October 19, 2026
New research from business resilience specialists IO suggests a growing concern that the rise of accelerated compliance offerings is contributing to a perception that certification alone delivers resilience. And yet does the greatest business value actually come from establishing, embedding and continuously improving the management systems that sit behind it? And, if so, how should certification be tailored to meet this approach?
With new information security, data privacy and AI governance regulations continuing to emerge across industries and regions, organisations are under increasing pressure to adapt their compliance programmes, according to IO. Its research reveals that, while most organisations feel prepared for upcoming regulatory requirements, far fewer are confident that their current compliance model can scale effectively, as demands continue to evolve.
“Despite widespread confidence among businesses about their readiness for new regulations (85%), only 35% of cybersecurity managers in UK organisations believe their existing compliance model is robust enough to scale effectively. In contrast, nearly half (50%) say they are ‘mostly’ prepared, but their model will need adjustments, while 15% feel underprepared in that, at the very least, notable changes will be required.”
These statistics reveal a key issue, points out IO: the gap between perceived and actual readiness is where resilience either holds or breaks. Organisations that build compliance into how they operate, rather than bolting it on in response to each new regulation or requirement, are the ones best placed to absorb what comes next.
Chris Newton-Smith, CEO of IO, explains: “Regulations are continuing to expand and this isn’t going to slow down anytime soon. Real resilience depends on having governance, oversight and compliance processes that can adapt as requirements change, allowing organisations to respond without repeatedly rebuilding their approach from scratch.
“The organisations best positioned for what’s next are not treating each new regulation as a separate project. Instead, they’re building governance and compliance capabilities that can support multiple frameworks and evolving requirements over time. This means new requirements don’t arrive as a crisis, but are absorbed into an existing structure. That’s what enables organisations to keep operating, continue growing and maintain trust with customers, partners and regulators.” he adds.
NON-STOP RESILIENCE
J.Paul Haynes, CEO of Cinchy, thinks that we’ve started to confuse compliance with resilience. “They’re connected, but they aren’t the same thing. It’s easy to look at a successful audit, a new certification or an updated set of policies and feel like you’ve reduced your risk. Those things absolutely have value. They create accountability and a common set of standards. But resilience isn’t measured by what happens during an audit. It’s measured by how your business performs on an ordinary Tuesday when nobody is checking.”
For years, compliance has centered on data. “We wanted to know where it lived, who could access it and whether the right safeguards were in place. None of that goes away, but AI changes what we’re trying to govern. Now we’re dealing with systems that don’t just retrieve information: they interpret it, connect it, make recommendations and, in many cases, take action. That’s a different conversation. The question is no longer just whether your data is protected. It’s whether AI is behaving the way your business expects it to.
“To me, that’s where compliance is headed,” says Haynes. “The challenge isn’t creating another framework or another certification. It’s making sure governance exists outside the policy manual. Every regulation, regardless of the industry, is really asking the same question: can you show that your controls work in practice? That’s becoming much harder when AI is involved, because those controls have to keep working every time AI interacts with your systems, not just when someone reviews them.”
Writing policies is the easy part, he states. Living by them is harder. “The companies that will navigate this transition best won’t necessarily have the largest compliance departments. They’ll be the ones that treat governance as part of everyday operations, instead of a periodic exercise. When your controls are part of how the business works, compliance becomes evidence of good governance, rather than the goal itself. I think that’s where the conversation is moving. For decades, we’ve focused on governing data. The next step is governing the systems that use it. That’s a very different challenge and one that every organisation will have to address as AI becomes part of everyday business.”
THE GREATEST VALUE
While compliance is an essential part of cyber-security governance, its greatest business value doesn’t come from certification itself, argues Notis Iliopoulos, EVP of managed risk and controls, Obrela. It comes from establishing, embedding and continuously improving the management systems that sit behind it. “Certification demonstrates that an organisation has met the requirements of a recognised standard at a particular point in time. That has real value, particularly when demonstrating governance to customers, regulators and other stakeholders. However, cyber risk is always evolving. Threat actors adapt their techniques, organisations introduce new technologies, business priorities shift and digital supply chains are more interconnected. A certificate alone can’t demonstrate that an organisation is resilient in that changing environment.”
