How permanent are some of the pandemic-induced changes going to be?

It's interesting that you brought up the whole inspection process, the whole certification process, the whole auditing process. I think that a lot of people for a long time did these audits in an impromptu cycle, they had a process that was well documented, but they didn't follow that process completely. They'd set up the war room. They'd cover a little bit each day, depending on who was available. I always assumed that the audit was a better audit, because people couldn't just plan their response. They had to do a little bit off the cuff and they had to riff it a little bit. And they didn't know when something was going to be inspected, so there was a little surprise factor. I always felt web trust audits and things like that were done in that way, because it lended some credibility to it. Do you think you've lost some of that credibility by having to be more regimented and more thoroughly planned out as to when something is going to happen?

I don't think so. There's always a bit of an adversarial relationship between an auditee and an auditor. Which is why I think compliance is not the same thing as security. Your objective is to provide them the necessary information that they'll understand, not so much the larger picture. We're not seeking advice, we're seeking conformance assessment. There was too much faith put into these physical assessments of conformity, in that you based conformance on what you saw was correct at this particular time. Auditors are now being forced to recognize there's more of an adversarial relationship than a collaborative one. You might be taking a more collaborative approach, but their brand is dependent upon them doing competent assessment, and so that their assertions are actually valid. And I think that will manifest into more automation, not just in gathering of evidence, but producing reliable, verifiable evidence. I think that's an interesting trend that maybe isn't directly apparent when looking at the impacts of COVID, but is something that I think we might be on the cusp of.

The automation, reproducibility, and ongoing, continuous validation that you're thinking compliance is going to have as a future, I think it's happening in other areas as well. In software development, there's sometimes vast differences between spec and implementation. Most of the time, there's a lot of hidden little artifacts, personality artifacts, or maybe relationship artifacts or, some decisions that were made off the cuff and not documented well through that process. The cost of that isn't really recognized until you have to absolutely trust a piece of software or until you have to support that software. I think that that kind of automation has gotten a significant jolt in the last year as things get more and more automated and reproducible.