Category Archives: Compliance

A Secure Pipeline Is Not the Same as a Trustworthy Release

Posted on by
Reply

The deployment dashboard is green.

The build completed. The scanners ran. The change ticket is closed. The application is in production.

Now ask a harder question:

Can the organization prove that the software running in production came from the reviewed source, was built in the approved environment, passed the required controls, retained every accepted exception, and arrived without substitution?

If the answer is only, “The pipeline succeeded,” the organization has not answered the question.

A pipeline is a workflow. A trustworthy release is a security claim supported by evidence.

That distinction matters because modern delivery systems do more than compile code. They pull dependencies, execute third-party actions, create infrastructure, retrieve secrets, generate artifacts, promote packages, and deploy to production. A green status can show that automation reached its final step. It does not automatically prove that every important input was authorized, every control ran as intended, or the exact artifact that passed review is the artifact now operating.

The National Institute of Standards and Technology reinforced this point in a September 24 update to its live Secure Software Development, Security, and Operations Practices project. The new material maps the Secure Software Development Framework to a DevSecOps model and adds functional scenarios across the software lifecycle. Those scenarios connect build isolation, integrity checks, provenance, software bills of materials, test records, signing, release policy, and deployment verification.

The practical lesson is straightforward:

Do not trust a release because the pipeline is busy with security tools. Trust it when the evidence remains connected from approved input to verified production artifact.

Green Is a Workflow State, Not a Trust Decision

Security teams commonly describe a pipeline by listing its tools.

There is source-code analysis. There is dependency scanning. There is infrastructure-as-code scanning. There is secret detection. There may be container scanning, dynamic testing, artifact signing, and a software bill of materials.

Each capability can reduce risk. Together, however, they still may not answer basic release questions:

  • Which source commit was actually built?
  • Which dependencies and build instructions were used?
  • Which identity requested and executed the build?
  • Did every required control run, or was one skipped, disabled, or misconfigured?
  • Were findings resolved, suppressed, or accepted as risk?
  • Which immutable artifact was approved?
  • Was that exact artifact deployed?
  • Can the evidence be reconstructed after the pipeline logs expire?

A scanner can report on the artifact it received without proving that the artifact was the one later deployed. A signature can protect integrity without proving that the signer was authorized to approve the release. An SBOM can describe components without proving that the build environment was trustworthy. A ticket can record approval without being bound to a specific artifact digest.

These are not arguments against scanners, signatures, SBOMs, or change records. They are reasons to connect them.

NIST Special Publication 800-204D describes CI/CD pipelines as the flow that takes software through build, test, package, and deployment activities, and it outlines strategies for integrating software-supply-chain security into that flow. The security objective is therefore not merely to add controls at individual stages. It is to maintain confidence as software and evidence move between them. (NIST SP 800-204D)

That requires a release evidence chain.

Build the Release Evidence Chain

A useful release evidence chain answers four questions in sequence:

  1. What entered the build?
  2. What happened during the build and test process?
  3. What exactly was approved for release?
  4. What exactly reached production?

The value comes from continuity. If any link refers to a different commit, run, artifact, environment, or approval, the chain is incomplete.

1. Establish the Inputs

Start with the inputs that define the release.

At minimum, the evidence should identify:

  • The source repository and exact commit.
  • The approved change, review, or pull request.
  • The build definition and versioned pipeline configuration.
  • Direct dependencies and other retrieved build materials.
  • Infrastructure-as-code and deployment configuration.
  • The builder identity and requesting identity.
  • The target environment and release criteria.

This is where apparently reproducible work often becomes ambiguous. A pipeline may reference a mutable branch, a floating container tag, an unpinned third-party action, or a package version range. The build can succeed twice while consuming different material.

The Supply-chain Levels for Software Artifacts provenance specification defines provenance as verifiable information about where, when, and how an artifact was produced. Its model includes the build process, top-level inputs, resolved dependencies, builder identity, and output artifacts. Not every organization needs to implement the highest SLSA level immediately. Every organization should be able to identify the inputs that materially determine a production artifact.

The governing question is:

Can we reconstruct what the build trusted, not merely where the source repository lives?

2. Prove What Executed

The next link is the execution record.

