a management-defined scope during a fixed window, so they miss what changes outside that window by design.
• Security drift shows up quietly after the report ships, and sustaining compliance year over year is where most programs slip.
• A second audit typically covers a longer period than the first, giving unnoticed drift more room to surface. If it does, there may be no easy fix, and the exception can end up on the report.
• Continuous enforcement keeps the environment matching the certificate, catching drift before the next audit finds it.

Compliance theater is what happens when a company passes its audit but the security behind the certificate never has to keep working. Target, Equifax, and LastPass had all passed major compliance checks before their breaches came out. The certificates were real, but the audit window was too narrow to prove what was running everywhere, every day. What they thought they had was protection, but it turned out all they had was compliance theater.

Want to see what Zip shows about your controls right now? Get a live demo and see live coverage data across your environment.

When Valid Certificates Didn't Stop the Breach

Here's what happened to each of these companies, and why passing an audit wasn't enough to keep them protected. Each had sign-off from a real auditor on a real framework, not a rubber-stamped shortcut.

Company	Compliance status at breach	What failed
Target (2013)	Recently passed PCI-DSS Level 1	Attackers stole login credentials from a heating, ventilation, and air conditioning (HVAC) vendor in November 2013. Because Target hadn't properly separated its vendor network from the payment network, those same credentials let attackers reach point-of-sale systems and install malware that captured tens of millions of card numbers.
Equifax (2017)	ISO 27001 certification program	Equifax never patched a known flaw in its Apache Struts software, letting attackers in. An expired certificate on the device that inspected encrypted network traffic left it blind for months, so nobody noticed the exfiltration until the certificate was renewed, by which point millions of people's data was exposed.
LastPass (2022)	SOC 2 Type II, SOC 3, and ISO 27001 certifications	Attackers got in through a third-party cloud storage system outside the SOC 2 audit's scope, using keylogger malware on an engineer's home computer to capture the master password needed to unlock the backup decryption keys.

Audits target what's running today, on every system, whether or not it was ever in scope.

Why Compliance Theater Survives the Audit

Compliance theater usually traces back to the audit process itself, not to careless auditors. A handful of structural choices create the same blind spots in nearly every audit, no matter who's running it:

• The audit window is fixed. Between audit periods, teams add new systems, change configurations, and see staff turnover, all without a required security review in between. A SOC 2 report only covers its own observation period.
• Auditors review a representative slice of evidence rather than every event, and that sampling can leave some operational areas unchecked.
• The system description sets the boundaries in advance, and the auditor doesn't test anything outside them, even if it's part of daily operations. At LastPass, the breach traveled through a system that fell outside those boundaries.
• A team can document a control without enforcing it day to day. Documentation proves a team designed the control, not that it kept running after the audit ended.

Audits cannot see what changes between one audit and the next, or anything outside the scope management defines, and sampling adds another blind spot. The controls most likely to fail are the ones nobody rechecks once they're running quietly in the background.

The Controls That Determine Whether You're Secure

Drift tends to cluster in the same five places:

• Multi-factor authentication (MFA). Just 70% of users across Okta's own workforce customer base had MFA adoption in place as of January 2025, which leaves close to a third signing in with a password alone. A federal threat-hunt review calls for enforcing MFA on every remote access method, since that path remains a common way in.
• Endpoint detection and response (EDR). A 2025 federal agency breach traced back to EDR alerts nobody continuously reviewed. An EDR agent in detect-only mode will see an attack happen and not stop it.
• Mobile device management (MDM). When enrollment is incomplete and nobody enforces policies well, blind spots grow along with the number of devices. That gets worse when teams don't know how many devices they're supposed to be tracking in the first place.
• Offboarding. Former employees can retain access to email, software, and financial information after layoffs when deprovisioning is incomplete.
• Interim reviews. Checking controls between audit cycles is the only way to catch drift before it becomes a finding. Skip those checks, and small failures can add up into a real compliance lapse by the time the next audit happens.

A department of one or two can't re-verify all of this by hand every week, and they shouldn't have to. Automation that continuously checks every control and fixes drift the moment it appears stops configuration drift from turning into next year's audit exception. Zip runs exactly that kind of automation for teams that can't staff a full-time reviewer, watching EDR sensor health, device enrollment, and offboarding continuously instead of catching them during a quarterly sweep. Zip surfaces and fixes drift before it reaches an audit, not after.

Year Two Is Where the Drift Shows Up

A first SOC 2 Type II report usually spans a short observation window. The second one stretches across the full twelve months since the last audit, pulling in any drift that went unnoticed the first year. Fixing a control after the fact doesn't erase a failure that happened inside that window, and it still shows up as an exception on the report, meaning a team ends up explaining it to auditors or restarting the audit cycle entirely. The controls most likely to fail tend to be the ones a team only checks once a year:

• Risk assessments done as paperwork, or skipped entirely
• Vendor reviews that slide as the vendor list grows
• Tabletop disaster recovery exercises deferred at small companies
• Missed offboarding steps during fast hiring that later surface as "where is that person's laptop?"
• Change documentation drifting away from how the team operates day to day

Commercial pressure rises in year two. Year two often brings the fastest customer growth, which is when customers review the new report most closely during renewals and vendor reviews. Teams that keep a steady review rhythm walk into year two with nothing to excavate.

