A recent survey conducted by Pentest-Tools.com has cast a new light on the evolving nature of compliance within organizations, revealing a shift away from the outdated notion that compliance activities occur solely once a year. Rather, the research shows that continuous compliance practices are increasingly becoming the norm, even as the automation frameworks necessary to support this evolution are lagging behind.
The comprehensive study undertaken in July 2026 involved insights from 201 practitioners in security and compliance roles, including IT managers, compliance and Governance, Risk, and Compliance (GRC) leads, security engineers, and DevSecOps professionals. Rather than relying on perspectives from executives or auditors, the focus was placed on those who engage in the daily, hands-on work of managing compliance and maintaining critical certifications such as ISO 27001 and SOC 2.
### Continuous Assessment Cycles
The data presents a compelling narrative: approximately 60.2% of respondents asserted that they conduct formal assessments of their security controls at least on a monthly basis. A significant portion, 37.8%, reported engaging in continuous assessment, while another 22.4% verified their controls monthly. In stark contrast, only 9.5% of organizations still follow an annual assessment cycle, and notably, no participant assessed controls less frequently than every six months.
This increase in assessment frequency is particularly striking when juxtaposed against the actual pace of changes in production systems. More than half of the respondents, specifically 56.8%, indicated that their production environments evolve at a rate of once a month or less. This suggests that many organizations are testing their controls at a frequency that meets or even surpasses the rate at which their underlying systems undergo updates.
Two main explanations for this trend have emerged. Some organizations have strategically separated control validation from deployment timelines, positioning assessment as a continuous requirement that must be upheld. Others appear to be reacting to external pressures, notably the rising incidence of published and actively exploited vulnerabilities, leaving systems—even those that have not been altered—vulnerable and exposed.
### Bottlenecks in Evidence Gathering
A critical revelation from the report pertained to the complications faced during audit preparations. Respondents cited that most audit delays are not attributable to deficiencies in policy documentation but rather stem from operational hurdles. The chief bottlenecks identified included the need for input from technical teams (50.7%), timely acquisition of necessary technical evidence (42.8%), coordination among various teams (36.3%), and addressing outstanding security issues prior to the audit (34.3%). Remarkably, only 3.5% of respondents reported experiencing no significant obstacles.
When asked about the most time-consuming aspects of maintaining compliance evidence, the majority pointed to the collection of evidence itself, which accounted for 45.8% of the workload. This was followed by validating the authenticity and consistency of findings (38.8%) and confirming that fixes had been effectively implemented (36.8%). Alarmingly, only 2% of respondents indicated that managing compliance evidence did not pose a noteworthy burden.
The report elucidates that security teams generally possess the requisite information that auditors necessitate. However, the challenge lies in translating that knowledge into demonstrable proof for the auditors.
### The Automation Gap
Despite a large majority (80.6%) of respondents indicating that they collect compliance evidence year-round, only 38.3% primarily utilize automated tools for this process. A significant 42.3% claim to engage in continuous evidence collection, albeit with a reliance on significant manual consolidation. Meanwhile, 14.9% still compile evidence primarily in the lead-up to audits.
This issue becomes even more complex when multiple compliance frameworks come into play. Nearly 90% of respondents maintain more than one compliance framework, yet only 6.5% utilize tools or templates that effectively manage the evidence mapping across these frameworks. A daunting 63.2% admitted to remapping evidence manually, while 25.9% indicated that most evidence was redundantly documented separately for each framework.
### Confidence in Certification
The survey also delved into practitioners’ confidence levels regarding compliance certification. While an impressive 93% believed that certification reflects their organization’s security posture to some extent, only 51.2% felt this was continuously accurate. A significant concern emerged as 41.8% believed the certification’s validity diminishes after the initial assessment, showing a clear lack of trust in the long-term value of the certification.
This skepticism was closely related to the practitioners’ confidence concerning surprise audits. Among those who viewed certification as continually reflective of the organization’s security posture, 59.2% reported being very confident in their ability to demonstrate control effectiveness during an unexpected audit compared to a mere 16.7% among those who consider it only accurate immediately post-assessment.
### Discovering Control Failures Early
Interestingly, the survey indicated that only about 12% of respondents reported first uncovering control failures during audit preparations. The majority identified issues through continuous monitoring or regular internal reviews, highlighting that most firms proactively catch these issues before auditors are involved.
Moreover, the survey observed a maturity gradient based on organizational size. Companies with fewer than 100 employees exhibited a reliance on continuous automated monitoring to detect failures at only 31.3%, whereas roughly half of the organizations employing more than 1,000 staff reported the same—a disparity reflecting the technological maturity rather than the workforce size itself.
### Demand for Automation Over Integration
Practitioners expressed a desire for less manual effort rather than further integrations when evaluating tools for audit readiness. Continuous, automated evidence generation emerged as the top priority for 24.4% of respondents, with an overwhelming consensus for this factor compared to the relatively lower priority assigned to integrating existing GRC and ticketing tools.
The findings reveal a notable contradiction: while automation and integration collectively accounted for one-third of suggestions when practitioners were asked what they would change in their compliance workflows, the overarching desire remained for a singular and continually updated evidence base—rather than a complex web of tool connections requiring manual intervention.
### Conclusion
The survey paints a vivid picture of a compliance landscape that has shifted toward continuous validation, even as the necessary supporting tools lag behind. Organizations are facing the painstaking reality that despite tighter assessment timelines, increasing evidence demands, and a need to satisfy a multitude of frameworks, much of the responsibility still lies with technical teams for manual collection and validation of proof.
Adrian Furtuna, the founder and CEO of Pentest-Tools.com, emphasized that the survey aimed to encapsulate the experiences of those executing the work—rather than merely capturing top-level insights from executives or auditors. “The bottleneck in modern compliance isn’t policy or paperwork,” he stated. “It’s producing technical evidence that security controls actually work, at the pace environments change, without burning out the engineering teams who hold that evidence.”
The complete report, titled “The audit bottleneck isn’t policy. It’s proof,” is available for deeper insights and analysis from Pentest-Tools.com.