Most organisations measure control coverage constantly and control efficacy annually. Coverage is easy: the firewall exists, the EDR agent is deployed, the policy is written. Efficacy is whether any of it would actually stop the attack that lands on a Tuesday afternoon in March. That question usually gets answered once a year, by a consultant, against a scope agreed six weeks earlier.
The gap between assessed and actual
Controls degrade silently. A firewall rule that was correct at the assessment gets a permissive exception added during an incident and never removed. An EDR agent stops reporting after an OS upgrade and nobody notices because the dashboard still shows the host as enrolled. A segmentation boundary is bridged by a helpful network change for a migration. None of this generates an alert, because the thing that would alert is the control that quietly stopped working.
Meanwhile the environment itself changes daily — new services, new identities, new exposures — and time-to-exploit for a newly disclosed vulnerability is routinely measured in hours. The distance between "how fast your attack surface changes" and "how fast you can prove your controls still hold" is where breaches live.
What Monolith validates, continuously
Monolith treats every control as unproven until it has been seen to hold, and re-proves it on a cadence measured in hours rather than quarters.
- Egress policy. It confirms blocked destinations are actually blocked by attempting the connection, not by reading the rule.
- Segmentation. It probes zone and VLAN boundaries under realistic lateral-movement attempts to confirm they hold.
- Endpoint telemetry. It detects agents that have gone quiet — enrolled but silent — before they become blind spots.
- Patch state. It verifies a remediation actually applied and the exposure closed, not merely that a change ticket was marked done.
- Detection coverage. It exercises attack techniques against a digital twin of the estate and treats the absence of an alert as the finding.
Offensive validation runs only inside a signed scope you define. Anything unlisted is blocked at the policy and network layer, and every probe is written to the evidence store.
Why this is different from a scanner
A vulnerability scanner enumerates what could be wrong. Breach-and-attack-simulation products replay techniques but typically report to a console for a human to work through. Monolith closes the loop: it exercises the control, identifies the gap, stages the remediation, and executes it on approval — then re-runs the exercise to confirm the fix held. The output is not a list of findings; it is a steadily shrinking exposure window with evidence for every step.
What it gives a CISO
Control efficacy becomes a timestamped measurement rather than an annual assurance. When the board asks whether the egress policy would have stopped the exfiltration described in last week's industry bulletin, the answer is not "we believe so" — it is "it was exercised against that technique on Thursday at 03:14 and held, and here is the record."
Annual testing still has a place: an independent assessor brings an outside perspective and satisfies external requirements. But it is one data point. Monolith provides the other 364.
Speed is the KPI
The number a board can understand is the exposure window: the time between a control failing or an exposure appearing and the moment it is verified closed. Measured annually, that number is unknown for most of the year. Measured continuously, it becomes a metric that goes down, and Monolith reports it before and after on every class of exposure: mean time to detect, mean time to remediate, and the window in between. In week one it is a finding. By day thirty it is a trend.
Someone to stand behind it
Acting on an estate is only defensible if someone can stand behind every action. Monolith operates to a published controlled-autonomy standard, and every validation, every proposed fix and every remediation lands in a hash-chained evidence record nobody on your team can edit. When the auditor, the regulator or the board asks what was tested, when, by whom, with what authority and with what result, the answer is a record rather than a recollection.
The mechanics of the loop, from twin construction to verification, are on how the simulations actually run.
Frequently asked questions
Is continuous control validation the same as breach and attack simulation?
They overlap. BAS replays attack techniques to test detection and prevention. Continuous control validation as Monolith performs it goes further by also validating configuration state (egress rules, patch application, agent health), staging and executing the remediation for gaps it finds, and verifying the fix — rather than reporting findings into a queue.
Does exercising controls risk disrupting production?
Probes run within a signed scope you define, with explicit exclusions, rate limits and a single revocation control. Techniques with any destructive potential are run against the digital twin rather than the live estate, and irreversible actions are human-only at every autonomy setting.
How often does Monolith exercise a given control?
Continuously, on a cadence driven by change: a control is re-validated when the environment it protects changes, when new intelligence affects it, and on a baseline interval regardless. In practice most controls are exercised many times a day rather than once a year.
Does this replace our annual penetration test?
No. An independent external assessment satisfies regulatory and contractual requirements and brings a fresh perspective. Monolith addresses the 364 days in between, when controls drift and the environment changes.
What happens when a control fails validation?
The failure is logged as a finding with the evidence, the remediation is staged with severity and blast radius, and it is presented for approval — or executed automatically if it falls into a class you have pre-authorised. After remediation the control is re-exercised to confirm it now holds.