NIST’s functional DevSecOps scenarios describe automated builds using ephemeral environments, integrated analysis, repeatable processes, and logged results. They also demonstrate integrity checks for source, commits, images, binaries, and libraries; provenance creation; signed SBOM generation; and captured scanning output. These are examples rather than universal prescriptions, but they show what trustworthy execution must make visible. (NIST functional demonstration scenarios)

For a consequential release, evidence should show:

  • The build ran in an approved and appropriately isolated environment.
  • The expected pipeline definition executed.
  • Required tests and security checks ran against the intended input or artifact.
  • Results were recorded, including tool errors and incomplete scans.
  • Policy gates evaluated those results.
  • Any manual intervention or override was attributable.
  • The build environment did not quietly modify the release after testing.

This last point is easy to miss. If a package is rebuilt during promotion, if configuration is injected outside the governed process, or if a production image is assembled from components different from those tested, the organization has created a new artifact. Prior evidence may no longer describe it.

The proof should also distinguish passed from did not run. An unavailable scanner, an empty report, a timed-out test, and a successful control are different states. A secure release process fails closed where risk demands it and makes degraded controls explicit where business continuity requires an exception.

3. Bind Approval to the Artifact

Release approval should name the thing being approved.

That normally means an immutable identifier such as a cryptographic digest, accompanied by evidence that explains why the artifact is eligible for promotion. The release packet can be assembled automatically and may include:

  • Artifact name, version, and digest.
  • Build provenance or attestation.
  • Signature and signing identity.
  • SBOM and dependency analysis.
  • Test and scan results.
  • Security and functional acceptance criteria.
  • Open findings and their disposition.
  • Approved exceptions, owners, expiration dates, and compensating controls.
  • Change and release approvals.

NIST’s new functional scenarios explicitly connect release documentation with records from tests, scans, and compliance checks. They also include signing and verification before deployment and policies intended to allow only signed, validated software from approved build and test processes to proceed. (NIST functional demonstration scenarios)

This is more than audit packaging.

If an approver accepts risk for artifact A, the approval should not be reusable for artifact B. If a critical scanner did not run, the record should not look identical to a fully tested release. If an emergency change bypasses a normal gate, the deviation should remain attached to the artifact until it is resolved or retired.

An exception hidden in a ticketing system is not part of the release decision unless the promotion process can find and enforce it.

4. Verify Promotion and Deployment

The final link is often the weakest.

Teams may secure the build, sign the artifact, and preserve provenance—then deploy by a path that does not verify any of it.

Provenance is useful only when a consumer checks it. The SLSA artifact-verification guidance calls for comparing the artifact with its provenance, validating the provenance signature, checking the builder identity, and confirming that build parameters match expectations.

At promotion and deployment, the organization should verify:

  • The artifact digest matches the approved release record.
  • The signature and attestation are authentic and valid.
  • The builder and signer are trusted for that application and environment.
  • Required evidence exists and satisfies policy.
  • The target environment received the approved immutable artifact.
  • Unauthorized or unsigned substitutions are rejected.
  • Deployment and runtime inventory can identify the artifact actually operating.

NIST’s scenarios carry this principle into deployment by verifying SBOM and provenance data before deployment and applying policies so only signed and validated software is deployed. The objective is not to sign everything and declare victory. It is to make authenticity and policy verification part of the consuming action.

This closes the most important gap:

The artifact that passed the controls must be the artifact that received the approval, and the artifact that received the approval must be the artifact that reached production.

An Evidence Packet Is Not a Folder Full of Reports

Organizations sometimes respond to assurance demands by saving more output.

That creates volume, not necessarily proof.

A release evidence packet should be machine-associated with a specific build and artifact. It should preserve relationships, not just documents:

  • Commit to build invocation.
  • Build invocation to artifact digest.
  • Artifact digest to test and scan results.
  • Findings to disposition and exception.
  • Approval to artifact digest.
  • Artifact digest to deployment event.
  • Deployment event to running workload or asset inventory.

The packet does not need to be a single file or a new platform. It can be a set of signed attestations, repository records, policy decisions, tickets, and deployment events. What matters is that the organization can follow the links without relying on memory, screenshots, or an engineer who remembers what happened.

The NIST Secure Software Development Framework is deliberately high-level so organizations can integrate its practices into different development lifecycles. That flexibility is useful. It also means leaders should define what evidence demonstrates each practice in their environment.

