From pilot to real-world validation

In July, we shared how EMERALD Pilot 4 was taking shape as a continuous compliance environment for the financial sector, combining a hybrid cloud environment, automated evidence collection, document-based evidence analysis and a custom certification scheme tailored to a regulated financial organization. Since then, the pilot has reached an important milestone: putting these capabilities to the test through a real audit process.

In October 2026, independent auditors carried out an audit using the EMERALD environment. It followed a real audit approach, but on a representative subset of security controls, so that it could be managed within the pilot while respecting the privacy and security constraints of a financial institution. In total, 30 security controls and 64 metrics were exercised: 46 based on organizational and documentary evidence and 18 based on evidence obtained from infrastructure.

Can AI lighten the audit workload?

A significant part of any security audit is repetitive: locating evidence, reviewing policies, checking technical configurations and tracing findings back to individual controls. As organizations rely on more services and suppliers, this work becomes difficult to scale. EMERALD is exploring whether AI and automation can take on part of this workload while keeping expert judgment at the centre of the audit.

On the documentary side, EMERALD’s AMOE component analysed security documentation and associated relevant evidence with compliance metrics, so that auditors start from pre-selected information rather than reviewing every document manually. The pilot also showed why human expertise remains fundamental: documentation contains nuances, context, tables and complex relationships that an automated assessment may not interpret as a human auditor would. This points towards a collaborative model: AI assists in processing and organizing evidence, while the auditor interprets context and makes the final assessment.

Automating evidence from the infrastructure

Cloud environments already generate information about virtual machines, networks, storage, identities and their configurations. Pilot 4 explores whether this information can be turned directly into compliance evidence, rather than collected manually when an auditor requests it. OpenNebula acted as an Evidence Collection Gateway, connecting infrastructure events and configurations with the EMERALD assessment process: 18 infrastructure-oriented metrics were assessed through this automated path, with 15 producing evaluations aligned with the expected assessment. Organizations could thus move from collecting evidence because an audit has started to keeping it available whenever an assessment is required, which is especially valuable when the same requirements must be checked across many environments and suppliers.

Towards AI-assisted continuous assurance

The last Pilot 4 exercise does show that substantial parts of the workflow can already be supported by automated evidence collection and AI-assisted analysis. Automation performed best on clearly measurable infrastructure conditions, while documentary evidence pointed to the next improvements: better semantic analysis of complex documents and easier aggregation from individual metrics to an overall view of each control.

The lesson is not that audits should become fully autonomous, but that automation should handle what can be reliably automated, so that auditors can concentrate on interpretation, exceptions and the questions that require human judgment. For financial institutions, this could extend security assurance across more systems and suppliers and allow more frequent assessments, without increasing manual effort at the same rate. EMERALD Pilot 4 is an early but concrete example of that model: not replacing the auditor, but giving auditors and compliance teams better tools to make security assurance more continuous, manageable and scalable.

TECHNICAL KEY ADVANCEMENTS SINCE JULY 2026

• Real audit validation: independent auditors, real audit approach, controlled pilot scope.
• 30 controls and 64 metrics: documentary and infrastructure evidence in one workflow.
• 46 documentary metrics: AI-assisted evidence analysis (AMOE) at a meaningful scale.
• 18 infrastructure metrics: collected automatically via OpenNebula, 15 aligned with the expected assessment.
• Human plus automation: AI assists the assessment; auditors keep the final judgment.