Beyond the automation gap: a survey on continuous compliance audit for IoT security

Briliyant, Obrina ORCID: https://orcid.org/0000-0002-1054-8112, Javed, Amir ORCID: https://orcid.org/0000-0001-9761-0945 and Cherdantseva, Yulia ORCID: https://orcid.org/0000-0002-3527-1121 2026. Beyond the automation gap: a survey on continuous compliance audit for IoT security. Computers and Security 168 , 104953. 10.1016/j.cose.2026.104953

Preview

PDF - Published Version Available under License Creative Commons Attribution Non-commercial No Derivatives. Download (3MB) | Preview

Abstract

Despite decades of research into automated security compliance tools, only 18% of organizationsactually use them. This gap between academic innovation and real-world adoption is particularly an issue for Internet of Things (IoT) environments, where the sheer volume of connected devices makes manual security auditing challenging. This review investigates why computer-assisted auditing technologies fail to gain traction in practice. We trace the evolution of compliance automation and reveal a fundamental disconnect. Our analysis introduces a human-centered framework that systematically categorize current technologies and identifies where each falls short of auditor needs. Rather than pursuing ever-more sophisticated automation, we argue that effective compliance tools must augment human expertise through collaborative human-computer interaction. The review synthesizes diverse approaches across formal methods, network analysis, and regulatory frameworks, consistently finding that technical excellence alone cannot bridge the implementation gap. We conclude by presenting a research roadmap that guides security researchers toward building practically viable solutions, ones that leverage strong academic foundations while addressing the urgent, real-world need for continuous IoT security auditing,

Item Type:	Article
Date Type:	Publication
Status:	Published
Schools:	Schools > Computer Science & Informatics
Publisher:	Elsevier
ISSN:	1872-6208
Related URLs:	Publisher
Date of First Compliant Deposit:	8 May 2026
Date of Acceptance:	30 April 2026
Last Modified:	04 Aug 2026 21:36
URI:	https://orca.cardiff.ac.uk/id/eprint/181387

Actions (repository staff only)

Edit Item