For twenty years I ran technology infrastructure and security for a national retailer with hundreds of stores and billions in revenue.
When PCI DSS came into effect and applied to us, compliance became part of that job. We passed every audit we faced, year after year. These days I ghostwrite books for CISOs and security founders, so I spend a lot of time getting this exact knowledge out of people’s heads and onto the page.
Which means I know the process from the inside, and I know the thing the process doesn’t want you to say out loud. Passing a PCI audit doesn’t mean you’re secure. It means you were compliant on the day someone checked.
Passing a security audit doesn’t mean you’re secure. It means you were compliant on the day someone checked.Share on X
Those aren’t the same thing, and the gap between them is where companies get breached. The audit is a photograph. Security is a film. A photograph of a tidy room tells you nothing about whether the room is tidy tomorrow.
PCI DSS is the standard that applies to any business handling credit card data. It exists because payment data is valuable and businesses kept losing it. The standard lays out requirements. Encrypt cardholder data. Restrict who can access it. Maintain firewalls. Patch your systems. Log activity. Test your defenses. The list is long and it’s reasonable. Getting those requirements written down in a way people follow is its own discipline, which I get into in good security policy names names.
An audit checks whether you meet those requirements at the moment of the audit. An assessor reviews your systems, your policies, and your evidence. If everything lines up, you pass. You get your attestation. You move on.
The assessor is checking a state. They confirm the firewall rules are correct today, and they can’t confirm that someone won’t change those rules next Tuesday because a vendor asked and it seemed harmless. They verify the systems are patched today, and they can’t verify you’ll keep patching them once the audit pressure is off.
I got lucky early. Our auditor was a man named Steve Levinson, and he was the best kind of auditor there is. He later wrote the foreword to one of my books. That tells you something about how that relationship went. But what made him good is worth explaining, because it changed how I understood the entire process.
Steve understood something most people miss about PCI.
You can’t conform to the letter of the standard. Not fully. The standard is enormous, it’s written to cover every possible business, and if you tried to satisfy every literal clause exactly as written, you’d never finish. A real company with real systems and a real deadline can’t do it.
So Steve focused on the intent of the standard instead of the letter. He looked at each control and asked what it was trying to protect against. Then he judged whether we were achieving that protection, even where our method didn’t match the literal text. That distinction, between documenting real protection and just satisfying a checklist, is the whole subject of my piece on documenting security policies and procedures, and the regulatory documents that drive them. This didn’t make the audit easier, exactly. It made it possible.
It reduced an impossible checklist down to a subset we could confront and finish in the time we had.
A great auditor doesn’t enforce the letter of the standard. Nobody can meet that. They enforce the intent. That turns an impossible checklist into something you can do.Share on X
The thing Steve was good at was communicating. He’d sit down and talk to you. He took the time to understand exactly what was going on with a control. What our systems did. What needed fixing, against what merely looked wrong on paper. He wasn’t there to catch us. He was there to understand us and help us get to real security.
That’s the lesson I wish someone had given me before my first audit. A good auditor is the most useful security consultant you’ll get all year, and they’re sitting right across the table telling you exactly where your gaps are. The companies that treat the auditor as an enemy to be fooled are throwing away the best free advice in the building.
The first one was tough. We’d never been audited before, so we walked in with a long list of things that weren’t right, and we had no idea how many until Steve found them.
That first pass turned up a lot to fix. It was a big jump from where we were to where the standard needed us to be, and there’s no way to make that first jump small.
If you’re facing your first audit, expect that. You’ll have more findings than you think, and that’s normal. All it tells you is that nobody had measured you before.
What surprised me is how much easier it got. Each year after that first one, the audit got smoother. We knew what was coming. We’d built better infrastructure, partly in response to what the earlier audits taught us. The findings shrank because we’d already fixed the structural problems and built habits that kept them fixed. By the later years, the audit was almost routine, because the security work was already done before the assessor arrived. The first audit is a wall. After that, you’re just maintaining.
