A global employment platform passes its compliance audits and is repeatedly found to have real security weaknesses. What is the gap?

The gap

Compliance tests whether controls exist and operated; security tests whether an adversary can achieve their goal. Those overlap and are not the same, and a control framework can be fully satisfied by a system that is straightforwardly exploitable.

Specifically, frameworks are weak on: the design quality of a control (a password policy that exists and is weak), coverage (a control operating on the systems it knows about while the estate grew around it), composition (each service secure and the interaction between them not), and anything not enumerated, which by definition includes novel attack paths.

Where the two genuinely reinforce each other

• Evidence. The discipline of proving a control operated continuously produces the logging and monitoring that security response depends on.
• Coverage forcing. An auditor asking "on which systems does this operate" surfaces the shadow estate that security teams struggle to get attention for.
• Ownership. Frameworks force a named owner for each control, which is often the only reason one exists.
• Budget. Compliance obligations release funding that security arguments do not, which is unfortunate and useful.

What to add on top

• Adversarial testing: penetration tests scoped to objectives ("obtain another tenant's payroll data") rather than to a checklist, and red-team exercises that include the human and process paths.
• Threat modelling during design, which is the only activity that changes architecture rather than adding mitigations.
• Control coverage measured against the authoritative inventory, not against the systems the control already knows about — scope drift means a control operating perfectly on a shrinking share of the estate.
• Fail-closed controls with health monitoring, because a control that stopped running produces silence, and silence looks like success.

The framing for the organisation

Compliance is a floor and a communication mechanism, not a security programme. It tells customers and regulators that a defined set of things is done; it does not tell you whether you would survive a determined attacker.

Presenting it as equivalent is how organisations end up genuinely surprised by a breach in a system that passed every audit — which is a common enough outcome that the distinction is worth making explicitly to whoever approves the budget.