There's a moment that repeats itself in security consulting. A business passes its compliance audit — SOC 2, ISO 27001, a cyber insurance questionnaire — and six months later has an incident that the audit never contemplated. The paperwork was in order. The response wasn't.
Compliance and resilience are not the same thing. Compliance answers the question "can you demonstrate you have controls?" Resilience answers "when a control fails, what happens next?" Both matter, but only one of them is tested by an attacker.
What compliance actually buys you
To be clear: compliance frameworks are useful. They force an inventory of systems and data, establish a baseline of controls, and create accountability that otherwise wouldn't exist. For a SaaS-first business, an insurance renewal questionnaire is often the first time anyone has written down where the data lives and who can access it.
But frameworks are, by design, generic and point-in-time. They describe a minimum standard for organizations in general, assessed on a schedule. Your attacker is specific and works on their own schedule. The gap between those two is where incidents happen.
The failure modes of checkbox security
Three patterns show up again and again in businesses that are compliant on paper and fragile in practice:
- Controls exist but nobody watches them. MFA is enforced, logging is enabled — and the logs go nowhere. A suspicious sign-in from an unfamiliar country generates an alert that no one is assigned to read. Detection without response is just record-keeping for the post-incident report.
- Scope is drawn around the audit, not the business. The production environment is locked down because it's in scope; the marketing team's automation platform with a synced copy of the customer list is not. Attackers don't respect scoping decisions.
- The plan has never been rehearsed. An incident response plan that has only ever been a PDF fails in its first real use. Who has authority to suspend a compromised account? Who talks to customers? If the answer lives in one person's head and that person is on a plane, the plan doesn't exist.
What resilience looks like for a SaaS-first business
Resilience doesn't require a security operations center or a seven-figure budget. For businesses running on Microsoft 365, Google Workspace, and a stack of SaaS platforms, it comes from a handful of unglamorous practices:
- Know your actual attack surface. Not the one in the audit scope — the real one, including the tools each team signed up for on a credit card. You can't defend accounts you don't know you have.
- Make detection someone's job. Alerts need an owner and a service-level expectation, even if that owner is a fractional resource. "The system flagged it" is not a defense if nobody was ever going to look.
- Rehearse the ugly scenarios. Run a tabletop exercise on a business email compromise or a ransomware note. An hour of walking through "what would we actually do" exposes more gaps than a quarter of policy review.
- Decide in advance what you'll disconnect. The most consequential incident decisions — suspending accounts, revoking tokens, taking an integration offline — are much easier to make calmly in advance than at 2 a.m. during an active compromise.
- Close the loop after every scare. Near-misses are free lessons. A phishing email that almost worked should change a control somewhere, not just get deleted.
None of this replaces compliance. It's what makes the compliance real: when the auditor asks "how do you respond to a detected intrusion," the answer is a rehearsed process rather than a document nobody has opened.
Where to start
If you're compliant today and unsure whether you're resilient, one question might help: when did a control last fail, and how did you find out? If the honest answer is "we haven't had a control fail," the more likely truth is that one failed and nobody noticed, or had time, or knew what to do.
Start small. Pick your most likely incident — for most cloud-first businesses, that's a compromised email account — and trace it end to end: how you'd detect it, who would respond, what they'd do first, and how you'd know it was over. Fix what that exercise exposes, then pick the next scenario.
Compliance gets you through the audit. Resilience gets you through the incident. Both are important to your business and can reinforce each other. Where a good practice is in place, it probably meets a compliance requirement at the same time.