Written by Will Jones
Businesses managing cybersecurity requirements often find themselves working across multiple frameworks, audits, documentation systems, spreadsheets, consultants, and specialized tools. Each requirement can demand internal time, technical expertise, and financial resources, creating pressure to find an efficient path through compliance while keeping attention on the security practices those requirements are intended to support.
Mike Kim, co-founder and CEO of Mycroft, an AI-native security and compliance company, sees an opportunity to reconsider that dynamic. Drawing on more than a decade of cybersecurity and compliance experience, Mike argues that organizations can benefit from moving away from an instinct to optimize solely for cost and convenience.
“If the goal becomes finding the cheapest or easiest way to satisfy a requirement, you can lose sight of why the requirement exists in the first place,” he says. For Mike, compliance works best as a framework for building stronger security, with certification serving as evidence of that work.
That distinction matters because an audit can verify that particular policies, controls, and processes exist within a defined scope. Meanwhile, security extends into the daily condition of an organization’s systems, identities, applications, cloud infrastructure, and data.
A controversy involving a compliance provider brought that distinction into sharper focus after a former customer accused the company of using fabricated evidence and audit practices that could give customers the appearance of compliance without corresponding security work. The issue gained further attention when a customer associated with the provider experienced a security incident and subsequently moved its compliance program to another provider for re-certification. “These developments offer a broader lesson,” Mike says. “Certification can document the presence of specified policies and controls, while those controls still need to function within the organization’s everyday security environment.”
Mike’s perspective starts with a question: Can an organization account for the assets it needs to protect? Servers, cloud environments, applications, identities, endpoints, and code can accumulate as businesses grow, and the resulting complexity can make basic visibility surprisingly difficult. Mike argues that organizations can sometimes gain substantial security value from fundamentals such as password management, access reviews, and understanding who has access to which systems. Those measures can also provide a clearer basis for deciding where additional technology is warranted.
This is where Mycroft’s AI-native model enters the broader conversation. The company’s platform brings together security and compliance functions across frameworks including SOC 2, CMMC, FedRAMP, FedRAMP 20x, GDPR, HIPAA, ISO 27001, and ISO 42001, while connecting compliance work with cloud, application, device, and third-party risk. Its role reflects Mike’s view that security information becomes more useful when it can be interpreted in the context of an organization’s actual environment.
Mycroft’s proprietary technology powers the Risk Operations Center, a mechanism for processing large volumes of security information and identifying priorities. Mike states, “This can help organizations move through the noise surrounding cybersecurity by finding smaller, actionable improvements that may deserve attention before another layer of tooling is purchased.” The company’s broader model combines AI with domain expertise, allowing information from different parts of the security environment to contribute to prioritization and compliance work.
The potential value of that model extends beyond reducing the administrative cost of an audit. Mike views the opportunity as a resource-allocation problem. Security teams have finite time, attention, and budgets, so technology can help direct those resources toward areas where they may have greater practical impact. “The question isn’t simply whether AI makes compliance cheaper,” Mike says. “The bigger question is whether AI can help a company spend its limited security resources on the things that matter most.”
That perspective also changes the meaning of compliance itself. Mycroft’s platform can generate and manage artifacts such as policies, risk registers, system descriptions, security plans, and plans of action, while its experts can help configure controls, collect evidence, and maintain and operate the compliance program. The broader objective is to connect those artifacts with the environment they describe, giving compliance documentation a relationship with ongoing security operations.
Trust becomes especially important in that equation. A certification can influence purchasing decisions, customer relationships, and access to regulated markets, while trust can take considerably more effort to rebuild after a security failure or a credibility concern. Mike’s argument is about giving compliance the right place in the security lifecycle. “Trust is an asset,” he emphasizes. “Once you’ve damaged it, rebuilding it can take much longer than building it properly in the first place.”
For businesses pursuing sophisticated contracts, particularly in regulated sectors and government markets, that distinction can have commercial implications. Mycroft’s focus reflects a broader demand for security programs that can support ambitious growth while meeting formal requirements. “Our mission is to help organizations achieve enterprise-grade security and compliance without building massive internal teams,” Mike remarks.
In that context, compliance can serve as the entry requirement, while security capability can become part of the value proposition a company brings to customers and partners. Certification can demonstrate that a defined standard has been addressed, while the quality of the underlying security program can influence how confidently an organization operates after the auditor leaves. For Mycroft, AI offers a way to make that deeper work more accessible by helping companies understand their environments, prioritize meaningful actions, and connect compliance with the security practices those frameworks were designed to encourage.
