IP Services' CEO would audit a security program by asking when it last restored from backup

The gap those questions open is between a control that exists and a control that has been exercised. A firewall rule can be confirmed from a change record. A restore cannot be confirmed by anything except a restore. That asymmetry is why the tool inventory is the artefact that travels upward: it is auditable from paperwork, and it is available in any quarter you ask for it ^[4].

The arithmetic inside Alldridge's own piece is the useful part. The list of what most organizations already own runs to seven line items ^[4][5]. The audit he proposes runs to four questions ^[7][8]. Three of the four can only be answered by performing the test, and only the question about over-privileged accounts can be settled from records an organization already holds ^[19].

On segmentation he reports a specific failure mode. Firewalls, VLANs and policies all read correctly, and everyone involved believed the controls were in place, until the actual communication paths were tested and systems were found talking in ways nobody intended ^[13]. "The documentation looked secure, but the environment told a different story," Alldridge wrote ^[14].

The conflict of interest is worth stating: an IT services chief executive telling buyers their controls are untested is describing a market. The answer is in where his argument sends the money. He names poor change management, configuration drift and unmanaged systems as the things quietly undermining security, and writes that "Security maturity cannot sustainably exceed operational maturity" ^[16]. That points spending at operational discipline. On most security budgets that is the least fundable item.

The evidence has a clear limit. The assessments in the column are described without naming an organization, a date, or a count, and there is no measured population behind any of it ^[18]. So this is a hypothesis about which failures matter, resting on one practitioner's casework. The four questions are testable whether or not his casework is representative.

The tradeoff he does not price is time. A restore rehearsal and a 2 a.m. drill draw on the same operations hours as the next tool rollout, and the restore consumes production capacity to prove a negative. That makes the split between this quarter and this decade fairly sharp. The privileged-account review and a single restore test fit in a quarter. Mapping actual communication paths across an estate is the multi-quarter programme, and it is the one that overturned the documentation in his account ^[13].

One item on his list is newer than the rest. AI agents appear in the inventory he wants built, alongside users, privileged accounts and service accounts ^[10], and again in behavioral detection, where he asks whether an agent is operating outside its intended scope ^[17]. They appear nowhere in the seven controls he opens with ^[4].