Somewhere right now, a senior engineer is using a shared root credential to push a production database change at 11 p.m. There is no second set of eyes, no record of which human ran the query, and no clean log to hand the auditor in three months when they ask who did what.
That scene is the modal reality at companies that have passed every audit they have ever taken, and it explains why so many of them still appear in breach disclosures six months later.
Compliance, security, and engineering velocity used to be three separate disciplines with three separate budgets, three separate quarterly reviews, and three sets of people who only saw each other in incident postmortems. They are now one operational discipline whether or not the org chart has caught up. The database layer is where the convergence either works or fails, and most programs do not know which one they have.
The old GRC playbook assumed a few things that are no longer true. It assumed audits were periodic, evidence was hand-collected, and the gap between a regulation publishing and a regulator caring was years. Three shifts have made those assumptions expensive.
The first shift is that Continuous Controls Monitoring (CCM) has moved from emerging category to expected practice. Gartner has tracked CCM in its Hype Cycle for Cyber Risk Management four years running, and its 2026 Market Guide for DevOps Continuous Compliance Automation Tools projects that 65% of organizations will integrate compliance automation into their DevOps workflows by 2028.[1] What was a niche idea five years ago is now the direction the analyst consensus expects every mature program to head.
The second shift is that the Digital Operational Resilience Act (DORA) became enforceable on January 17, 2025, binding roughly 22,000 EU financial entities and their information and communication technology (ICT) service providers to continuous requirements for risk management, incident reporting, third-party oversight, and resilience testing. Non-compliance penalties reach 2% of annual worldwide revenue for financial entities and 1% of average daily worldwide revenue for designated critical ICT providers.[2] DORA expects entities to demonstrate ongoing operational resilience and to produce evidence of it on demand.
The third shift has two sides. On the regulatory side, the EU AI Act began applying in phases starting February 2, 2025. General-purpose AI obligations took effect on August 2, 2025. Article 50 transparency rules apply from August 2, 2026. High-risk system rules were recently pushed to December 2, 2027 under the Digital Omnibus on AI agreed on May 7, 2026.[3] The timelines are softer than the original regulation's posture, but the directional pressure is unchanged. On the operational side, IBM's 2025 Cost of a Data Breach Report found that 97% of organizations that suffered an AI-related security incident lacked proper AI access controls, and 63% had no AI governance policies in place.[4] Whichever direction you look at the AI problem from, the answer routes back to who can access what data and whether anyone can prove it.
All three shifts share one premise: regulators, auditors, and attackers all operate continuously now. Quarterly audits and binders of static evidence were built for a slower world.
Compliance practitioners have argued for decades that controls reduce risk. The 2025 figures put that argument at unprecedented scale and make the impact of inadequate controls hard to ignore.
IBM's 2025 report puts the average cost of a data breach at USD 4.44 million globally, with the US average reaching a record USD 10.22 million. The average time to identify and contain a breach was 241 days.[4] These figures are averages drawn from activity-based cost estimation across 600 organizations.
Supply chain compromises were more expensive and slower to find. IBM reports an average cost of USD 4.91 million per supply chain breach and a 267-day lifecycle, the longest of any vector studied.[4] Verizon's 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled year over year to 30%, with stolen credentials remaining the leading initial access vector at 22%.[5]
Occupational fraud is the older problem with newer numbers. The Association of Certified Fraud Examiners' 2024 Report to the Nations covered 1,921 cases of occupational fraud across 138 countries, with total losses of approximately USD 3.1 billion. Median loss per case was USD 145,000. Median time to detection was 12 months. The ACFE estimates that a typical organization loses 5% of annual revenue to fraud.[6]
One finding ties all of this together. The ACFE reports that more than half of occupational fraud cases studied were correlated with lack of internal controls or management override of internal controls.[6] When anti-fraud controls were in place, fraud losses and detection times roughly halved.[6] This illustrates the difference between a control program that works and one that produces paperwork.
Segregation of duties (SoD) is the oldest idea in this article and the one most organizations claim to have figured out. The ACFE has reported for years that roughly 70% of occupational frauds are committed by a single person acting alone. Including a second person forces collusion and dramatically reduces both the opportunity and the perceived likelihood of getting away with it.[7] The principle is codified in ISO 27001:2022 Annex A 5.3 and embedded in every major audit framework that touches access management.[8]
The classic SOX-era SoD model assumed financial transactions in an ERP. The 2026 attack surface is broader. Production database writes, schema changes, data exports, AI agent reads, and ad hoc analyst queries all need the same separation between request, execution, and oversight that journal entries needed in 2002.
This is where most database programs quietly fail. A shared root credential breaks SoD on day one because it makes attribution impossible. A "temporary" direct production access path that nobody got around to closing breaks SoD on day two. A senior engineer who is simultaneously the requester, the executor, and the de facto approver breaks SoD on day three. The audit paperwork still reads clean. The control is not enforced anywhere a human could not bypass it.
Approvals turn segregation of duties from theory into operational evidence. The four-eyes principle predates modern compliance, but its absence is still the single most common gap I see when an organization has passed audits and still loses data.
IBM's 2025 report named DevSecOps approaches and security AI insights among the top cost mitigators of breach impact, reducing average breach cost by USD 227,192 and USD 223,503 respectively.[4] Both are forms of automated, gated change. Savings come from the fact that an approval gate is the simplest possible failure-prevention mechanism that scales.