“We use the tool” is a capability statement.

“Here is the result for the exact artifact in production, and here is how policy consumed it” is an assurance statement.

Measure Evidence Continuity, Not Security-Tool Count

Counting pipeline tools rewards installation. Counting findings rewards detection volume. Neither measure shows whether the release decision can be trusted.

More useful measures include:

  • Percentage of production releases with verified provenance.
  • Percentage of deployments performed by immutable digest rather than mutable tag or name.
  • Percentage of production artifacts whose signature and approval were verified at deployment.
  • Percentage of required controls that produced a conclusive result for each release.
  • Percentage of exceptions linked to an artifact, named owner, compensating control, and expiration date.
  • Time required to identify the source, builder, evidence, approval, and deployment history for a running artifact.
  • Percentage of emergency releases whose evidence gaps were reconciled within the required time.
  • Number of unauthorized, unsigned, or mismatched artifacts rejected during controlled testing.

One particularly revealing metric is time to prove production:

Starting with a running workload, how long does it take to prove what source produced it, how it was built, what controls ran, who accepted the residual risk, and how the artifact was promoted?

If the answer requires several teams, multiple consoles, and manual correlation, the evidence chain is fragile even when every tool is technically present.

Test One Release End to End

Do not begin with an enterprise transformation.

Choose one internet-facing or otherwise consequential service and one recent production release. Ask a developer, platform engineer, security analyst, and service owner to reconstruct the release together.

Start from production and work backward:

  1. Identify the exact running artifact by immutable digest or equivalent identifier.
  2. Find the deployment event and show that it referenced the same identifier.
  3. Find the approval and confirm that it applied to that artifact.
  4. Retrieve the test, scan, and policy results associated with the artifact.
  5. Identify every exception and verify its owner, rationale, compensating control, and expiration.
  6. Retrieve the provenance, signature, SBOM, and build logs.
  7. Trace the build to the exact source commit, build definition, dependencies, builder, and requesting identity.
  8. Confirm that the evidence is retained long enough for incident response, audit, and operational learning.

Then run a negative test in a safe environment.

Try to promote an unsigned artifact. Change the digest after approval. Skip a required control. Use an unapproved builder. Present provenance with an unexpected parameter. Confirm that the release process rejects the change and produces an event responders can use.

The negative test matters because a dashboard can show that the approved path works without proving that an unapproved path is blocked.

The exercise will probably reveal governance issues as well as technical ones. Teams may disagree about who owns the policy, which findings are release-blocking, how emergency changes are reconciled, how long evidence is retained, or whether a vendor-managed deployment exposes enough detail to verify the chain.

Those disagreements are part of the finding.

Scale Assurance by Consequence

Not every internal script needs the same release process as a payment platform, clinical system, or internet-facing identity service.

Use consequence to set the assurance level.

For low-impact software, a minimum evidence packet may include the commit, build identity, artifact digest, required test results, and deployment record. Higher-impact systems may require isolated or hardened builders, signed provenance, verified SBOMs, independent approval, stronger separation of duties, policy enforcement at deployment, and longer evidence retention.

The important point is to make the differences explicit.

A lower-assurance release should be a risk decision, not an accidental byproduct of team maturity. The organization should know which systems lack provenance, which deployment paths accept mutable artifacts, which controls can be bypassed, and who owns the improvement plan.

This also keeps the program practical. The goal is not to create a paperwork tax that slows every change. Evidence should be generated and connected by the delivery process wherever possible. Human attention should focus on policy, exceptions, high-consequence decisions, and failed verification.

Automation moves software quickly. It should move proof with equal discipline.

What Security Leaders Should Do This Week

Start with one production service and one release.

  1. Name the artifact. Record the immutable identifier for what is actually running.
  2. Trace the chain backward. Connect deployment, approval, test results, build record, and reviewed source.
  3. Find the silent states. Identify controls that can time out, fail open, return empty results, or be skipped without a distinct release decision.
  4. Bind exceptions to releases. Require an owner, rationale, compensating control, expiration date, and artifact reference.
  5. Verify at deployment. Confirm that signatures, provenance, builder identity, and required evidence are checked when software is promoted—not merely created earlier.
  6. Run one negative test. Attempt a safe substitution or skipped-control scenario and verify that the process blocks it.
  7. Measure time to prove production. Set a target for reconstructing the complete evidence chain during an incident or audit.