This means the management system is where organisations can create long-term value, he continues. “It should not just demonstrate that governance processes exist; it should also ensure that cyber risk is continually understood, prioritised and reduced. That means embedding risk management into day-to-day operations and not treating compliance as a periodic exercise. In practice, organisations need to move beyond asking whether controls exist to understanding how effectively they perform against the threats they are most likely to face.
“This is why organisations often combine traditional audits and maturity assessments with continuous, evidence-based approaches to cyber risk management. Threat-informed risk modelling, control validation and cyber risk quantification provide ongoing insight into changing cyber exposure, so that organisations can validate the effectiveness of controls, prioritise remediation and make more informed decisions in the midst of change.”
Traditional compliance reporting often focuses on policy adherence or control implementation, but these measures do not always provide business leaders with enough insight into the organisation’s actual cyber exposure or the potential operational and financial consequences of an incident. “They need decision-quality intelligence that helps them understand where risk is changing, where resilience is improving and where further investment will have the greatest impact.
“Certification should support, rather than define, an organisation’s approach to cyber resilience,” Iliopoulos concludes. “The organisations that get the greatest value from compliance are those that use certification to reinforce a management system that is continuously informed by evidence, regularly validated against real-world threats and embedded into everyday decision-making.”
SPOTTING THE DIFFERENCE
Jon Abbott, who is CEO and co-founder at ThreatAware, points to the difference between compliance to achieve certification and compliance processes which organisations use as a starting point for ongoing improvement. “This difference matters because, ultimately, achieving certification is never the finish line, it’s the starting point. They prove compliance at the time of certification.
“However, no organisation’s security posture is static, so it can’t provide evidence of ongoing cyber security resilience. The threat landscape moves fast and continued compliance relies on assets, configurations and people, which could change within the space of a day. When you take this into consideration, the real question isn’t whether you passed an audit; it’s whether your controls are also future-proofed, given the dynamic nature of cyber threats.”
To unlock the real value of certifications, organisations need to prove their commitment beyond the point at which an audit is completed, adds Abbott. “The only way to bridge this gap is through continuous monitoring to ensure that their cyber assets are aligned with security policies and compliance requirements. This is where the greatest business value from compliance is created; ultimately, security governance is an ongoing process to reduce risk, support growth, create competitive advantage and to improve customer trust.”
Ongoing visibility of assets means that the standards achieved with certifications are continuously maintained, he says, and any gaps can be surfaced and used to drive improvement. “If compliance feels frictionless, that’s usually a sign it isn’t doing its job. A further consideration for businesses is the difference between certifications and frameworks like ISO 27001. The value of frameworks is that they create structure and discipline, while providing a common language for managing risk. However, when it comes to certification bodies, they can operate to different standards, which matters when assessing the weight that a certificate holds,” he concludes.
EVIDENCE-BASED SUCCESS
Accelerated compliance offerings have made recognised standards more accessible, particularly for SMEs, says Mihail Popa, CISO of Bridgeworks. However, certification can be mistaken for the objective, rather than evidence of an effective system. “Certification is a point-in-time assessment against a standard. Business resilience is demonstrated daily through governance, risk management, operational discipline, incident response, continual improvement and culture. An organisation may be certified while lacking mature asset management, vulnerability management, supplier oversight or tested continuity arrangements. Conversely, organisations with strong disciplines often recover better than those focused on certificates.”
Accelerated programmes can encourage a checklist mentality, where passing the audit matters more than reducing risk, he adds. “The objective is to improve the ability to anticipate, withstand, respond and recover. The greatest value comes from establishing, embedding and improving the systems behind certification. Standards such as ISO 27001, ISO 22301 and ISO 9001 were designed to improve performance, not produce certificates.”
Real value, states Popa, comes from embedding processes into operations:
- Risk assessments inform business decisions
- Security controls become part of system design
- Continuity plans are tested, not just documented
- Supplier and vulnerability risks are continually assessed
- Lessons from incidents drive process improvements.
“This continual improvement cycle, often described through Plan-Do-Check-Act, delivers resilience. Certification independently confirms that those processes exist and operate effectively. Organisations that embrace the management system gain numerous benefits: reduced disruption, improved customer confidence, better governance, clearer accountability and stronger executive decision-making.”
Certification should sit within a continuous assurance programme, he continues. “Rather than preparing before audits, organisations should maintain year-round evidence through monitoring, internal audits, risk reviews, exercises, supplier reviews and corrective actions. For cyber security, this means proving operational effectiveness, rather than documenting controls. Auditors expect evidence of vulnerability management, monitoring, incident response testing, access reviews, backup testing, patching and measurable security objectives.”
