Here is the claim that will get me disinvited from your next GRC standup: most of what enterprises call "security" is not security. It is a documentation exercise wearing security's clothes. Some of it is merely overrated — controls that buy false confidence at ruinous opportunity cost. But some of it is worse than that: a handful of these "controls" make the organization less safe than doing nothing would. Not "we could do better." Net-negative. The 90-day password rotation and the phishing simulation that gets an intern written up are not weak controls — they are anti-controls, and every program is full of milder cousins that quietly burn the two scarcest resources security has: budget and attention.
So keep two buckets in mind as you read. One holds the things that are simply mistaken for security — expensive, comforting, and orthogonal to whether you'd survive contact with an adversary. The other holds the things that are affirmatively harmful. I am not arguing against rigor. I am arguing that most compliance programs have confused the map for the territory so completely that a real attacker would see through them in an afternoon.
The anti-controls: where the harm is real
Start with the corpse everyone still keeps at the dinner table: mandatory periodic password rotation. NIST killed it in SP 800-63B — verifiers SHALL NOT require memorized secrets to be changed arbitrarily, e.g. periodically. The FTC's chief technologist, Lorrie Cranor, wrote "Time to rethink mandatory password changes" in 2016. And the seminal research is older still: Zhang, Monrose, and Reiter's 2010 UNC Chapel Hill study, "The Security of Modern Password Expiration," showed that users predictably mutate Summer2023! into Summer2024!. Given one expired password, offline hash-cracking recovered a large fraction of the successor near-instantly, and even a rate-limited online attacker guessed roughly one in six accounts within five tries. Rotation does not defeat that attacker. It trains him, by forcing the exact incremental pattern he's best at predicting. The finding is over a decade old and has never been seriously contested.
And yet. Walk into a random Fortune 500 tomorrow and I will bet you real money MaxPasswordAge is still 90. Not because it works — we have proof it doesn't — but because an auditor's checklist, written against a framework nobody has re-derived from first principles since the Clinton administration, has a line item for it. The policy survives because killing it means explaining to a non-technical auditor why you're "deviating from best practice," and nobody gets promoted for winning that argument. So the crackable password lives on, filed under "hardened."
Compliance does not measure whether you are secure. It measures whether you resemble the other organizations that got breached.
SOC 2 is a report about your paperwork
This one belongs in the other bucket — not harmful in itself, just routinely mistaken for something it isn't. Here is what a SOC 2 Type II attestation actually certifies: that over an observation window, you did the things you said you would do in the controls you chose to describe. That's the whole product. It is a consistency check between your written policy and your logs. It says nothing — nothing — about whether the controls you picked are the right ones, whether they'd survive contact with a competent adversary, or whether the gaping hole in your architecture is even in scope.
I have watched companies with a spotless SOC 2 Type II run a flat network where any compromised laptop could reach the production database. I have watched a "compliant" org keep the auditor's evidence in a Confluence space a phished helpdesk account could read end to end. Okta had SOC 2. LastPass had SOC 2 — and was hollowed out through a DevOps engineer's home computer running a years-old vulnerable Plex install, leaking vault backups for months before anyone noticed. Change Healthcare, whose outage disrupted a large share of US pharmacy claims processing for weeks, was breached through a Citrix portal with no MFA on it at all. None of these firms failed an audit. They passed. The audit and the breach are simply orthogonal events, and pretending otherwise is the industry's central lie.
The structural rot is that the auditee pays the auditor and wants the renewal. Nobody in that transaction is incentivized to find the thing that kills the deal. So you get a document that reads like a security program and functions like a receipt.
The annual pen-test is theater with a scope statement
Also the second bucket — not net-negative, but wildly overtrusted. A real adversary has unlimited time, no scope, no rules of engagement, and no report deadline. Your Q4 pen-test has a two-week window, a scope negotiated to exclude "anything that might affect production," a WAF politely left in monitoring mode, and a firm contractually barred from touching the third-party SaaS where half your crown jewels actually live. You get the report, fix the two criticals, mark the mediums "risk accepted," file the PDF, and tell the board you're "tested."
You tested a snapshot of a subset under conditions no attacker will ever honor, once, twelve months ago — and your attack surface changed every day since, because your engineers ship continuously. A point-in-time pen-test in a continuous-deployment shop is like inspecting one frame of a film and certifying the plot.
Attacker's actual model: continuous, unscoped, patient, creative
Your pen-test's model: 2 weeks, scoped, October, then a PDF
Delta: the entire breachPhishing simulations that punish employees are the worst offender
Back to the anti-controls — and this is the one I hold in special contempt, because it doesn't just waste money, it inverts the security relationship. You send your own staff a deceptive email, and when a stressed accounts-payable clerk clicks it during month-end close, you enroll them in remedial training, ding their record, or — in the genuinely deranged programs — dangle a fake holiday bonus to juice the click-through, then humiliate everyone who fell for it. West Midlands Trains did exactly that to roughly 2,500 employees in 2021. It went about as well as you would expect.
And the metric the CISO shows the board — "click rate down to 4 percent!" — is a vanity number measuring how well people recognize your templates, not spear-phishing built from their real org chart and a spoofed message from their actual manager.
What the same money buys instead
The real cost of all of this is opportunity cost. Every dollar and every engineer-hour spent manufacturing audit evidence is one not spent on controls that demonstrably move the needle:
- Phishing-resistant MFA everywhere — hardware keys and WebAuthn, not SMS, not fatigue-able push. This one control would have stopped Change Healthcare, most of the 0ktapus campaign — which compromised well over a hundred organizations by phishing Okta credentials — and a large share of ransomware initial access.
- Real network segmentation and least privilege, so one popped laptop does not own the datacenter.
- Automated patching and an accurate asset inventory — you cannot defend what you cannot enumerate, and the boring truth is that most breaches ride known CVEs on forgotten boxes.
- Centralized, tamper-evident logging with detections a human actually reads at 2 a.m., versus logs you collect solely so the auditor can confirm you collect logs.
- A blameless reporting culture where "I think I clicked something" earns a thank-you and an incident ticket, not a disciplinary note.
None of that has a clean checkbox. All of it is harder to buy than an attestation. That is precisely why it keeps getting deferred.
The uncomfortable conclusion
Compliance is not worthless. It is a floor, a sales-enablement artifact, a way to let procurement sleep. Fine — sell it as exactly that. The failure is substitution: treating the floor as the ceiling, treating "we passed" as "we're safe," and letting a framework designed to be legible to auditors quietly become the working definition of security. Worse, in the two cases where the checkbox actively degrades your posture, substitution doesn't just leave you flat — it hands the attacker the pattern.
The attackers are not filling out your vendor questionnaire. They do not care about your SOC 2 badge. They are running continuously, unscoped, patient, and creative — and they are counting on you to spend this year's budget proving to a third party that you did the things on a list nobody ever re-derived from a threat model.
Stop resembling secure organizations. Start being a hard target. Those are different projects, and only one of them comes with an auditor.