[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F13":3},{"item":4,"lessons":16,"controls":67,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","13","Control 13","Network Monitoring and Defense",1398,"Center for Internet Security (CIS)","**What it asks for.** This control asks organisations to operate processes and tooling that provide comprehensive monitoring of and defence against threats across their network. It includes centralised alerting, intrusion detection or prevention, segmentation and traffic filtering.\n\n**In practice.** Mature teams correlate network and host telemetry in a central platform, deploy intrusion detection or network detection and response at key points, and filter traffic between segments. Port level access control, remote device posture checks and flow logging support investigations. A security operations function, internal or outsourced, tunes detection and handles alerts. Evidence includes architecture showing monitoring points, alert handling metrics and tuning records.\n\n**Common gaps.** Visibility of east west traffic and cloud networks is often weak, and alert fatigue leads to untuned rules being ignored. Segmentation plans exist on paper but are not enforced.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fnetwork-monitoring-and-defense","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1482,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"ai-powered-pen-testing-tools-lower-the-bar-for-attackers","AI-Powered Pen Testing Tools Lower the Bar for Attackers","2026-11-13T21:20:23.73+00:00",{"slug":24,"title":25,"published_at":26},"unauthenticated-ray-agent-enables-hidden-gpu-crypto-mining-via-rootkit","Unauthenticated Ray Agent Enables Hidden GPU Crypto Mining via Rootkit","2026-11-13T16:21:40.741+00:00",{"slug":28,"title":29,"published_at":30},"ai-powered-autonomous-attacks-breach-10-organizations-with-minimal-human-effort","AI-Powered Autonomous Attacks Breach 10 Organizations With Minimal Human Effort","2026-11-13T12:20:26.721+00:00",{"slug":32,"title":33,"published_at":34},"north-korean-hackers-steal-6b-from-binance-using-crypto-obfuscation-chains","North Korean Hackers Steal $6B from Binance Using Crypto Obfuscation Chains","2026-11-13T11:20:22.826+00:00",{"slug":36,"title":37,"published_at":38},"autonomous-ai-driven-attacks-breach-semiconductor-and-defense-targets","Autonomous AI-Driven Attacks Breach Semiconductor and Defense Targets","2026-11-12T16:21:21.535+00:00",{"slug":40,"title":41,"published_at":42},"operation-endgame-dismantles-multi-malware-infrastructure-stealing-millions-of-records","Operation Endgame Dismantles Multi-Malware Infrastructure Stealing Millions of Records","2026-11-12T16:20:42.268+00:00",{"slug":44,"title":45,"published_at":46},"ai-powered-espionage-tool-automates-credential-theft-and-trace-erasure-against-government-networks","AI-Powered Espionage Tool Automates Credential Theft and Trace Erasure Against Government Networks","2026-11-12T15:22:54.034+00:00",{"slug":48,"title":49,"published_at":50},"gsocket-backdoors-survive-patching-persistence-is-the-real-threat","GSocket Backdoors Survive Patching — Persistence Is the Real Threat","2026-11-12T10:20:21.914+00:00",{"slug":52,"title":53,"published_at":54},"ai-powered-red-teaming-tools-like-artex-lower-the-bar-for-autonomous-attacks","AI-Powered Red Teaming Tools Like ARTEX Lower the Bar for Autonomous Attacks","2026-11-12T00:20:48.496+00:00",{"slug":56,"title":57,"published_at":58},"gsocket-weaponized-for-persistent-c2-after-vulnerability-remediation","GSocket Weaponized for Persistent C2 After Vulnerability Remediation","2026-11-11T21:20:44.365+00:00",{"slug":60,"title":61,"published_at":62},"turla-hijacked-exchange-servers-as-covert-c2-infrastructure","Turla Hijacked Exchange Servers as Covert C2 Infrastructure","2026-11-10T22:21:40.469+00:00",{"slug":64,"title":65,"published_at":66},"376m-nitori-customer-records-stolen-after-weeks-of-undetected-access","37.6M Nitori Customer Records Stolen After Weeks of Undetected Access","2026-11-10T21:20:22.479+00:00",[68,73,78,83,88,92],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",612,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",346,{"slug":79,"name":80,"problem":81,"stories":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",338,{"slug":84,"name":85,"problem":86,"stories":87},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",201,{"slug":89,"name":90,"problem":91,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":93,"name":94,"problem":95,"stories":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",173,[98,104,109,114,119,125,130,136],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","32","Article 32","Security of processing",632,{"family":105,"item":106,"code":107,"title":107,"together":108},"itil","overview","ITIL",560,{"family":5,"item":110,"code":111,"title":112,"together":113},"12","Control 12","Network Infrastructure Management",543,{"family":5,"item":115,"code":116,"title":117,"together":118},"7","Control 7","Continuous Vulnerability Management",507,{"family":120,"item":121,"code":122,"title":123,"together":124},"nist-800-53","sc-7","SC-7","Boundary Protection",441,{"family":120,"item":126,"code":127,"title":128,"together":129},"si-2","SI-2","Flaw Remediation",405,{"family":131,"item":132,"code":133,"title":134,"together":135},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",368,{"family":120,"item":137,"code":138,"title":139,"together":140},"si-3","SI-3","Malicious Code Protection",352]