Look at the big retail breaches of the last fifteen years. Almost every one of those companies was PCI compliant. They had the attestation. They passed the audit. And the attackers still walked out with millions of card numbers.
The companies that pass the audit on paper and skip the user training are securing the walls while leaving the front door propped open.
The standard is fine. The problem is that compliance is a floor, and a lot of companies treat it as a ceiling. They do the minimum to pass, file the paperwork, and go back to their actual jobs, and the security posture decays the moment the auditor leaves the building. I find that maddening, because the customers whose card numbers walk out the door never had a say in how little the company decided to do.
Most companies treat security compliance as a ceiling. It’s a floor. The minimum. The point where real work starts.Share on X
An attacker doesn’t care that you passed an audit in March. They care whether the door is open in September. And doors that were locked in March drift open all the time, because systems change, people leave, vendors get added, and the careful configuration that passed the audit slowly rots. The single highest-value security work we did was training the users.
The end users were the people who let attackers in, and almost never on purpose. Someone would get an email, the email would look fine, they’d innocently click the link, and just like that we would have ransomware spreading through the environment. It was an ordinary person doing what the email asked, because that’s what helpful people do.
So we trained them, hard. Not a once-a-year video nobody watches. Real, repeated training about what a bad link looks like, what a phishing email feels like, why the urgent request from the boss might not be from the boss. We taught people to pause and feel the small wrongness before they clicked. That whole problem, the people who can be talked into opening a door no firewall guards, is what I cover in the human layer is where security actually breaks.
This matters for PCI because the standard can make you focus entirely on systems and configurations, the technical controls an assessor can verify. Meanwhile the breach is going to come through a person clicking a link, which no firewall rule prevents. The companies that pass the audit on paper and skip the user training are securing the walls while leaving the front door propped open. The human layer is where attacks land, and it’s the part the checklist barely touches.
You can pass every technical control in PCI and still get breached, because the attack comes through an employee clicking a link. Train your people or none of the rest matters.Share on X
What keeps a company secure between PCI audits?
The stuff that keeps you secure is unglamorous and continuous.
It’s patching servers on a schedule and not skipping the ones that are inconvenient to reboot. It’s reviewing who has access and pulling it the day someone changes roles. It’s watching your own logs and noticing when something looks wrong. It’s training your people, again and again, because they’re the real perimeter.
None of that shows up cleanly on an audit. An auditor can confirm you have a patching policy. They can’t easily confirm you follow it every week when nobody is looking. The gap between the policy on paper and the behavior in practice is the whole ballgame, and it’s invisible to a snapshot.
The companies that stay secure are the ones where security is a habit baked into daily operations.
The patching happens because that’s just how the team works. The access reviews happen because someone owns them and does them. The logs get watched because watching them is part of somebody’s job. I go deeper on that unglamorous daily grind in the boring security work that actually keeps you safe. The audit, when it comes, is just confirmation of something that was already true.
This is also the kind of distinction that separates a security book worth reading from one that just repeats the standard. When I work with a security leader on their book, the real material is the hard-won judgment about what protects an organization versus what just passes the audit. That judgment is what readers can’t get anywhere else.
My take
A clean audit proves you met the standard for one day. It says nothing about the other 364, and most breaches hit companies that passed their last one. Spend your money on the habits nobody inspects, the weekly patching, the access pulls, the repeated user training. Treat the auditor as confirmation of work you were already doing. If the audit is the goal, you’ve secured the paperwork and left the front door propped open.
What does PCI teach about security beyond compliance?
PCI is the example because I lived it, but the lesson is bigger than payment data. The same habits-not-snapshots principle applies right down to your own machines, which I wrote up in home computer security. Any security structure works the same way. SOC 2, HIPAA, ISO 27001, whatever applies to your business. They all certify a state at a point in time and create the same temptation to do the minimum, pass, and relax.