A modern pipeline can run dozens of tools and still produce an untrustworthy release.

The difference is evidence continuity.

When source, build, controls, exceptions, approval, artifact, and deployment remain bound together, the organization can make a defensible claim about what reached production.

Without that chain, green means only that the workflow finished.

More Information and Assistance

MicroSolved, Inc. can help organizations:

  • Assess CI/CD, DevSecOps, and software-supply-chain controls.
  • Map release evidence from source through production deployment.
  • Review build isolation, signing, provenance, SBOM, and artifact-verification practices.
  • Test release gates, exception handling, and unauthorized-artifact rejection.
  • Design practical assurance tiers for high-consequence systems and vendors.
  • Build release, incident-response, and audit evidence playbooks.

Contact MicroSolved at info@microsolved.com or +1.614.351.1237.

Relax. We’re on watch.

AI tools were used as a research assistant for this content, but human moderation and writing are also included.

 

Vendor Evidence Is Now a Cyber Materiality Risk

Posted on by
Reply

A cybersecurity incident does not care where your data lives.

It does not care that the affected application is vendor-managed. It does not care that the logs are in a SaaS console your team cannot access. It does not care that the data-flow diagram is maintained by procurement, that customer-impact details live with a managed service provider, or that the outage timeline depends on a third-party support ticket.

But your materiality decision may care very much.

Public companies must disclose material cybersecurity incidents on Form 8-K within four business days after determining that the incident is material. The SEC’s rule also requires disclosure of the material aspects of the incident’s nature, scope, timing, and impact or reasonably likely impact, and the materiality determination must be made without unreasonable delay after discovery.

That creates a practical problem many organizations have not fully internalized:

The disclosure clock may be yours, but the evidence may belong to someone else.

That is not just a legal nuance.

It is an operational design problem.

It is a governance problem.

Continue reading →

The Evidence Supply Chain: How CISOs Build a Cyber Materiality Data Plane Before the Incident

Posted on by
Reply

A ransomware incident does not wait for the organization chart to catch up.

At 8:17 a.m., the SOC sees encryption activity on a file server. At 8:31, operations says the plant is still running. At 8:44, finance says revenue recognition may be affected if order processing stays down past noon. At 9:02, legal asks whether customer data was accessed. At 9:18, the forensic team says it is too early to tell. At 9:23, a vendor says the outage may have started in their environment. At 9:41, communications asks whether they should prepare a holding statement.

By hour two, everyone is working hard.

But they are not necessarily working from the same reality.

That is the problem.

Cyber materiality is often discussed as a decision problem. When does a cyber event become a board-level business event? When does it become reportable? When does it become material to investors, customers, regulators, lenders, or strategic partners?

Those are important questions. Public companies, for example, must disclose material cybersecurity incidents on Form 8-K within four business days after determining materiality, including the material aspects of the incident’s nature, scope, timing, and impact or reasonably likely impact.

But underneath that decision sits a deeper problem:

Continue reading →

Cyber Materiality Engineering: How CISOs Pre-Decide When Risk Becomes a Board Event

Posted on by
Reply

A ransomware incident does not stay technical for very long.

For about the first fifteen minutes, it may look like a security operations problem. A strange alert. A locked server. A suspicious authentication chain. A vendor portal behaving badly. A handful of systems no longer responding the way they should.

Then the blast radius starts to widen.

Operations wants to know whether they can keep running. Finance wants to know whether revenue recognition, cash movement, reserves, or forecasts are exposed. Legal wants to know whether notification clocks have started. The CEO wants to know what can be said, to whom, and when. The board wants to know whether this is “material.” Investors may eventually ask the same thing, only with less patience and more lawyers.

This is where many organizations discover that their cyber incident response plan is not really an enterprise decision plan. It tells people who to call. It tells the SOC how to preserve evidence. It may even have a communications tree and a sample press statement.

But it often does not answer the question that matters most in the first few hours:

Continue reading →

AI Agents Are Already Working for You. Who’s Managing Them?

Posted on by
Reply

AI Agents Are Not Applications. They Are Digital Workers.

Most organizations are adopting AI agents faster than they are learning how to govern them.

That is the problem.

