Manish | Creating, without hustle. 🧘🏽‍♂️

After leaving my CISO role a few years ago, I audited banks, a major conglomerate, government departments and other organisations in India. I found critical gaps. Many challenged my findings with the same argument: “We have been audited for years with zero observations.” One example explains the problem. A requirement called for active monitoring to identify newly created data for classification. The previous auditor marked it compliant because the organisation had Active Directory. Having Active Directory does not demonstrate that new data is being discovered and classified. The auditor had just two years of experience. The organisation’s representative also lacked the experience to understand the requirement. Neither understood what needed to be tested, yet the control passed. This is not an argument against junior professionals. It is a question of who assigns the work, supervises it and takes responsibility for the conclusion. These audits assess baseline security, not advanced defences. When even the baseline is misunderstood, years of clean reports can build a dangerous false sense of security. AI-assisted attacks make that complacency even more worrying. I fear more breaches and ransomware incidents if we keep treating previous audit results as grounds to reject new evidence. Zero observations should invite scrutiny, not end it. I examine this problem in my paper, The Illusion of Competence: ssrn.com/abstract=6942398