The audit bottleneck isn’t policy. It’s proof.
We surveyed 201 security and compliance practitioners to understand where security, engineering, and compliance teams face the most friction when turning vulnerability data into compliance evidence.
They told us that:
→ Nearly 90% manually map or re-document evidence across compliance frameworks
→ 80.6% collect evidence continuously; only 38.3% primarily use automated tools
→ 50.7% mention getting time and input from technical teams becomes a bottleneck
The numbers
60.2% assess the effectiveness of security controls at least monthly. Only 9.5% rely on annual assessments.
50.7% say getting time and input from technical teams is the biggest audit preparation bottleneck.
Only 38.3% primarily rely on automated tooling for continuous evidence collection, even though 80.6% collect evidence throughout the year.
Nearly 90% manually remap or re-document at least some evidence across multiple compliance frameworks.
Why we ran this survey
Technical evidence shows whether a security control works, if a finding is real, and if remediation held. We wanted to understand how teams:
→ produce that evidence,
→ where manual work accumulates, and
→ what slows audit readiness.
Shaped by company size, geography, internal processes, and technology stacks means compliance works differently in every organization. We looked past those differences to find the pain points practitioners share.
This July 2026 survey reveals what 201 hands-on security and compliance practitioners do, think, and need to maintain certifications. Respondents’ roles include IT managers, compliance and GRC leads, security engineers, DevSecOps professionals, and security specialists.
Let’s unpack why producing the technical evidence to maintain continuous compliance - without overloading teams with manual work - is proving harder than you’d expect with today’s automation.
Technical evidence, not policy, is the audit bottleneck
The most commonly reported audit preparation bottleneck is getting time and input from technical teams. That puts pressure on the people who hold the data, run the tests, and demonstrate whether findings are real and fixes held.
The most frequently selected bottlenecks were:
→ Getting time and input from technical teams (50.7%)
→ Obtaining technical evidence (42.8%)
→ Coordinating work across teams (36.3%)
→ Resolving outstanding security findings before the audit (34.3%)
Only 3.5% report no significant audit preparation bottlenecks.
Respondents spend more time collecting evidence (45.8%) than validating it (38.8%) or demonstrating successful remediation (36.8%).
Teams are stretched all across the organization, and the perception is that this is all my team's job, but it's the responsibility of everyone. Those with more technical roles tend to deprioritize any audit work until it becomes urgent.
Survey respondent
Certification brings trust, but confidence has an expiry date
Certification is no longer the end of the compliance process. Confidence between audits comes from continuing to validate controls and collect evidence as environments change.
Overall, 93% believe certification reflects their organization’s security posture. But only 51.2% believe it does so continuously. Another 41.8% say the certification reflects reality well only immediately after an assessment.
Confidence in a surprise audit follows the same pattern
Among respondents who believe certification continuously reflects their security posture, 51.2% would feel very confident demonstrating control effectiveness in a next-day audit.
Among those who believe certification reflects posture well only immediately after an assessment, just 16.7% would feel very confident.
Practitioners do not distrust certification. They trust it with an expiry date. Current technical evidence is what keeps that confidence from fading between assessments.
Better automation, experienced resources, tone at the top change so that Management sees certification and compliance process as an integral part of the organization and not as a tick the box item or a badge for advertisement.
Survey respondent
Assessment frequency outpaces annual audit cycles
We expected most organizations to assess security controls annually or quarterly. Instead, we found:
→ 37.8% assess continuously
→ 22.4% assess monthly
→ combined, 60.2% assess controls at least once a month
→ only 9.5% rely on annual assessments
.png)
Production environments often change less frequently.
More than half of respondents (56.8%) say their environments change monthly or less often.
That means many organizations now assess controls as often as, or more often than, their production environments change.
This doesn’t necessarily mean teams assess too often.
A control that passed last month can fail this month because the vulnerability landscape around it changed, even when the underlying environment did not.
But maintaining different operational and compliance cadences creates measurable friction:
→ 45.8% agree that differing delivery cycles make compliance work and reporting difficult
→ 47.3% agree that staffing issues affect the flow of compliance information
→ 42.8% agree that inadequate reporting tools create friction
→ 42.3% agree that inadequate data-gathering software creates friction
Change the way the other teams handle their work. Our side is always up to date, running. Other teams take days to even reply.
Survey respondent
Evidence collection is continuous, but automation hasn't caught up
In total, 80.6% of respondents collect compliance evidence throughout the year: 38.3% rely primarily on automated security tooling, while 42.3% still depend on significant manual consolidation.
With evidence in hand, cross-framework mapping is the sticking point. Only 6.5% of respondents say tooling or templates handle most of the work. Most (63.2%) still partially remap evidence manually, and 25.9% re-document the same evidence for each framework.
