For years, passing a security audit meant producing documents. A policy stating MFA is required. A screenshot from one point in time. A spreadsheet of last quarter's access review. The binder was the deliverable, and a good binder passed.
Auditors have started asking a harder question. Is the control actually working, right now?
The Gap Between Written and Working
A policy states what should be true. It says nothing about whether it is true today, for every identity, in an environment that's drifted since the last review. "We enforce phishing-resistant MFA" is a sentence. Whether every privileged account actually has it, whether an exception opened three weeks ago and never closed, whether a new SaaS app slipped outside the policy's scope: those are facts a document can't hold. Point-in-time evidence ages the moment it's captured. The environment keeps moving; the screenshot doesn't.
Effectiveness Is the New Bar
The shift is from proving a control exists to proving it works, and works consistently, not just on the day the auditor visits. That's a higher bar than most programs are built for. It rewards the teams who can account for how their controls are actually performing and honestly surface where enforcement has slipped. And it exposes the ones who mistook having a policy for enforcing one.
For identity especially, where configuration drifts daily and exceptions accumulate, the distance between the written policy and the working reality is usually wider than anyone wants to defend under questioning. Abnormal's identity posture work is built for exactly that gap — continuous visibility into whether controls are actually enforced, not just documented.
The audit is becoming a question about reality, not paperwork. The programs that thrive will be the ones that can already answer it on any given day.
See the latest from Abnormal's product and engineering teams.
