By Dharmesh Acharya, Co-Founder at ZeroThreat.ai
One hundred customers. Their highly sensitive information, including full names and business addresses, email addresses and phone numbers, Social Security numbers, and dates of birth.
All remained exposed for 6 months (July–Dec 2025).
Now, this didn’t happen to a company that was cutting cybersecurity corners. We are not talking about a reckless startup that didn’t care or couldn’t care enough about data security.
This happened within the PayPal Working Capital (PPWC) loan application system.
PayPal, a trusted FinTech institution, is highly regulated and highly scrutinized. It maintains PCI DSS compliance for payment card security. It holds SOC 1 and SOC 2 certifications for service organization controls. It is certified under ISO 27001 for information security management. It undergoes continuous audits conducted by some of the most rigorous firms in the world.
And yet, a vulnerability lived inside its environment for months.
This is not an indictment of PayPal. It is a reminder to all of us: Compliance is the floor, not the ceiling.
Passing an audit does not mean you are secure. It means you met a defined set of controls at a defined moment in time. Security, however, does not operate in moments. It operates continuously.
The Compliance Illusion
We often mistake certification for safety. We assume that because controls exist on paper, risk must be contained in reality. But that’s hardly what happens.
Compliance Measures Conformance, Not Resilience
Audits are designed to evaluate whether required controls exist and are functioning at the time of assessment. They test alignment with standards. They confirm documentation. They review evidence.
What they do not guarantee is operational resilience between audit cycles.
A certification demonstrates that policies are written, controls are implemented, and processes are documented. It does not prove that vulnerabilities will not emerge tomorrow. It does not ensure that a misconfiguration introduced next week will be detected immediately. It does not prevent a new code deployment from unintentionally exposing sensitive data.
Compliance answers the question: Are we aligned with the framework?
Security must answer the harder question: Are we resilient against evolving risk?
Those are not the same question.
Point-in-Time Validation in a Continuous Threat Environment
Modern digital systems change daily—sometimes hourly. New code is deployed. Infrastructure scales dynamically. APIs connect to third parties. Cloud permissions evolve. Access roles expand.
Attackers do not wait for annual reviews. They do not respect quarterly assessments. They operate continuously.
When a vulnerability can exist for months in a highly regulated organization, it highlights the structural gap between periodic validation and continuous exposure. The risk does not appear because compliance is irrelevant. The risk appears because compliance is episodic.
- A control validated in March may degrade in May.
- A configuration confirmed in June may drift in July.
- An access pathway approved last quarter may become a liability next quarter.
Security risk accumulates in the spaces between audits.
Certifications Create Confidence—Sometimes Too Much
There is a psychological comfort in certification. Boards see badges. Executives see reports. Stakeholders see compliance statements. These signals matter—and they should.
But confidence can quietly turn into complacency.
When organizations assume “audit passed” = “secure,” they lower their vigilance. Compliance becomes a destination instead of the baseline that it is, and teams prepare intensely for audit season, but their focus ends up shifting once certification is achieved.
This rhythm is understandable. It is also dangerous. Threat actors do not operate on audit calendars.
The PayPal incident is a case study in this uncomfortable truth: even in organizations with mature compliance programs and external oversight, exposure can persist undetected.
The issue is not that compliance failed. The issue is that compliance alone cannot carry the burden of modern cyber risk.
Governance Must Evolve Beyond Checklists
The conversation we need to have is not whether standards like PCI DSS, SOC 2, or ISO 27001 are valuable. They are. They create structure. They establish accountability. They set expectations.
But governance in 2026 cannot rely solely on checklist validation.
Boards and executives must ask different questions:
- How quickly do we detect configuration drift?
- How rapidly do we remediate known vulnerabilities?
- How often do we validate our assumptions?
- Are we measuring exposure continuously or only before audits?
This is where the phrase bears repeating: Compliance is the floor, not the ceiling.
It defines the minimum acceptable posture. It does not define excellence. It does not define vigilance. It does not define ethical stewardship of customer trust.
Rethinking Security in a World That Never Stops Changing
We are operating in an era where digital infrastructure evolves in real time. AI accelerates both software development and attack discovery. Supply chains are interconnected. Cloud environments scale automatically. Human error remains constant.
Meanwhile, regulatory frameworks, by necessity, move more deliberately. They codify known risks. They define control categories. They update periodically.
There will always be a temporal gap between regulatory definition and technological evolution.
That gap is where ethical responsibility lives.
Organizations must decide whether they treat compliance as proof of safety or as a foundation upon which continuous vigilance is built. They must determine whether audit readiness is their objective, or whether sustained resilience is their obligation.
The global compliance landscape is expanding. More certifications. More reporting requirements. More scrutiny. This is a positive development. It signals that society expects accountability in the digital age.
But accountability is not satisfied by documentation alone.
The PayPal incident will not be the last example of a highly compliant organization experiencing a security lapse. Nor should it be interpreted as evidence that compliance is futile. Instead, it should serve as a catalyst for maturity.
Passing an audit should be the beginning of the conversation, not the end.
Security is not a certificate on a wall. It is discipline in motion. It requires continuous validation, cultural commitment, and leadership attention long after the auditors have left.
If we truly believe cybersecurity is a duty of care—to customers, to partners, to society—then we must hold ourselves to a higher standard than minimum alignment.
Compliance establishes the floor. Trust demands that we build higher.
Dharmesh Acharya is the Co-Founder of ZeroThreat.ai and a technology executive with more than 2 decades of experience in cybersecurity, enterprise software, and digital risk management. He works at the forefront of protecting organizations from evolving cyber threats and advocates for continuous vigilance and ethical responsibility in security and compliance.