What Is a Security Audit?
A security audit is a structured, evidence-based review of an organization’s controls against a standard, framework, or policy. Where a penetration test asks “can we break in?”, an audit asks “are the right controls in place, and can you prove they work?” It is how organizations demonstrate — to themselves and to others — that security is real, not aspirational.
What does an audit examine?#
Audits are broad rather than deep, covering the control environment:
- Access controls — who can do what, and whether least privilege holds.
- Configuration & patching — systems hardened and up to date.
- Logging & monitoring — is activity recorded and reviewed?
- Policies & procedures — do they exist, and are they followed?
- Compliance — alignment with frameworks like ISO 27001, SOC 2, or PCI DSS.
The recurring theme is evidence. An audit does not take “we do that” on faith; it asks for the log, the configuration, the ticket that proves it.
How does an audit differ from a pentest?#
| Security audit | Penetration test | |
|---|---|---|
| Question | Are controls in place and working? | Can an attacker break in? |
| Method | Review, interview, evidence | Active exploitation |
| Breadth | Wide, systematic | Deep, targeted |
| Output | Findings vs. a standard | Proven attack paths |
The two are complementary — an audit finds missing controls; a pentest finds whether the present ones actually hold.
Audits are part of governance and risk work. Explore the operational side at the Defense & Hardening hub, and more at the Security Fundamentals hub.
Frequently asked questions#
What is the difference between a security audit and a penetration test?
An audit is a systematic review that checks controls against a standard or policy, largely through evidence, interviews, and configuration review — it asks "are the right controls in place and working?" A penetration test actively tries to break in. Audits assess coverage and compliance; pentests prove exploitability.
What does a security audit cover?
Typically access controls, configuration and patching, logging and monitoring, policies and procedures, physical security, and how well the organization follows its own standards or an external framework like ISO 27001, SOC 2, or PCI DSS. The output is findings mapped to requirements, with evidence for each.