Detection without prevention produces a treadmill
When the same control fails repeatedly on newly created resources, the defect is in the provisioning path, not in the resources. Detective posture management alone will report it forever at a steady rate proportional to delivery velocity.
The fix is upstream: policy as code in the pipeline, service control policies at the organization boundary, and hardened modules that make the compliant configuration the default one.
- Policy-as-code checks in pull requests, blocking on high-severity classes
- Organization-level guardrails for the controls that must never regress
- Hardened modules so the compliant path is also the fastest path
Drift is only actionable with a change context
Joining posture findings to change events — pipeline run, console action, API caller — turns a misconfiguration into an accountable event with a responsible actor and a reproduction path. Without that join, remediation is anonymous and recurrence is inevitable.
Manual console changes on production accounts deserve their own detection class. They are both the most common source of drift and the easiest to eliminate through access design.
Exceptions with expiry, or the baseline erodes
Exceptions are legitimate; permanent exceptions are policy changes made without governance. Every exception carries a business justification, an owner, a compensating control under continuous verification, and an expiry date that triggers review.
- Expiry mandatory, maximum 90 days for high-severity controls
- Compensating control verified continuously, not asserted once
- Exception inventory reviewed with the business owner monthly
Benchmarks are the floor, not the program
Coverage across more than 7,000 checks spanning CIS, provider best practice and regulatory mappings establishes the floor. The program is what you build on top: which controls are preventive, which are exception-eligible, and which are business-critical enough to page someone.