Most organisations don’t have a security-control problem. They have an evidence problem.
Simon du Plessis, Director of Practice – IT & Security, writes on the need for organisations to replace security assumptions with evidence.
There is a question I keep coming back to in conversations with customers: how much of your security posture can you actually prove?
Most organisations can point to a sensible set of controls. MFA is enabled. Backups are running. Leavers are removed. Security policies exist. People have completed training. On paper, the right things appear to be in place.
But a control being purchased is not the same as it being deployed. Being deployed is not the same as being consistently applied. And being applied is not the same as being effective.
That is the gap leaders need to close: the gap between “we have it covered” and “here is the evidence that it is working.”
Security assurance is now a business issue
This is no longer just an IT concern. Boards are being asked to demonstrate oversight. Insurers want clearer evidence at renewal. Customers are asking more detailed questions during procurement. Regulators expect organisations to understand where risk sits and how it is being managed.
If you cannot evidence a control quickly, the impact is not limited to a security audit. It can slow down a tender, weaken a cyber-insurance submission, undermine a board discussion or delay the response to an incident. Good evidence turns security from a statement of intent into something the business can rely on.
Shadow AI exposes the confidence gap
Shadow AI is a good example. In almost every customer conversation I am having, AI is already being used somewhere in the organisation without formal approval. That is rarely because employees are trying to bypass IT. They are trying to work faster: summarising a document, preparing a presentation, analysing data or removing an administrative task.
The wrong response is to treat this simply as a tool problem or to assume a blanket ban will solve it. Shadow AI is the latest example of an old governance problem: the organisation believes it knows what is happening, but lacks the visibility to prove it.
The real challenge is knowing which tools are being used, what data is being shared and whether the controls you designed are reflected in day-to-day behaviour. Visibility has to come before policy, because you cannot govern what you cannot see.
The same issue appears elsewhere. When I ask whether MFA is enabled, the answer is usually yes. When I ask whether it covers every relevant user, application and exception, and whether that can be evidenced, the conversation changes.
Can you prove that former users no longer have access? Can you demonstrate that backups have been tested, not just scheduled? Can you show that security controls cover the whole environment rather than the systems everybody already knows about?
See it. Own it. Prove it.
You do not need another long list of security tasks. I would start with a simple leadership framework:
See it. Do you have an accurate view of the technology, identities, data and AI tools being used across the organisation? Where are the blind spots, unmanaged exceptions and assumptions?
Own it. Is there a named person accountable for each material risk and control? If a gap is identified, is it clear who decides what happens next, by when and with what priority?
Prove it. Can you produce current evidence that the control is operating as intended? Not a policy written two years ago or a screenshot from implementation day, but evidence that reflects the environment now.
See it. Own it. Prove it. is deliberately simple. Its value is that it changes the quality of the conversation. Instead of asking, “Do we have MFA?”, ask, “Where is MFA not enforced, who owns those exceptions and what evidence shows the remaining risk is understood?”
Move from reassurance to assurance
The same discipline applies to leavers, backups, privileged accounts, device management, third-party access and AI. The technology will change. The leadership requirement does not: understand what is happening, make accountability explicit and test whether the controls stand up to scrutiny.
The next time someone says, “Yes, we have that covered,” ask one more question: ” Show me how we know.”
That question is not about catching people out. It is about replacing reassurance with assurance and giving the business confidence it can defend.
Security maturity is not measured by how many tools you have bought or how many policies you have written. It is measured by how quickly you can see a risk, identify who owns it and produce evidence that the relevant control is working.
That is the shift leaders should be driving: from assumed protection to provable protection.
Test your own assumptions
Our five-minute security posture quiz is a practical starting point. It is designed to challenge the assumptions you may be making today and highlight where stronger evidence is needed.