A chatbot that answers questions is one thing. An AI agent that can access business data, use tools, trigger workflows, generate artifacts, make recommendations, or alter enterprise state is something else entirely.

At that point, the organization is no longer just deploying software.

It is introducing a new kind of operational actor.

That actor needs identity.

It needs boundaries.

It needs oversight.

It needs evidence.

It needs a human owner.

It needs a kill switch.

In other words, AI agents must be managed more like digital workers than ordinary applications.

AIAgentBanner

Continue reading →

CaneCorso™ and the Real Problems AI Is Creating for the Business

Posted on by
Reply

AI didn’t sneak into the enterprise.

It walked in through productivity.

Email triage. Document handling. Support workflows. Internal copilots. Retrieval systems. Early agentic use cases. All of it made sense at the time. All of it still does.

But something changed along the way.

We didn’t just adopt AI—we embedded it into workflows that can influence decisions, expose data, and take action.

That’s where the problem starts.

And it’s exactly where CaneCorso™ is designed to operate.

CaneCorsoAI

AI Risk Isn’t a Model Problem — It’s a Workflow Problem

There’s a persistent misunderstanding in the market right now.

Most conversations about AI security still center on the model—what it knows, how it behaves, whether it can be tricked.

That’s not where the real risk lives.

The real risk shows up when:

  • Untrusted content enters a workflow
  • That workflow uses AI to interpret or transform it
  • And the output influences business operations

That content might come from:

  • Email
  • Documents
  • OCR pipelines
  • Retrieved knowledge (RAG)
  • Support tickets
  • External data sources

Once it’s in the workflow, it’s no longer just data.

It’s influence.

CaneCorso™ exists to control that influence—before it becomes an operational problem.

Continue reading →

Introducing CaneCorso: An AI Application Firewall Built for Real Workflows

Posted on by
Reply

AI has officially crossed the line from experiment to infrastructure.

Email flows into copilots. Documents feed RAG pipelines. Support tickets trigger agents that can take action. The convenience is real—and so is the risk.

What hasn’t caught up is security.

Most security models were built for a world where inputs were predictable and trust boundaries were well-defined. That world doesn’t exist anymore. Today, untrusted content flows directly into systems that can reason, decide, and act.

That’s exactly where things get interesting—and dangerous.

When Good Data Carries Bad Instructions

One of the biggest misconceptions about AI security is that it’s a model problem. It’s not. It’s a workflow problem.

Attackers don’t need to break in anymore. They ride along with legitimate data—emails, PDFs, tickets, knowledge base entries—and inject instructions that your AI system may interpret as truth.

Think about what that means in practice:

  • A support ticket that contains hidden instructions
  • A PDF with embedded prompt injection
  • A knowledge base entry that poisons RAG outputs
  • An approval workflow manipulated through summarization

Layer in human behavior—blind trust, over-privileged access, weak validation—and you’ve got a system primed to fail in ways that traditional controls simply won’t catch.

CaneCorsoAI

A More Rational Approach to AI Security

CaneCorso™ takes a different path.

Instead of trying to block everything suspicious (and breaking workflows in the process), it follows what’s described in the Rational AI Security model —security that behaves more like an immune system than a wall.

That means:

  • Detecting and isolating threats without stopping the system
  • Treating all inbound content as untrusted by default
  • Preserving business continuity while reducing risk
  • Producing measurable, auditable outcomes

This isn’t theoretical. It’s a direct response to how AI systems actually behave in production.

One Control Plane for AI Workflows

At its core, CaneCorso gives you a shared AI Application Firewall—a single control plane that sits between your workflows and your models.

Instead of every team building its own brittle filters, you get consistent, reusable protection across:

  • Email triage and analysis
  • RAG pipelines and knowledge systems
  • Document AI and OCR ingestion
  • Support and ticketing workflows
  • Agent-driven automation

The platform delivers:

  • Runtime decisions: allow, sanitize, tokenize, or block
  • Privacy controls: redact or tokenize sensitive data before model exposure
  • Audit-ready logs: reasons, scores, and evidence you can actually use
  • Adversarial validation: Injection Scanner proves controls before and after deployment

This isn’t just about stopping attacks—it’s about making security operationally usable.

Continue reading →

Rethinking Account Lockouts: Why 15 Minutes Isn’t a Strategy

Posted on by
Reply

There’s a moment in almost every security program where someone asks a deceptively simple question:

“Is 15 minutes a standard account lockout duration?”

