Every system in the fleet can silently pick up a misconfiguration at a random moment — a new one, at a random system, with no warning. Both grids below see the exact same stream of events, so the comparison is apples-to-apples.
Periodic sampling audit (left) only looks at the fleet on a fixed schedule. Each time it fires, it draws a random subset of systems and checks only those — anything wrong outside that subset, or introduced right after the audit snapshot, keeps running exposed until the next scheduled audit.
Continuous monitoring (right) checks every system all the time, so a new misconfiguration is caught almost as soon as it appears, regardless of which system it lands on.
The chart tracks cumulative undetected exposure — the running sum, over every system and every day, of time spent with an unnoticed issue live. Sampling's curve climbs in bursts between audits; continuous monitoring's curve stays nearly flat.
- New misconfigurations — fleet-wide rate at which issues randomly appear.
- Audit interval — how far apart the periodic audits are spaced.
- Sample size — what fraction of the fleet each periodic audit actually inspects.