For WAN Acceleration, compliance should extend beyond the networking technology itself. “WAN Optimisation platforms may handle sensitive business data through compression, caching, protocol optimisation and encrypted traffic. Certification should assess how these technologies protect confidentiality, maintain integrity, support availability and integrate with controls such as encryption, identity management, logging and continuity planning.
“So, the focus should be on whether the technology supports secure and resilient business operations, rather than simply whether it functions as intended.”
THE ‘BREAKDOWN’ GAP
Tim Freestone, chief strategy officer, Kiteworks, says his company asked hundreds of security, risk management, IT and compliance professionals not what their organisations had certified, but what they had actually deployed. “The gap between those two questions is where compliance breaks down” he comments.
Kiteworks’ 2026 Data Security and Compliance Risk Annual Survey Report scores organisations on binary controls; whether they are deployed or not deployed; with no partial credit for documented processes or planned investments. “The mean Data Security Maturity Score across the full population is 39 out of 100,” states Freestone.
“Seventy-eight per cent of those same organisations experienced at least one AI-related security incident in the previous 12 months. Certified organisations are in that 78%. Certification tells you whether a management system exists. It doesn’t tell you whether the controls that system describes are technically enforced at the infrastructure layer. And the reality is that’s where incidents happen.”
Sixty-three per cent of organisations surveyed by Kiteworks have channel policies restricting sensitive data to approved systems. “Of those, 66% don’t enforce them technically. The policy document passes an audit. The infrastructure ignores it. An attacker [or an employee using an unsanctioned AI tool] doesn’t read policy documents. They interact with what the architecture permits.”
Organisations at Tier 4 maturity in the survey (the 6% that have deployed nine or more of 11 measured controls) experienced AI incidents at a 34% rate. Tier 1 organisations, minimal control deployment, report them at 91%. “Certification status doesn’t explain that gap,” he says.
“Budget doesn’t either. Organisations allocating 25% or more of IT spend to cybersecurity still land at a mean maturity score of 39. The difference is whether the controls are operational.”
IO is right that continuous improvement of the management system is where the value lies, he acknowledges. “But you can only improve what you’re measuring. If the metric is documentation coverage – how well the policy manual describes required controls – you can score well, while the enforcement layer does nothing useful. If it’s deployment coverage – which controls are technically running – you get a number that tracks actual exposure. Most organisations are measuring one and calling it the other.”
THE FAST-TRACK GAP
Przemyslaw Grandos, head of IT & compliance at Catalogic Software, posits the following scenario: “A mid-size IT services firm passes its ISO 27001 audit in the spring. The certificate goes on the website and the security team moves on. Eight months later, a supplier is compromised and the incident spreads into the firm’s environment. The recovery plan exists; it was even part of the audit evidence, but nobody has run it since it was written. Restoring the affected systems takes three times longer than planned, because the plan was reviewed on paper and never tested.” This, he says, is the gap fast-track compliance offerings tend to paper over. “A certificate confirms that a set of controls existed on the day of the audit. The surveillance audits that run through an ISO 27001 three-year cycle mainly confirm the paperwork is still in order. Whether those controls have ever been executed is a separate question the audit rarely answers. A working management system is what lets you run that recovery plan when it matters.”
That system requires named owners for each control and a set schedule for testing them. Skip that and the audit becomes a document describing controls nobody has practised running. “Fast-track compliance offerings sell speed to a certificate, skipping the system that makes it work,” states Grandos.
“ISO 27001 is deliberately generic, built to work for a five-person consultancy and a multinational alike. Most organisations copy-paste it, without scoping it to their actual operations, producing a certificate that clears the audit, but leaves the organisation exposed to exactly the scenario above. Embedding it means building those reviews into supplier decisions and incident response, on a cadence that matches how the organisation actually changes.”
In practice, certification pays off when organisations:
- Scope the system to their actual risk profile
- Give each control a named owner who can act on it
- Test recovery and incident response plans on a schedule
- Update the risk register when material changes happen.
“Certification still matters. It gives customers and regulators a shared reference point, and forces organisations to document and review controls they would otherwise defer. But the certificate is a floor, not the objective. Get the management system right first and the certificate follows.”