Compliance Is Not Security: Why Certified Companies Still Get Breached

Compliance is not security, and the gap between the two has cost some of the largest organizations on earth their customer data. A clean audit report tells you controls existed and were configured correctly during a review window. It does not tell you an attacker is inside your network right now. Every Canadian business owner who has ever handed a certificate to a client should understand that difference before it becomes an incident.

Why Compliance Is Not Security in Practice

The phrase compliance is not security sounds like a slogan until you look at what an audit actually measures. A compliance review checks that MFA is turned on, laptops are encrypted, policies are signed, and access reviews happened on schedule. It confirms the controls exist. It does not sit awake at 3 a.m. watching for the login that should not be happening.

Consider Target. Its payment card security assessor found the company compliant with PCI DSS at the end of September 2013, weeks before malware on its network began stealing customer card data, according to GovTech reprinting the Star Tribune in 2014. The certificate was accurate. The attackers still got in.

There is a second problem hidden in that story. A US Senate Commerce Committee staff report in March 2014 found that Target failed to respond to multiple automated warnings from its anti-intrusion software, as reported by BankInfoSecurity. The tools fired. Nobody acted. That is the real lesson for Ontario businesses: compliance is not security when nobody is watching the alerts that compliance told you to install.

An audit describes a past period. An attacker operates in the present. Those are two different jobs, and one certificate cannot do both.

What an Audit Sees Versus What an Attacker Does

A compliance framework is a checklist frozen in time. A skilled attacker moves through your environment in real time, using valid credentials whenever possible so nothing looks broken. This is exactly the seam where compliance is not security becomes a lived experience rather than a talking point.

Look at the Snowflake customer incidents in 2024. About 165 organizations were notified, and investigators found no breach of Snowflake’s own environment, according to The Hacker News in June 2024. Every incident traced back to stolen customer credentials, on accounts with no MFA, passwords never rotated, and no network allow lists.

Those accounts could have passed a paper review that only asked “does the platform support MFA?” The platform did. The customers had not turned it on. A control that exists on the menu but not on the account is invisible to a checklist and wide open to an attacker.

Okta’s own root cause report from November 3, 2023 tells a similar story. An attacker had access to its customer support system from September 28 to October 17, 2023, and files for 134 customers were accessed. A service account password had been saved in an employee’s personal Google profile, and additional access was found only after a customer shared a suspicious IP address on October 13.

Read that last detail again. A customer spotted the intrusion first. Detection, not certification, is what ends a breach.

How to Close the Gap Between Compliance and Detection

Keep your certification. Customers ask for it, and it proves your controls were built correctly. Then add the layer that watches for attackers. Here is a practical sequence any Canadian business can follow.

1. Keep the certification you already hold, because it answers client due diligence questions and satisfies insurers.
2. Add continuous monitoring so someone or something watches for attacker activity around the clock, not once a year.
3. Run daily hygiene checks that a static audit never covers.
4. Fix what the checks surface, quickly, especially on anything facing the internet.

Those daily hygiene checks are where compliance is not security turns into real defense. Watch for:

• Repeated failed sign-ins and impossible-travel logins
• New administrator accounts you did not create
• Security tools that were quietly disabled
• Internet-facing systems missing patches for known vulnerabilities

Our continuous vulnerability management service produces a monthly device update list for your IT team, so the patching gap between audits never grows silently in the background.

Compliance Is Not Security, But Regulators Still Expect Both

Canadian regulations already assume you are doing more than passing an audit, which is another way of saying compliance is not security in the eyes of the law. PIPEDA requires safeguards appropriate to the sensitivity of the information, and safeguards you never verify are not really safeguards.

The Canadian Centre for Cyber Security’s Top 10 IT Security Actions tell organizations to keep monitoring intrusion prevention alerts and logs to spot signs of intrusion, and to set a baseline of normal traffic so changes can be detected. That is guidance about watching, not about certifying. The CCCS is describing active detection, which no annual report delivers on its own.

