Continuous posture management vs. point-in-time assessments

Getting ahead of the security curve starts with a mindset shift

Most security work starts with a poke. An auditor sends a request list or an alert lands in someone's inbox, and the team drops everything to investigate and respond. Getting ahead of the curve takes a different mindset. Decide what good posture looks like, check against it on a steady rhythm, and fix what drifts before anyone has to poke you. That's proactive security, and you never have to investigate the incident you prevented.

The poke, investigate, react cycle

A lot of the teams I talk to run security as a loop with two triggers.

The first is the audit. Nobody looks closely at posture until the auditor arrives. Then the team spends weeks pulling reports, rebuilding timelines, and chasing screenshots to prove it met the criteria all year. That can check the compliance box. As a security practice, it leaves a lot to be desired, because the evidence shows what was true the week you collected it and very little about the months before.

The second is the alert. More mature teams pick the scenarios they care about, build alerts around them, and investigate when one fires. That's a real step up. The catch is that many alerts describe a policy that's already broken. By the time you learn that someone was added to Domain Admins, or that a folder of sensitive files was opened to Everyone, you're investigating a violation you'd rather have prevented. In both cases, the auditor or the incident sets your team's schedule.

Frameworks already expect ongoing improvement

Auditors moved past snapshots a while ago. A SOC 2 Type I report checks whether controls are designed correctly at a single date. A Type II report tests whether they operated effectively over a period, typically 3 to 12 months. ISO/IEC 27001:2022 requires you to monitor and measure your security controls (Clause 9.1) and continually improve your security management system (Clause 10.1). NIST CSF 2.0 includes both Continuous Monitoring and Improvement as categories. Each framework asks you to show that you're acting on your posture over time, and a pre-audit scramble is the hardest way to prove it.

What proactive security looks like in practice

Proactive security is mostly a rhythm built around policies, and you can start small.

• Set your first policies from a benchmark. You don't have to invent a definition of good. Start with the framework or benchmark that matters to your business, whether that's CIS Benchmarks, NIST CSF, or the SOC 2 criteria your auditor tests. Turn a handful of its controls into policies. Good starters include enabled accounts with no recent sign-in, accounts that don't require a password, privileged groups with members nobody can explain, and sensitive files shared with Everyone or with external users.
• Know your scenarios and get the data. For each policy, decide what you need to see to know whether it's being met. Then deploy a tool that monitors that information continuously, so you're not rebuilding it by hand every quarter.
• Make the findings clear and actionable. Your baseline is only useful if the team can read it at a glance and tell what to fix first. If it takes an expert to interpret the results, they won't get acted on.
• Review proactive risks every week. Book 30 minutes to go through the most important risks that haven't turned into an alert or incident yet. For each one, decide whether it's reasonable. If it isn't, fix it. If you keep accepting the same finding, your policy may need adjusting to fit how the business really works.
• Watch the trend. A single score shows where you are today. How it moves over time shows leadership, and your auditor, whether the practice is working. Small, steady improvements make audits easier and keep pushing risk down, which moves you further from a potential breach.

Take a common example. A contractor finishes a project, and their account stays enabled. In an alert-driven model, you find out when that account signs in from somewhere unexpected. In a proactive rhythm, it shows up in your weekly review as an enabled account with no recent activity, and you disable it before anyone else can use it.

Posture work won't stop every attack, and you still need alerts for suspicious behavior. It shrinks the misconfigurations attackers rely on, so the alerts you do get are more likely to point to something new.

Why most teams stay reactive

Team size matters less than practice maturity. A three-person team can run a mature program, and a large company can still be running from audit to audit. The teams that struggle most are the ones trying to improve, or the ones pushed into it by a new compliance requirement, a customer security review, or a cyber insurance questionnaire.

What holds them back is friction. They don't have a ready-made definition of good. They can't tell which of hundreds of settings matter most, and nobody has time to build a framework from scratch. Larger organizations often hire consultants to deliver one. That's expensive, and it usually produces another assessment frozen at a single date. Most small and midsize businesses can't budget for it at all.

I think removing that friction is the product's job. A good posture tool should give you a built-in baseline, a plain-language view of what's driving your risk, and a clear sense of what to fix first. If it expects the team to bring its own framework, most teams never get past the first step.

Start with the rhythm

You don't need a mature program to begin. Start with a few policies from a benchmark, get a baseline, and protect 30 minutes a week. A few months in, the pokes stop setting your agenda, and the next audit becomes a report you can pull in an afternoon.

That's the kind of practice we're building Netwrix 1Secure to support, with built-in risk assessments that give teams a starting point for their posture.

See where your posture stands today. Start a free trial of Netwrix 1Secure.