AWS Foundational Security Best Practices ships ~290 controls. SOC 2 Trust Services Criteria added 12 new criteria in the 2017 → 2022 revision. NIST CSF 2.0 added a whole new function (Govern). Every one of those updates means a vendor with a hand-coded rule library has to allocate engineering time to translate the new doc into rule files. We measured what that actually costs.
The half-life math
We pulled the public release notes from the four largest hand-coded compliance vendors. Median time from a framework revision to coverage in their product: 11 weeks. Mean: 19 weeks. The 90th percentile: 38 weeks. That's a customer running an audit on the new framework while the vendor's library still encodes the old one — for nine months.
That gap doesn't show up in the marketing copy. It shows up when an external auditor asks for evidence against the new criteria and the vendor's report cites the old ones.
What changes when the corpus is the source of truth
CME ships an agent that reads the framework PDF directly. Re-ingest takes ~12 minutes for SP 800-53 Rev. 5 (398 controls, 1,200+ pages). Coverage updates the same hour. The customer's next audit cites the new revision.
The math we'd expect a serious buyer to run: if a framework you care about updates twice a year and the vendor takes 11 weeks to catch up, you're spending ~20 weeks a year on stale evidence. For most teams that's worse than the gap they were trying to fix.