The short answer? No.
The more honest answer? It’s common—but often wrong for the environment it’s deployed in.

And I’ve seen more than a few organizations learn that the hard way.

3Errors

The Myth of the “Standard” Lockout

If you go looking for authoritative guidance—from Center for Internet Security, FFIEC, or CISA—you’ll notice something interesting:

They don’t tell you what number to use.

Instead, they consistently emphasize:

  • Risk-based decision making
  • Balancing usability and security
  • Detecting and responding to threats—not just blocking them

That’s not an accident. It’s an acknowledgment that static controls like lockouts are blunt instruments in a very dynamic threat landscape.

What We Actually See in the Real World

Across environments—financial services, healthcare, SaaS, manufacturing—the patterns are pretty consistent:

Setting Typical Range
Failed attempts before lockout 3–10
Lockout duration 5–30 minutes
Most common default 10–15 minutes

So yes, 15 minutes sits comfortably in the middle.

But “common” and “effective” are not the same thing.

Where 15 Minutes Breaks Down

1. It Punishes Users More Than Attackers

A 15-minute lockout sounds reasonable—until you multiply it.

  • A clinician locked out mid-shift
  • A call center agent missing SLAs
  • A trader unable to access systems during market hours

Now multiply that by repeated lockouts from cached credentials, mobile devices, or service accounts.

You don’t just have a security control—you have an operational problem.

2. It Doesn’t Stop Modern Attacks

Attackers have evolved. Most environments haven’t.

Today’s common attack patterns:

  • Password spraying (low-and-slow, avoids thresholds)
  • Credential stuffing (valid credentials, no lockout triggered)

A longer lockout duration doesn’t meaningfully impact either.

If anything, it gives a false sense of security while the real attack path goes untouched.

What Actually Works: A Layered Approach

This is where the conversation needs to shift—from “what’s the right number?” to “what’s the right strategy?”

1. Lockouts Are Supporting Controls—Not Primary Defenses

If you’re relying on lockouts as your main protection, you’re already behind.

At a minimum, you should be pairing with:

  • MFA everywhere it’s technically feasible
  • Conditional access (device, location, behavior)
  • Authentication throttling and smart detection

2. Tune for Risk, Not Defaults

A more balanced configuration tends to look like:

  • 5–10 failed attempts
  • 5–10 minute lockout
  • Reset counter after a defined cooldown window

This reduces user friction while still slowing down brute-force attempts.

More importantly—it acknowledges that lockouts are a speed bump, not a wall.

3. Progressive Delays Beat Hard Lockouts

One of the most underutilized strategies is progressive delay:

  • Attempts 1–2 → no delay
  • Attempts 3–5 → 30–60 second delay
  • Continued attempts → increasing delay

This approach:

  • Degrades attacker efficiency
  • Preserves user productivity
  • Avoids helpdesk spikes

It’s a far more surgical control than a blanket 15-minute lockout.

4. Detection Over Punishment

Modern security programs don’t just block—they observe.

You should be:

  • Logging all failed authentication attempts
  • Alerting on patterns (spraying, geographic anomalies)
  • Correlating identity signals across systems

Lockouts should be one signal among many—not the primary response.

Implementing This in Active Directory

Let’s get practical.

In on-prem Active Directory, you’re working primarily with Group Policy.

Recommended Baseline

In your domain or fine-grained password policy:

  • Account lockout threshold: 5–10 attempts
  • Account lockout duration: 5–10 minutes
  • Reset account lockout counter after: 10–15 minutes

Where to Configure

  • Group Policy Management Console (GPMC)
    • Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Account Lockout Policy

Advanced Considerations

  • Use Fine-Grained Password Policies (FGPP) for high-risk accounts (admins, service accounts)
  • Monitor Event IDs:
    • 4625 (failed logon)
    • 4740 (account locked out)
  • Feed logs into your SIEM for correlation and alerting

Implementing This in Microsoft 365

In Microsoft 365, the model shifts significantly.

You don’t directly control “lockout duration” in the same way—because the platform is already applying smart lockout behavior.

