Compliance teams are facing a growing problem: an organisation can pass an audit one day and begin drifting out of compliance shortly afterwards, simply because its infrastructure has changed. Gal Yosef, Regional SE Director at AlgoSec, explores why ‘point-in-time’ compliance is increasingly struggling to keep pace with modern hybrid infrastructure and why organisations need to move towards continuous compliance and evidence of control.
Compliance is difficult for many reasons, but perhaps one of the hardest things to get right is timing.
An organisation might pass an audit on Monday and begin drifting out of compliance by Wednesday, without anything necessarily going wrong or anybody even knowing about it. A cloud deployment might change an access rule, a temporary firewall exception might become permanent or a third-party service might update an integration according to its own schedule. These changes look innocuous in isolation, but that’s precisely what makes ‘timing’ such a perilous issue.
As they pile up, they create a growing mismatch between the controls an organisation has documented and the actual operating environment it finds itself in. That’s a problem in a basic network environment, let alone a hybrid set-up where applications and policies have to stretch across clouds, data centres, SaaS platforms and APIs. A quarterly review can only capture one moment, and compliance posture can change in the blink of an eye.
This is also becoming a key focal point for regulators, which is only adding to the pressure. DORA and NIS2 place greater emphasis on operational resilience, cybersecurity risk management, supply chain oversight and demonstrable accountability, making periodic evidence of good intentions increasingly inadequate. That pressure is now being reflected in business priorities. According to an Information Systems Audit and Control Association (ISACA) survey published in 2025, 66% of businesses now regard regulatory compliance as a major priority, closely followed by business continuity and resilience at 62%. Organisations are beginning to realise that they need to start thinking beyond the next audit.
Why ‘point-in-time’ compliance is breaking down
Traditional compliance models were built around infrastructure that changed slowly enough to be inspected at fixed intervals, so day-to-day checks were never really an issue. In the age of hybrid infrastructure, however, things look a little different. Cloud deployment pipelines, infrastructure-as-code updates, container orchestration and vendor-managed services have introduced a near-constant stream of changes, each of which can alter an organisation’s security and compliance posture from one hour to the next.
The structure of modern applications makes this especially difficult. A single business service might combine a public cloud front end, an on-premises database, authentication delivered through a SaaS provider, and connections to several third-party APIs. Different teams may own each component, apply different controls, and work through different management platforms. Every team can follow its own procedures correctly while gaps emerge between them, particularly where application traffic crosses environments or depends on infrastructure nobody can see in full. This fragmentation leaves compliance teams reconstructing evidence after changes have already taken place.
Configuration drift
Even well-designed controls can’t keep up with continuous change. Inevitably, emergency access permissions will at some point remain active for longer than required or a firewall rule that was meant to be temporary will persist due to a simple oversight. Even cloud policies can be accidentally duplicated across accounts, while vendor updates continuously roll in. Before an organisation knows it, ‘configuration drift’ has begun, and the gap between the organisation’s approved security policies and the controls operating across its infrastructure widens. According to AlgoSec research, maintaining consistent policies across on-premises and cloud environments is now the leading cloud security challenge, cited by 59% of practitioners.
Managing this drift requires an accurate, continuously updated view of application connectivity and the policies governing it. Every proposed change should be checked against security and compliance requirements before deployment, with exceptions recorded, monitored and removed when they expire. Automation can perform these checks consistently across environments, identify deviations as they emerge, and generate a clear record of what changed, who approved it and whether the resulting configuration remains compliant. This keeps governance aligned with the live environment, even as the infrastructure beneath it continues to move.
Governance must extend beyond the organisation
The compliance perimeter now stretches far beyond the infrastructure an organisation owns. A single application may depend on cloud providers, managed services, identity platforms, payment processors, software vendors and external APIs, each operating on its own infrastructure and change schedule. These relationships allow businesses to build and scale services quickly, but they also create dependencies that internal security tools may struggle to see. If teams cannot map which applications rely on which external services, they cannot fully assess how a supplier outage, configuration change or security incident could affect the wider business.
Modern regulations are making that lack of visibility harder to ignore. NIS2, for instance, requires covered organisations to address cybersecurity risks within their supply chains and supplier relationships, while DORA establishes specific requirements for managing ICT third-party risk in financial services. AlgoSec’s research also revealed that 65% of security teams believe third-party and supply chain risk management requires significant improvement, suggesting that regulatory expectations are advancing faster than many organisations’ ability to meet them. Vendor inventories, contracts and periodic assessments remain important, but they only describe the relationship on paper. Continuous compliance requires application-level visibility into how external services connect to the business, what access they have, which controls govern those connections and how dependencies change over time.
It turns governance into part of the organisation’s everyday operating model. When policies are enforced consistently, changes are validated before deployment, drift is identified early and evidence is generated automatically, teams can move faster with greater confidence and remain prepared for scrutiny at any moment. Put simply, continuous evidence of control keeps compliance aligned with the environment as it changes.
