The Last Manual Audit: Agentic AI and the Future of Compliance

Why are cybersecurity audits universally hated?

Seventy percent of large companies go through cybersecurity audits every year according to CFO magazine. Everyone hates them.

Compliance teams prepare for months. They gather evidence. They stay late, they work weekends. Operations slow. Auditors send lists. Auditors send deadlines. Nothing about this is novel. Nothing about this is humane.

I know because I lived it.

What does an audit actually feel like?

At IBM, in the financial services group, an IT audit was announced, with a focus on identity and access management. No introduction, no ceremony, just a short email announcing the start.

Four auditors scattered across the world, all wanting everything: logs, evidence, histories. The 40 requests arrived with a deadline: 72 hours, and follow-ups required within four hours.

We flew to North Carolina, to IBM’s offices in Research Triangle Park. The buildings were built in the sixties, built for manufacturing. Now they were offices, half-empty, corridors echoing with the sense of a place out of time.

Inside, my team assembled. We merged massive datasets. We checked user accounts against directories that hadn’t been updated. We pulled logs no one could read. Thousands of lines of timestamps, IP addresses, cryptic error codes. We opened ServiceNow, traced requests, permissions, approvals. We stayed until late at night with deadlines closing in. None of it was designed for us to succeed.

This is how audits work. This is how audits have always worked. The ritual of suffering. 

Why are audits like digital archaeology?

We were digging through layers of digital sediment, searching for fragments that might build a story. Every log was a fragment. Every permission change, a decision. Why it happened, no one could say. Why it mattered, we had to prove.

An audit is not an investigation. It is not even verification. It is a reconstruction. A story told backwards. Like a carriage horse pulling against the weight of the past, while the road ahead has already been paved for something faster.

How will AI digital employees impact audits?

AI digital employees are not efficiency software, not automation, something different. They act,  investigate, provide context,  and change course as they find patterns. Its Agency, the capacity to act without us.

During those three weeks, my team strained against time, memory, and volume. An AI system would not. It could chase multiple threads at once, compare sources, adapt as it went. It would not stop.

Audits will change in three ways:

• Proactive Investigation: Rather than waiting for specific queries, agentic AI can identify potential issues and begin investigating them autonomously, often discovering problems before they become compliance failures.
• Dynamic Adaptation: As new information emerges during an audit, agentic systems can adjust their investigative strategies in real-time, following leads that human auditors might miss or lack time to pursue.
• Continuous Monitoring: Unlike periodic human audits, agentic AI maintains persistent awareness of system changes, building ongoing evidence trails that provide comprehensive audit readiness at any moment.

Why is Context so Important?

Auditors want more than evidence. They want a narrative they can trust. AI digital employees can provide the whole picture.

AI will build a digital twin of the environment

• Every ticket, every log, every record, held together, alive, available at once.
• No more human request-and-response cycles.
• Auditors will work directly with a digital employee, asking questions and getting answers instantly.
  

AI will explain the why, not just the what

• Not just that a user had a permission, but why.
• Whether it was granted intentionally.
• Whether it was ever used.
• How it compares to patterns across the enterprise.
  

How do AI Digital Employees uncover hidden risks?

Take one request: verify that terminated employees no longer had system access.

For us, this meant genealogy. Permissions passed along through groups, requests, outdated authorities. Every inheritance is documented by screenshots and signatures.

The AI digital employees would have produced the lineage instantly. Not just who had access, but how it came to be, what circumstances led to it, whether it fit patterns or stood apart. The entire story in one motion.

It would have surfaced what we could not see:

• The Forgotten Contractor – Access that should have expired but did not.
  
• The Promoted Manager – Administrative privileges that lingered after a role change.
  
• The Phantom Integration – A dormant service account left open, waiting.
  

We missed these stories because we were drowning. 

What is the difference between static and living evidence?

Traditional audits rely on static evidence: screenshots, exported logs, attestations. Evidence that is already decaying as it is captured.

AI digital employees treat evidence as living information. Continuous. Dynamic. Always aware. It builds the history as it happens, providing continuous assurance instead of periodic reconstruction.

Can we trust AI to verify human behavior?

There is unease in letting a non-human intelligence verify human behavior. But AI offers something humans cannot: consistency.

• The same rigor every time.
  
• No fatigue.
  
• No shortcuts.
  
• No politics.
  

How much do manual audits cost?

That IBM audit consumed 2,300 hours of human labor. Eleven people, three weeks. Projects delayed. Resources drained. Stress levels maxed.

And what did we get? Temporary assurance. A certificate that expired the moment it was signed.

Why is AI assurance more cost-effective?

AI digital employees changes the equation:

• Continuous assurance.
  
• Decreasing costs over time.
  
• No frantic flights to empty offices.
  
• No endless nights of copying and pasting logs.
  

Why will this be the last manual audit?

The audit I lived through will soon look as dated as carbon paper.

Because this isn’t just faster software. It is a different kind of worker. A digital employee that does not wait, that does not forget, that sees the why as clearly as the what.

This is not about replacing judgment. It is about freeing judgment. The AI employees will be there first, answering instantly, providing stories with the facts. Ready when the auditors call.

The revolution has already begun. The only question left is how quickly we decide to join.

‍

About the Author

Justin Woody is the co-founder of Twine. Previously he was the Senior Director of Innovation and Market Research at Claroty, a leading firm in Industrial Control Systems and medical security. 

An active speaker at global events, Justin maintains close ties with a network of cyber leaders to foster innovation and share insights. Outside of work, he enjoys spending time with his family and pursuing his passion for flying.