Smart Lockout (Azure AD / Entra ID)

  • Automatically tracks failed attempts
  • Uses adaptive thresholds
  • Differentiates between familiar and unfamiliar locations

What You Should Do Instead

1. Enable and Enforce MFA

  • Conditional Access → Require MFA for all users (with staged rollout if needed)

2. Configure Conditional Access Policies

  • Block legacy authentication
  • Require compliant devices
  • Apply geographic restrictions where appropriate

3. Monitor Identity Signals

  • Azure AD Sign-in logs
  • Risky sign-ins and users
  • Integration with Defender for Identity / Sentinel

4. Tune Smart Lockout (if needed)

  • Default threshold is typically sufficient
  • Adjust only if you have a strong operational reason

The Bottom Line

A 15-minute lockout isn’t wrong.

It’s just incomplete.

  • ✔️ It’s common
  • ❌ It’s not a standard
  • ⚠️ It can create more operational pain than security value

The real shift is this:

Stop treating account lockouts as a primary control. Start treating them as part of a layered identity defense strategy.

Because in today’s environment, the goal isn’t just to block access.

It’s to understand it.

 

 

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

Update on PromptDefense Suite and AI Security Research

Posted on by
Reply

Last week, I discussed why and some of how we built the new PromptDefense Suite. 

This week, we are discussing the product’s future internally and how we might go to market. This is mainly due to two new capabilities we have built into the product. 

The first is an API and workflow automation mechanism. This allows organizations to stand up a single instance of PromptDefense and then use it to protect multiple AI/agent workflows. The code no longer has to be embedded directly in the project; instead, all defensive capabilities and logging can be accessed via an API instance. The API is robust and supports API key restrictions that tie into a rules engine, so that different workflows can have different trust models and actions pre-assigned in an audit-friendly way. 

Secondly, we have developed a licensing mechanism that covers protected workflows and skips the per-seat, per-token models that seemed too confusing for most firms looking for these kinds of tools. They told us they wanted a simpler licensing approach, and we developed a new licensing mechanism to make it easy, manageable, and auditable. Our testers have been calling it a win! 

As we continue with the beta-testing process and lock down our decisions about where the product is going, the news that drove us to create it continues to flow in. More of our clients are working on agents and AI-integrated workflows, which require this level of protection. While we continue to develop PromptDefender, we are also working to develop and release extended frameworks for AI model, agent, and product management, along with policies, procedures, and vendor risk assessment tools for these frameworks, for our vCISO clients. We’re also busy researching ongoing compliance implementation for AI workflows and agents, and should have more on that shortly. 

In the meantime, if you want to discuss AI or agent security, risk management, or other relevant topics, please reach out. We would love to talk with you and help align our modernization capabilities with your emerging needs. You can always email us at info@microsolved.com or call us at +1-614-351-1237. 

As always, thanks for reading. Stay safe out there, and stay tuned for more updates. 

The Hidden Cost of Compliance: Why “Checkbox Security” Fails Modern Organizations

Posted on by
Reply

In today’s threat landscape, simply “checking the boxes” isn’t enough. Organizations invest enormous time and money to satisfy regulatory frameworks like PCI DSS, HIPAA, ISO 27001, GDPR, and NIS2—but too often they stop there. The result? A false sense of cybersecurity readiness that leaves critical vulnerabilities unaddressed and attackers unchallenged.

Compliance should be a foundation—not a finish line. Let’s unpack why checkbox compliance consistently fails modern enterprises and how forward-looking security leaders can close the gap with truly risk-based strategies.

Compliance vs. Security: Two Sides of the Same Coin?

Compliance and security are related—but they are emphatically not the same thing.

  • Compliance is about adherence to external mandates, standards, and audits.

  • Security is about reducing risk, defending against threats, and protecting data, systems, and business continuity.

Expecting compliance alone to prevent breaches is like believing that owning a fire extinguisher will stop every fire. The checklists in PCI DSS, HIPAA, or ISO standards are minimum controls designed to reduce loss—not exhaustive defenses against every attacker tactic.

“Compliance is not security.” — Security thought leaders have said this many times, and it rings true as organizations equate audit success with risk reduction. 

Checkbox Security: Why It Fails

A compliance mindset often devolves into a checkbox mentality—complete documentation, filled-in forms, and green lights from auditors. But this approach contains several fundamental flaws:

1. Compliance Standards Lag Behind Evolving Threats

Most regulatory frameworks are reactive, built around known threats and past incidents. Cyber threats evolve constantly; sticking strictly to compliance means protecting against yesterday’s risks, not today’s or tomorrow’s. 

