The Detection Gap

Edition #14: The Detection Gap

Your runtime scanning tool flags a critical finding - Terraform code deployed an S3 bucket with public read access three days ago.

The code was reviewed, approved, merged to main, and deployed. Now the developer needs to context-switch back, fix the Terraform, create a new PR, wait for approval, and redeploy.

This is The Detection Gap - discovering violations after code review, after CI/CD, after deployment. Issues found too late when fixes are expensive.

Runtime detective controls catch problems in production. By then, developers have moved on. Rework requires context switching, re-review, redeployment. What could have been a 30-second fix during the pull request becomes a multi-day cycle.

The issue is detecting at the wrong lifecycle stage. Shift standards validation into the build process using the Standards and Controls Practices from the 5 Practices of Cloud Governance:

→ Implement IaC scanning in CI/CD - Scan Terraform, CloudFormation, ARM templates during pull requests. Violations caught in seconds.
→ Integrate into developer workflow - Pre-commit hooks, IDE plugins, PR checks provide instant feedback when context is fresh.
→ Define standards as scannable policies - Codify standards into policy files developers can test locally before committing.
→ Fail builds on critical violations - Build pipeline enforces standards before runtime.
→ Keep runtime as safety net - Build-time catches IaC violations. Runtime catches console changes and drift.

Build-time validation catches violations when fixes are trivial. Issues don't reach production. Runtime shifts from primary enforcement to backup verification.

- Keep on Herding, Bob

What's Happening in Cloud Governance 📡

Cost Ownership Can't Be Centralized: Effective cost management requires distributed accountability rather than centralized control, with development teams taking ownership of their budgets. This approach mirrors observability practices and strengthens overall cloud governance by making financial responsibility a core part of every team's workflow.

How AI Is Reshaping Cloud Strategy and Governance in Higher Education: Higher education institutions are establishing governance frameworks as the foundation for responsible AI adoption. These structures help define how technologies are selected, deployed and used while balancing cloud, on-premises, and hybrid approaches based on data sovereignty and security needs.

IT Leaders Struggle with Cloud Costs: IT leaders face mounting challenges managing cloud costs as spending continues to grow. Organizations are seeking optimization strategies and better governance frameworks to control expenses while maintaining operational efficiency.

A New Era for Compliance: The Compliance Automation Revolution: The Compliance Automation Revolution transforms cloud governance by automating evidence collection, embedding compliance checks into development pipelines, and harmonizing regulatory frameworks. This enables organizations to shift from manual audits to continuous, real-time compliance monitoring.

Get Involved 👋

Join the conversation on LinkedIn about this newsletter edition.