And they all share the same trap. The certificate on the wall makes everyone feel safe, leadership assumes the problem is handled, and the security budget gets harder to justify because didn’t we just pass the audit?
My friend Sixto Bernal built his whole philosophy around the answer to that question. Cybersecurity is the opposite of a cost center. It prevents problems, prevents lawsuits and protects the company’s reputation, and it pays back far more than it costs.
The certificate on the wall makes everyone feel safe. That feeling is exactly how companies stop doing the work that keeps them safe.Share on X
Not every company Sixto worked with bought that argument, and most executives miss it because they don’t understand what security does for them. They see a line item.
I see the breach that never happened, and a certificate on the wall shows neither one. What protects you is whether the work behind it keeps happening after the assessor goes home.
If you’re facing your first PCI audit and you’re scared of it, here’s the real advice. Relax, and just get through it. I mean that as practical advice.
Work with your auditor. Don’t try to cover things up, and don’t fluff over the parts you know are weak. The auditor already knows what weak looks like, and the moment you start hiding things, you turn the one person who can help you into someone who has to dig. Your auditor doesn’t want you to fail. Really. A good one wants you to succeed, and they’ll work with you to get there if you let them. So let them.
Show them the real state of things, ask what needs fixing, and fix it.
That’s the whole secret, and there’s nothing technical about it. The companies that struggle with audits treat them as a confrontation. The companies that breeze through treat the auditor as a partner. Bring them in, tell them the truth, do the work they point you to, and you’ll pass because you got closer to secure. I’ve got no sympathy for teams that try to game the standard, because every hour spent hiding a weakness is an hour it stays open.
Don’t aim to pass the audit. Aim to build the security, work openly with the person checking it, and let passing be the side effect. Companies that chase the audit do a frantic cleanup in the weeks before, pass, and then slide back. Companies that build real operations find the audit almost boring, because nothing special has to happen. The assessor shows up and everything is already the way it should be.
Eight clean audits taught me that the audit was never the point. The point was everything that happened in between, and the auditor was there to help me see it.
Frequently Asked Questions
No. Passing an audit means you met the standard on the day you were assessed. Security is continuous, and an audit is a snapshot. Most companies that suffer card breaches were PCI compliant at the time. The audit confirms a state, while the ongoing behavior is what protects you.
PCI DSS is the security standard that applies to any business handling credit card data. It sets requirements like encrypting cardholder data, restricting access, maintaining firewalls, patching systems, logging activity, and testing defenses. It exists because payment data is valuable and businesses kept losing it.
Relax and get through it, and work with your auditor instead of against them. Don’t cover things up or fluff over weak spots, because your auditor already knows what weak looks like and wants you to succeed. Expect the first audit to turn up a lot of findings, since you’ve never been measured before. It gets much easier in later years.
You can’t, fully, and a good auditor knows it. The standard is too large to satisfy literally clause by clause. The best auditors focus on the intent of each control, what it’s trying to protect against. That reduces an impossible checklist to a subset you can achieve. Aim for the protection the control intends.
User training. The end users are the ones who let attackers in, almost always by innocently clicking a bad link that delivers ransomware. You can pass every technical control and still get breached through a person. Repeated, real training on phishing and suspicious links protects the front door that no firewall rule covers.
Because compliance is a floor and many companies treat it as a ceiling. They do the minimum to pass, file the paperwork, and let the security posture decay once the pressure is off. Systems change, people leave, and the careful configuration that passed quietly drifts out of shape. An attacker only needs the door open on one day, and it doesn’t have to be audit day.
Yes. I ghostwrite books for CISOs, security founders, and technical executives who want their hard-won judgment on the record, accurately and in their own voice. I ran enterprise security for two decades and was technical editor on Cyberheist for KnowBe4, so the engagement isn’t spent explaining the basics. You can see how I work with cybersecurity leaders on my cybersecurity ghostwriting page.