For businesses in regulated fields, standards like PHIPA for Ontario health information and ISA/IEC 62443 for industrial systems push in the same direction: prove the control, then keep proving it works day after day. If you build with AI, the NIST AI RMF and the OWASP LLM Top 10 both frame security as continuous risk management, not a one-time stamp. The theme runs through all of them, and it is worth repeating that compliance is not security when the document is filed and nobody looks again. Our guidance on cybersecurity compliance in Canada walks through how these frameworks fit together for local firms.

Common Mistakes to Avoid

• Treating a passed audit as proof you are safe today, when it only describes a past review window.
• Buying tools that generate alerts, then leaving those alerts unread, exactly the failure the Senate found at Target.
• Enabling a control at the framework level while leaving individual accounts unprotected, the pattern behind the Snowflake customer incidents.
• Storing service account credentials in personal or unmanaged locations, as Okta’s root cause report described.
• Assuming your platform vendor’s security covers your own configuration mistakes. It usually does not.

Frequently Asked Questions

Q: What does “compliance is not security” actually mean for my business?

It means a certificate proves your controls were built and configured correctly during a review, while security means someone watches for attackers every day. Compliance is not security because an audit looks backward at a period and cannot see a live intrusion. You need both: the certification for clients and continuous monitoring for real defense.

Q: How long does it take to add monitoring on top of an existing certification?

Most businesses can layer 24/7 managed detection and response onto their current environment without disrupting the certification they already hold. The certification stays valid, and the monitoring begins watching for attacker activity that an annual audit was never designed to catch.

Q: What is the difference between a compliance platform and a SOC?

A compliance platform continuously checks that your settings match a framework, such as MFA on and laptops encrypted. A SOC watches for attacker behavior day and night and can contain a threat in progress. One confirms configuration, the other responds to intrusions, and you generally want both.

Q: Does PIPEDA or the CCCS require continuous monitoring in Canada?

PIPEDA requires safeguards appropriate to the sensitivity of the data, and the Canadian Centre for Cyber Security’s Top 10 IT Security Actions call for monitoring intrusion alerts and setting a baseline of normal traffic. Neither treats a single annual review as sufficient. Active detection is expected, not optional.

Q: What should I do first if I already have a certification?

Keep it, then add continuous monitoring and daily hygiene checks for failed sign-ins, new admin accounts, disabled security tools, and unpatched internet-facing systems. We can also produce an annual controls summary formatted for your insurer’s renewal or a client due diligence form, so your certification keeps doing its job while detection covers the gap.

If your certification is current but nobody is watching your logs, Secur-IT Data Solutions can add 24/7 detection and response without touching the audit you worked hard for.

References

1. GovTech: Clean Reviews Preceded Target’s Data Breach, and Others
2. BankInfoSecurity: Senate Report Analyzes Target Breach
3. The Hacker News: Snowflake Breach Exposes 165 Customers’ Data
4. Okta: Unauthorized Access to Okta’s Support Case Management System, Root Cause and Remediation
5. Canadian Centre for Cyber Security: Top 10 IT Security Actions
6. ISA/IEC 62443 Standards for Industrial Automation Security

For automating the compliance program, policies, evidence, and audit readiness, SecuritComply is built for exactly that.

Krikor Tengerian

Krikor Tengerian is the CEO and founder of Secur-IT Data Solutions, a Toronto-based cybersecurity firm focused on helping Canadian organizations secure their infrastructure and critical systems. With over 25 years of experience across cybersecurity and IT infrastructure, he has supported organizations in hardening networks, protecting critical workloads, and aligning security controls with business and regulatory requirements.​
Krikor actively shapes the direction and themes of Secur-IT’s educational content, collaborating with AI tools to structure, refine, and expand articles while providing the real-world context, use cases, and review to keep them accurate and practical for readers. He regularly shares insights on OT security, threat detection, incident response, and Canadian cybersecurity compliance to help industrial and commercial organizations better understand and reduce their cyber risk.