The compliance-security gap

A merchant can pass a PCI-DSS assessment with technical controls that would fail any competent security review. The assessment isn't wrong; it's that compliance and security aren't the same thing. Compliance is a floor. What's built above the floor is what actually matters.

Based on reviews across 2023; written February 2025.

Where the gap is largest

• Log retention without log review. The compliance requirement is that logs exist and are retained for a defined period. Nothing in the standard requires that anyone actually read them.
• Vulnerability scanning without triage. External scans are quarterly; findings are collected. Whether the findings translate into fixes on any particular schedule is not part of the requirement.
• Access reviews as ritual. Annual attestation that access is appropriate; no monthly review of drift; no verification that terminated employees actually lost access.
• Encryption in transit but not in use. Data is encrypted between hops and at rest, but sits decrypted in application memory for arbitrary durations.

Closing the gap

• Treat compliance findings as a lower bound. Every "compliant" control should have a stricter internal target.
• Instrument the security posture, not just the audit posture. If you can't answer "have we been compromised in the last 24 hours" with data, the audit report doesn't help.
• Do internal red-team exercises. The compliance auditor tests documented controls; the red team tests what actually happens.

The most secure organisations are also compliant. The reverse is not always true.