Technical controls should already run and stay under continuous review. Risk assessments, vendor reviews, and tabletop exercises are different, since they only happen once a year, so each one needs a named owner and a spot on a calendar. Fractional and virtual CISOs (vCISOs) who do this well treat it as a monthly check-in rather than an annual scramble, which is how their clients stay audit-ready all year.

How to Turn Compliance Theater Into Real Security

Catching most drift doesn't take a consulting engagement or a new tool. A short quarterly review, covering a handful of specific spots, takes an hour or less to run by hand. Run it automatically instead, and the same review catches drift every day instead of once a quarter. Start with the controls that touch identity first, since that's where attackers look.

1. Verify MFA runs on technical policy, not paperwork. Automated monitoring should flag non-compliant accounts as soon as they appear, since blind spots cluster around new hires and phone migrations.
2. Check whether EDR blocks the attack or just watches it happen. On Windows, Get-MpComputerStatus | select AMRunningMode shows whether Defender mode is active or passive. For CrowdStrike, use policy configuration to set prevention because sensor installation alone only proves the agent is present.
3. Pull the real device count from MDM before trusting the enrollment percentage. Comparing identity provider records against MDM enrollment automatically surfaces any mismatch before an audit does.
4. Look at how fast access disappears once someone leaves. Deprovisioning that runs through the identity provider should close accounts and revoke device access the moment HR marks someone as departed. That's usually where audits and telemetry find lingering access.
5. Ask whether the evidence reflects what's running right now or last quarter's export. Continuous, autonomous security monitoring replaces the screenshot scramble and lets teams query what was running on day X.

These checks catch most drift before an auditor does, whether a person runs them or automation does. The harder part is keeping them running every quarter, on top of everything else a lean team already owns.

Compliance as an Operating Posture

Checking those five spots on a schedule still means catching drift after it already happened. The real fix is enforcing the same controls automatically and continuously, instead of waiting for the calendar to remind you. Vanta and Drata are good at showing what your connected tools already report, but that reporting only reflects what's true the moment you pull it. Something still has to keep the controls themselves honest in between.

Zip is that enforcement layer, a Built and Managed Security Platform (BMSP) for lean teams. Jamf, Microsoft Intune, CrowdStrike, and your identity provider stay exactly what they are, separate tools each doing their own job, and Zip's role is keeping them agreeing with each other automatically instead of you logging into four consoles to find out they don't. Miss a layer entirely, no MDM in place at all, say, and Zip procures and deploys the right tool itself rather than leaving that blind spot for an auditor to find first.

That same automation catches drift the moment it happens instead of a quarter later. When a device drops out of enrollment or an agent stops reporting in, Zip fixes it or flags it for someone to act on, then writes the fix to the audit trail so there's nothing left to reconstruct when an auditor asks. Staying compliant stops being its own project and becomes a byproduct of the enforcement running underneath it.

BD Emerson ran into this pattern constantly with its own clients. A company would pass a SOC 2 audit, then drift out of compliance within a year once nobody owned enforcement day to day. Rather than build out its own managed services team, the consulting firm layered Zip in as the enforcement piece behind its advisory work, part of the continuous compliance strategy it now runs across its whole client portfolio. Clients maintain audit-ready compliance across SOC 2 and NIST, saving more than $200,000 a year each that would otherwise go toward a dedicated compliance hire.

Ready to close the distance between what your report says and what's running? Get a live demo and see it yourself in 14 days or less.

Frequently Asked Questions About Compliance Theater

What is the difference between compliance theater and checkbox compliance?

Checkbox compliance is the narrower problem, security work that looks good on paper while treating real risk reduction as an afterthought. Compliance theater is the bigger pattern, the surface-level processes that create an illusion of governance without protecting the company. Both tend to show up when security work only happens in the weeks before an audit.

How can I spot a low-quality SOC 2 report?

Use the report review basics as your diligence checklist. Check the signing certified public accountant (CPA), the scope, the testing detail, and whether the Type II observation period is long enough to be meaningful. Read the exceptions instead of stopping at the opinion letter, since a report with zero exceptions is one that needs a closer look, not less.

Do enterprise customers accept a SOC 2 report on its own?

Less and less. Buyers now expect penetration test results that hold up under retesting, live control evidence with logs as proof, and records of vendor AI use, which jumped from 36% to 51% of companies in one year. Treat the SOC 2 report as the first piece of a vendor risk assessment, not the whole file.

Is maintaining compliance cheaper than losing it?

By a wide margin. Losing compliance can stall revenue, trigger customer security reviews, and turn a breach into a fight over insurance and contracts. Staying compliant keeps the controls and evidence current before those costs pile up.