Techniques for identifying gaps in security controls

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• integrating with a set of security controls deployed with respect to a computing environment, wherein integrating with the set of security controls further comprises deploying an artifact in the computing environment, wherein the artifact is configured to record a plurality of activities performed in the computing environment by the set of controls, wherein integrating with the set of security controls further comprises enforcing at least one policy requiring code releases in the computing environment to be signed using an instance of the artifact;
• identifying at least one computing asset to be protected by the set of security controls;
• identifying at least one security control gap in the computing environment based on a configuration of the set of security controls, wherein each security control gap is defined with respect to one of the identified at least one computing asset;
• and
• performing at least one remediation action with respect to the identified at least one security control gap.

A system for identifying security control gaps, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• integrate with a set of security controls deployed with respect to a computing environment, wherein integrating with the set of security controls further comprises deploying an artifact in the computing environment, wherein the artifact is configured to record a plurality of activities performed in the computing environment by the set of controls, wherein the system is further configured to enforce at least one policy requiring code releases in the computing environment to be signed using an instance of the artifact;
• identify at least one computing asset to be protected by the set of security controls;
• identify at least one security control gap in the computing environment based on a configuration of the set of security controls, wherein each security control gap is defined with respect to one of the identified at least one computing asset;
• and
• perform at least one remediation action with respect to the identified at least one security control gap.