A workstation that has been hardened once does not remain that way: without real-time visibility into the hardening process, your endpoints’ configuration silently drifts toward a vulnerable state between audits. The question is no longer “Are my workstations compliant?” but “Are they still compliant today, at this very moment?” That’s the key difference between a one-time audit—a snapshot taken at a specific point in time—and continuous compliance monitoring, which constantly measures the actual state of each machine against a reference baseline.

For an RSSI or CIO at an SME or mid-market company, this gap has become the central blind spot in endpoint security. This article explains why configuration drift makes periodic audits structurally inadequate, what the numbers show, and how to restore continuous visibility.

Why does a hardened endpoint always end up drifting?

A hardened endpoint drifts because its configuration is dynamic: every OS update, every new application, every manual intervention by an administrator, or every emergency patch changes the system’s state. This is known asconfiguration drift: the gradual divergence between a machine’s approved state and its actual state.

The critical issue lies in the nature of this drift. It is largely invisible: it builds up through small, incremental changes that, taken individually, seem harmless. A service reactivated as a workaround, a security setting relaxed temporarily for a test and never restored, a group policy overridden by an update. These changes occur silently and accumulate over weeks or months, until the machine—which was once compliant with CIS or ANSSI-BP-028 baselines—presents a much broader attack surface than that documented in the latest audit report.

The paradox is this: the more active and well-maintained the fleet is, the faster it drifts. Compliance, therefore, is not a state that is achieved, but one that must be maintained.

What do the numbers say about the incorrect configuration?

Improper configurations are not a minor issue: they are among the most common causes of security breaches, even in organizations considered to be mature.

The joint advisory from the NSA and CISA on the ten most common misconfigurations ranks the default settings of software and applications at the very top of the list and emphasizes that these vulnerabilities reflect a systemic trend in many large organizations—including those with a mature cybersecurity posture. In other words, the problem is not limited to immature organizations: it is structural.

Verizon’s 2025 Data Breach Investigations Report reaches a similar conclusion: a large majority of breaches involve a non-malicious human factor—someone who falls for a phishing scam, misconfigures a control, or simply makes a mistake. Misconfiguration thus ranks alongside phishing among the most commonly exploited entry points.

These figures form the first step in the line of reasoning: if misconfiguration is a major cause of security breaches, then knowing at all times the actual configuration status of one’s infrastructure is not a luxury, but a defensive necessity.

Why Is a One-Time Audit No Longer Enough?

A one-time audit is no longer sufficient because it measures compliance at a single point in time, whereas vulnerabilities can arise in the interval between two assessments. An annual—or even quarterly—audit says nothing about the status of a workstation the day after it is validated.

Detecting deviations requires continuous monitoring against a known baseline, rather than one-time audits that fail to capture what has changed between reviews. This is precisely the rationale behind NIST SP 800-128, which establishes continuous monitoring and the maintenance of secure baselines as the foundation of configuration management.

The second blind spot is detection. “Insufficient internal monitoring” also appears in the NSA/CISA top 10, and the example provided by the agencies speaks volumes: they documented an organization that was unable to detect an attack team moving freely within its network, even though that team was deliberately attempting to trigger an alert. The principle is inescapable: an organization that cannot see the true state of its systems cannot know when its vulnerabilities are being actively exploited.

This news echoes the week’s previous reports. Week after week, the CERT-FR bulletin identifies vulnerabilities that allow for a “bypass of security policies” on widely deployed infrastructure components. However, a patch only provides lasting protection if it is continuously verified that it has not been undone by a subsequent change—such as a reinstallation, a rollback, or a forgotten exception.

What Real-Time Visibility Changes

Moving from one-time audits to continuous monitoring transforms a one-time, time-limited project into a sustainable and measurable security posture. In practical terms, real-time visibility rests on three pillars.

An explicit reference baseline

It all starts with a set of standards: the CIS Benchmarks and the ANSSI-BP-028 recommendations provide a common compliance framework, parameter by parameter. This is the “known-good” state against which any deviation will be measured.

Continuous Measurement of the Gap

Rather than simply confirming that a fix has been applied, the goal is to continuously measure the discrepancy between the actual status of each system or server and the baseline. Every deviation—a disabled setting, an introduced exception, or a service that has been restarted—becomes immediately visible, complete with a timestamp and a clear indication of who made the change.

Guided or Automated Remediation

Visibility is only valuable if it leads to action. Once a discrepancy is detected, remediation can be automated or guided, enabling a standard-sized IT team to keep hundreds of endpoints compliant without spending weeks on manual work—work that, in any case, would spiral out of control at the first sign of a deviation.

This three-part approach—baseline, continuous monitoring, remediation—closes the loop that a one-time audit leaves open. In the process, it generates the time-stamped proof of compliance required by regulatory frameworks such as NIS2, DORA, and ISO 27001, which demand automated traceability of security configurations—not just a simple annual report.

FAQ

What is configuration drift?

Configuration drift is the gradual divergence between a system’s approved secure state and its actual state, caused by untracked changes: updates, manual interventions, and emergency patches. It is usually invisible and accumulates over weeks or months.

Isn't an annual audit enough to ensure compliance?

No. An annual audit measures compliance at a specific point in time, but says nothing about the state of the infrastructure for the rest of the year. Vulnerabilities arise precisely in the interval between audits. Only continuous monitoring against a baseline can detect deviations as they occur.

Is misconfiguration really a common cause of security breaches?

Yes. The NSA and CISA rank default configurations as the most common security misconfigurations, and the 2025 Verizon DBIR shows that a large majority of breaches involve human error, including configuration errors.

What is real-time curing visibility?

It is the ability to continuously measure the discrepancy between the actual state of each endpoint and a reference baseline (CIS, ANSSI-BP-028), so that any deviation is detected immediately rather than during the next audit. It is based on an explicit baseline, continuous monitoring, and guided remediation.

How does continuous monitoring help with NIS2 or DORA?

These frameworks require automated traceability of security configurations. Continuous monitoring generates time-stamped evidence of each workstation’s compliance status, allowing organizations to approach an audit with up-to-date data rather than having to manually reconstruct it.

Sources

Take it from a photo to a movie. Cyberlib automates the hardening of your Windows, Linux, and macOS endpoints across more than 1,586 settings—aligned with CIS and ANSSI baselines—with continuous compliance monitoring and remediation of discrepancies. You no longer have to wonder if your endpoints were compliant during the last audit—you know they are compliant now. Discover Cyberlib.