Approvals at the database layer have a specific failure mode. An engineer with direct production write access can mutate data in seconds. Either the approval gate is enforced at the moment of execution, or it is not enforced at all. Slack threads and Jira tickets are commentary on approvals that should have happened.
A real approval mechanism captures the query before it runs, requires a second authorized human to clear it, records the decision, and only then permits execution.
"Slack threads and Jira tickets are commentary on approvals that should have happened."
Auditability is the control that determines whether the first two controls can be proven after the fact. The definition matters: a real audit log captures every action attributable to a specific human identity, with the exact query, target system, timestamp, parameters, and outcome, written to an append-only store that the actor cannot modify.
The ACFE finding that median fraud takes 12 months to detect[6] and IBM's 241-day average breach lifecycle[4] exist for the same reason. The audit record was either absent, ambiguous, or unusable when investigators went looking. Shared accounts erase attribution. Query logs without context (no human identity, no approver, no business reason) are simply forensic noise.
The Continuous Controls Monitoring trend accelerates the shift from periodic, manual evidence collection to continuous, machine-generated evidence.[1] Auditors increasingly expect the latter. Compliance leaders who can hand an auditor an immutable, queryable record of who did what against which database last Tuesday spend less time on audits and more time on the security work the audit was supposed to motivate.
These controls are not separable. Segregation of duties without approvals is theater. Approvals without auditability are unverifiable. Auditability without segregation of duties just records what one person did unchallenged. A compliance program built on any one of them in isolation is missing the leverage that the other two provide.
Three controls at the database layer, with the principle, the typical gap, and the resulting risk for each.
Three forward-looking observations, each cited, each tied to action.
Continuous Controls Monitoring becomes standard practice for mature compliance programs. As noted earlier, Gartner projects 65% of organizations will integrate compliance automation into DevOps workflows by 2028.[1] Organizations that have already deployed CCM report audit preparation time and cost reductions of up to 50%, with the largest enterprises citing reductions of around 75% in manual monitoring costs.[9]
Evidence automation pipelines feed compliance hubs. Compliance automation platforms have become a category. Organizations are wiring control telemetry directly from operational systems into the platforms where their auditors, risk teams, and regulators consume it. The quarterly screenshot run is being replaced by continuous data flows, which reduces both audit-prep burden and the window between when a control fails and when someone notices.
AI governance pressure forces real data-access logging. Regardless of how the Digital Omnibus on AI reshuffles dates, the directional expectation is set. Every system that touches sensitive data should be able to answer who accessed it, when, with whose approval, and for what purpose. IBM's data on missing AI access controls makes the operational case independent of the regulatory one.[4] Companies that build the logging muscle now will not have to scramble when high-risk AI system rules come into application on December 2, 2027.
Compliance is shifting from artifact production to continuous property. Organizations that adapt will pass audits faster and measurably reduce breach lifecycle and fraud exposure.
Most compliance programs can produce a binder. Fewer can produce an answer to who ran which query against which database last Tuesday.
QueryDesk was built to answer that question at the database layer, and a few others alongside it.
QueryDesk replaces shared root credentials with a unified access plane that binds every database action to a specific human identity. Segregation of duties moves from a concept to the default state of the system.
Approval Flows enforce mandatory second-set-of-eyes review at the moment of execution. The query is captured, the approver is named, the decision is recorded, and only then does the query run against production.
Always-On Audit Trails capture every query, every user, every credential, and every timestamp automatically. The log is append-only and structured for the questions auditors actually ask.
Obfuscation by Default operates at the query layer rather than the presentation layer. QueryDesk rewrites the query before it reaches the database, so masked fields are never retrieved at all. The masked data never leaves the database because it is never queried in the first place. That is a meaningfully different security posture than masking results after the fact, and it matters for any framework that cares about minimum necessary access.
Workflows codify repetitive procedures, and they can incorporate approvals at specific steps inside a larger sequence. The same operation runs the same way every time, with the right human gates baked in where they belong.
QueryDesk recognizes that the compliance landscape is moving faster than any single feature set can chase. Native segregation-of-duties risk surfacing (the kind of access-combination analysis that compliance teams currently buy from specialized vendors) is on the roadmap. Pre-built mapping of QueryDesk audit data to specific SOC 2, ISO 27001, and DORA controls is in plan. Native handoffs from QueryDesk audit logs to compliance automation platforms are coming. We see these gaps and are committed to closing them; the investment signals our belief that this is where database-layer compliance is going.
Companies that successfully navigate the modern compliance and security landscape will treat compliance as a continuous property of well-built systems rather than a quarterly performance check mark. The database layer is foundational to that work because the most consequential data lives there, and most controls that look fine in policy quietly fail there in practice.
The landscape has moved from periodic to continuous. The costs of falling behind are documented in millions of dollars per breach and months of undetected fraud. Three controls (segregation of duties, approvals, and auditability) reduce both, and the database layer is where they have the most leverage.
For teams that want to see how QueryDesk implements those controls, start a trial. For how QueryDesk maps to specific roles, see the Compliance Lead and Engineering Leader pages.
About the author
Nick Holt is a compliance and technology risk professional specializing in SOC, SOX, ISO 27001, and NIST-based control environments. His experience includes leading audit readiness efforts, developing control language, facilitating walkthroughs, and helping organizations strengthen their risk and compliance programs. He brings a practical, business-focused approach to compliance, with an emphasis on clear documentation and sustainable controls.
References