Hacking the audit interview

Lea Viljanen opens by framing security audits and assessments as fact-finding exercises that depend heavily on talking to people. Newer application security standards include architecture and threat modeling items that cannot be checked by technical testing alone, so the auditor's interview is there to collect evidence of how an organisation actually works. She stresses that the talk is about human psychology rather than technical methods.

The middle of the talk covers levers an auditor can use to get people talking. These include letting interviewees talk about their own work, giving honest recognition of their expertise, finding common ground while being wary of copying body language, and holding interviews somewhere relaxed, such as the interviewee's home, or at an uncomfortable time to test how they handle it. She then flips the view to the audited person, describing how they can keep the conversation impersonal, avoid volunteering information, or push so much detail that the session runs out of time. She also discusses why people lie to protect themselves, the role of psychological safety and blame culture in an organisation, and the difference between honest misremembering and deliberate lying.

Her closing point is that interviews alone rarely settle anything. Claims are followed up by requests for pipeline definitions, tool reports, tickets and meeting minutes, and when evidence cannot be produced the gap is recorded as a finding or left open for later. For practitioners, the takeaway is to build interview questions around verifiable evidence, to expect defensiveness when people fear blame, and to understand how the same dynamics can help or hinder either side of an audit.