2. Checklists Lack Contextual Risk Prioritization

Compliance is binary—yes/no answers. But not all controls have equal impact. A firewall might be present (box ticked), yet the organization might ignore the most actively exploited vulnerabilities like unpatched software or phishing risk. 

3. Audit Success Doesn’t Equal Real-World Security

Auditors assess documentation and evidence of controls; they rarely test adversarial resilience. A compliant organization can still suffer devastating breaches because compliance assessments aren’t adversarial and don’t simulate real attacks.

Real-World Proof: Breaches Despite Compliance

Arguments against checkbox compliance sound theoretical—until you look at real breaches. Examples of organizations meeting compliance requirements yet being breached are widespread:

PCI DSS Compliance Breaches

Despite strict PCI requirements for safeguarding cardholder data, many breached organizations were technically compliant at the time of compromise. Researchers even note that no fully compliant organization examined was breach-free, and compliance fines or gaps didn’t prevent attackers from exploiting weak links in implementation. 

Healthcare Data Risks Despite HIPAA

Even with stringent HIPAA requirements, healthcare breaches are rampant. Reports show thousands of HIPAA violations and data exposures annually, demonstrating that merely having compliance frameworks doesn’t stop attackers. 

The Hidden Costs of Compliance-Only Security

When organizations chase compliance without aligning to deeper risk strategy, the costs go far beyond audit efforts.

1. Opportunity Cost

Security teams spend incredible hours on documentation, standard operating procedure updates, and audit response—hours that could otherwise support vulnerability remediation, threat hunting, and continuous monitoring. 

2. False Sense of Security

Executives and boards often equate compliance with safety. But compliance doesn’t guarantee resilience. That false confidence can delay investments in deeper controls until it’s too late.

3. Breach Fallout

When conformity fails, consequences extend far beyond compliance fines. Reputational damage, customer churn, supply chain impacts, and board-level accountability can dwarf regulatory penalties. 

Beyond Checkboxes: What Modern Security Needs

To turn compliance from checkbox security into business-aligned risk reduction, organizations should consider the following advanced practices:

1. Continuous Risk Measurement

Shift from periodic compliance assessments to continuous risk evaluation tied to real business outcomes. Tools that quantify risk exposure in financial and operational terms help prioritize investments where they matter most.

2. Threat Modeling & Adversary Emulation

Map attacker tactics relevant to your business context, then test controls against them. Frameworks like MITRE ATT&CK can help organizations think like attackers, not auditors.

3. Metrics That Measure Security Effectiveness

Move away from compliance metrics (“% of controls implemented”) to outcome metrics (“time to detect/respond to threats,” “reduction in high-risk exposures,” etc.). These demonstrate real improvements versus checkbox completion.

4. Integration of Security and Compliance

Security leaders should leverage compliance requirements as part of broader risk strategy—not substitutes. GRC (Governance, Risk, and Compliance) platforms can tie compliance evidence to risk dashboards for a unified view.

How MicroSolved Can Help

At MicroSolved, we’ve seen these pitfalls firsthand. Organizations often approach compliance automation or external consultants expecting silver bullets—but without continuous risk measurement and business context, security controls still fall short.

MicroSolved’s approach focuses on:

  • Risk-based security program development

  • Ongoing threat modeling and adversary testing

  • Metrics and dashboards tied to business outcomes

  • Integration of compliance frameworks like PCI, HIPAA, ISO 27001 with enterprise risk strategies

If your team is struggling to move beyond checkbox compliance, we’re here to help align your cybersecurity program with real-world risk reduction—not just regulatory requirements.

➡️ Learn more about how MicroSolved can help bridge the gap between compliance and true security effectiveness.

Conclusion: Compliance Is the Floor, Not the Ceiling

Regulatory frameworks remain essential—they set the minimum expectations for protecting data and privacy. But in a world of rapidly evolving threats, compliance alone can’t be the endpoint of your cybersecurity efforts.

Checkbox security gives boards comfort, but attackers don’t check boxes—they exploit gaps.

Security leaders who integrate risk measurement, continuous validation, and business alignment into their compliance programs not only strengthen defenses—they elevate security into a source of competitive advantage.

 

 

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.