Seven Posture Failure Modes Compliance Never Catches
Each of these passes a compliance audit and shows up green on a dashboard, and each one has put a real company in the headlines. The gap between 'defined' and 'holding.'
Compliance asks whether a control is defined. Posture asks whether it's holding. The gap between those two is where breaches live, and it's wide enough to drive a ransomware crew through. Here are seven failure modes that pass the audit, render green on the dashboard, and have each put a real, named company in the news. I'll point at the forensic write-ups so you can see them in the wild.
1. MFA is "available," not enforced
The policy says MFA is required. The audit checks the box. But on a handful of accounts — a legacy tenant, a service account, a customer instance — it's optional, or never turned on. A leaked password alone walks in. This is the entire shape of the Snowflake campaign: MFA existed, wasn't enforced, and ~165 companies were breached with valid-but-stolen credentials. Compliance sees a policy; the attacker sees the exception.
2. Recovery bypasses everything you built
You can have flawless authentication and lose anyway, because the recovery path is designed to grant access to someone who can't authenticate. A social engineer calls the help desk, gets a factor reset, and is in — no exploit. MGM in 2023 and M&S in 2025 are the same playbook, two years apart. No compliance framework asks "how strongly does your help desk verify identity before a reset?" — which is exactly why the bar is set where the attacker wants it.
3. Non-human identities nobody governs
Every audit scrutinizes human accounts. Almost none seriously govern the OAuth grants, connected apps, and service accounts that often hold more access than the humans. A stolen integration token reached 700 companies; a forgotten OAuth grant to an AI tool opened a major platform. These are standing identities with no password to rotate and no MFA to enforce, and they're invisible to a checklist built around people.
4. The forgotten legacy account
"Decommission unused accounts" is in every policy and rarely enforced, because nobody's job is to hunt the corners. A legacy, non-production test account without MFA was the foothold into Microsoft via Midnight Blizzard — and a forgotten over-permissioned app turned that foothold into executive email. Compliance checks that a decommissioning policy exists; posture checks whether the test tenant from last quarter is still alive.
5. Sessions and tokens that outlive their security
MFA guards the login; it does nothing for a stolen session, because the session is proof the login already happened. A token lifted from a support file or endpoint malware replays straight past every factor. No audit asks "are your sessions bound to a device and short-lived?" — so the control that would catch this is never on the checklist.
6. Secrets sitting in the open
"Don't hardcode credentials" is policy everywhere and violated everywhere, because the fast way to ship is to paste the secret into a script or a share. A domain-admin credential to the privileged-access vault, hardcoded in a PowerShell script, turned one contractor's access into total compromise. Compliance can't see inside your scripts; posture means scanning for the secret before the attacker reads it.
7. High coverage masking low coverage
The meta-failure: a dashboard at 98% green where the 98% is only the part you instrumented. The breach comes from the uninstrumented remainder — the shadow SaaS app, the unconnected tenant, the manual process no scanner reads. Compliance rewards a clean report; posture demands you ask "clean across what, exactly?" A high score with unknown coverage is the most confident way to be exposed.
The thread
Every one of these passes an audit and fails an attacker, for the same reason: compliance verifies that a control is written down, and posture verifies that it's true right now, everywhere, including the parts nobody's watching. The frameworks aren't wrong; they're just answering a different question than the one the attacker is asking. If your posture program is really a compliance program with a nicer dashboard, these seven are your exposure — and they're not hypothetical, they're the last few years of headlines.
At Aurelion, finding exactly these gaps — the ones between "defined" and "holding" — across many client tenants is the problem we work on. If your green dashboard makes you nervous for reasons you can't quite name, that's the conversation I'm up for.