When considering what they'd change if they could, respondents had similar things to say.
Fully automate evidence gathering and mapping to stop wasting weeks manually pulling data and chasing engineering teams before audits.
Survey respondent
Automate the process. We usually provide the screenshots from the same menu over and over to prove the system has not been changed.
Survey respondent
I'd like the process of gathering evidence for compliance audits to be far more automated. Right now, mapping controls and pulling together proof between audit cycles takes a lot of repetitive manual work, and a system that generated and organized that evidence continuously would save significant time and reduce the risk of human error.
Survey respondent
Respondents were also asked which improvements would have the greatest impact on their compliance programs. Continuous, automated evidence generation was first, with 24.4% ranking it as the capability that matters most. Just 3% ranked it as least important.
If I could change one thing, it would be shifting from manual, point-in-time evidence gathering to automated, continuous control monitoring with cross-framework mapping.
Survey respondent
Respondents also talked about integrated platforms in the open-ended responses, but when forced to choose, they consistently ranked automated evidence generation ahead of integration with GRC platforms and ticketing systems.
Most organizations find problems before the auditor does
One assumption behind this survey was that organizations would mainly discover security control failures during audit preparation or the audit itself. The data doesn't support that.
Only 12% of organizations first discover failures through the audit process. Most find problems through monitoring and internal reviews that run throughout the year.
Control failures and vulnerabilities most commonly surface through:
→ Continuous automated monitoring or scanning: 44.3%
→ Routine internal security reviews: 24.4%
→ Continuous manual monitoring: 17.4%
→ Audit preparation: 6.5%
→ The audit itself: 5.5%
→ Security incidents: 1.5%
Only 12% of organizations first discover failures through the audit process. Most find problems through monitoring and internal reviews that run throughout the year.
Organization size adds a directional pattern
Among organizations with fewer than 100 employees, 31.3% primarily discover failures through continuous automated monitoring. Nearly 1 in 5 still first encounter problems during audit preparation or the audit itself.
Automated discovery rises to 44.6% among organizations with 100 to 999 employees. Among organizations with more than 1,000 employees, it reaches roughly half.
Before you act on this report
Two kinds of questions tend to follow findings like these: what the data can honestly support, and what it implies for choosing tools. They deserve separate treatment, because the first set is answered by the survey and the second by our experience building for this problem.
What the data can and can't tell you
"Does this mean annual audits are becoming irrelevant?"
No - it means the annual audit is becoming the checkpoint on a continuous process rather than the process itself. 60.2% of organizations already assess controls at least monthly, and only 12% first discover failures through the audit cycle. The audit still matters for trust and market access; it just no longer describes how the work happens.
"Is manual evidence work really that universal, or just badly distributed?"
Close to universal. Only 2% say compliance evidence isn't a significant workload, only 3.5% report no audit bottlenecks, and only 6.5% have largely automated cross-framework mapping. Intensity varies with framework count and organization size, but essentially everyone in the sample carries some of the load.
"We're a small team. Are we just behind the big companies?"
On process maturity, somewhat - larger organizations lean more on automated discovery, while the smallest still surface more issues during audit prep. But the gap is machinery, not headcount. Automated monitoring and evidence capture are the parts of the maturity curve that don't require more people, which makes them the highest-value starting point for a small team.
Choosing tools in light of this
"Should we prioritize GRC integration or automated evidence generation?"
The survey's answer is unambiguous: forced to rank, practitioners put continuous automated evidence generation first (24.4% ranked it most important) and integration near the bottom (12.9%, with the second-highest "matters least" score). The open-text answers reveal the deeper wish - a single, continuously current evidence base, not more connectors. Buy the thing that removes manual work first, then integrate it where remediation already happens.
"How does validated testing evidence actually help in an audit?"
Auditors accept evidence that shows a control worked at a point in time, that findings were real, and that fixes held. A validated finding carries that story natively: proof of exploitability, a tracked remediation, and a retest with before-and-after artifacts. Unvalidated scanner output invites the question teams dread - "can you show this was real and is now fixed?" - which sends someone back to the engineering queue.
"Won't continuous testing just create more findings to manage?"
More findings, yes - but validated ones, prioritized by proven exploitability, arriving steadily instead of in a pre-audit avalanche. The avalanche model is what breaks teams: evidence collection already outranks fixing problems as the top time sink. A steady, validated flow is precisely what makes the workload manageable.
This is one data point. The pattern is bigger.
Every report on Insights starts the same way: we ask the people doing the work, not the people buying the tools. Read them together and the patterns get hard to ignore.