Although businesses regularly chafe against regulations, the truth is they are often a good thing. Over the past five to 10 years, data breaches have grown more common , while technology like generative AI has become increasingly mainstream. Businesses have a responsibility to protect themselves and their customers by protecting their data, and regulatory guardrails can help.
But regulations can be tricky. Legislatures move slowly, but the threat landscape can change in the blink of an eye—which means some regulations can be rendered obsolete before they even take effect. Trickier still, the future of technologies like generative AI can be difficult to predict. Perhaps the biggest problem is simply misunderstanding the purpose of compliance. Far too many businesses look at compliance as a box to be checked. They know there are certain requirements they need to meet, but they don’t necessarily know why. Worse still, many incorrectly view complying with security regulations as a proxy for being truly secure. But there’s a major difference between being compliant and being secure.
It's good to be aware of and engage with regulatory changes, but businesses must never forget that security is the ultimate goal—not just compliance. While having an approval process for access requests might meet compliance requirements, it doesn’t meaningfully contribute to the organization’s security if those requests are rubberstamped without investigation.