[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F14":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","14","Control 14","Security Awareness and Skills Training",900,"Center for Internet Security (CIS)","**What it asks for.** Organisations should run a security awareness programme that shapes how staff behave so that they are security conscious and appropriately skilled. It covers general awareness topics and role specific training for those with particular responsibilities.\n\n**In practice.** A good programme trains all staff at onboarding and at least yearly on topics such as social engineering, authentication, data handling and incident reporting, and adds role based training for developers, administrators and executives. Content is refreshed to reflect current threats, and phishing simulations or other exercises measure behaviour. Evidence includes completion records, training content, simulation results and reporting rates over time.\n\n**Common gaps.** Programmes often focus on annual completion rates rather than behaviour change, and role based training for privileged users is frequently missing. Staff are seldom told clearly how and where to report a suspected incident.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fsecurity-awareness-and-skills-training","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1410,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto","North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto","2026-11-13T22:21:35.043+00:00",{"slug":24,"title":25,"published_at":26},"north-korean-deepfake-video-calls-drain-400m-in-crypto","North Korean Deepfake Video Calls Drain $400M in Crypto","2026-11-13T16:23:15.645+00:00",{"slug":28,"title":29,"published_at":30},"gootloader-takedown-exposes-risks-of-compromised-websites-and-access-as-a-service-malware","Gootloader Takedown Exposes Risks of Compromised Websites and Access-as-a-Service Malware","2026-11-13T16:22:57.628+00:00",{"slug":32,"title":33,"published_at":34},"fake-gta-6-download-delivers-credential-stealing-malware","Fake GTA 6 Download Delivers Credential-Stealing Malware","2026-11-13T16:22:38.997+00:00",{"slug":36,"title":37,"published_at":38},"leaked-secrets-and-a-backdoored-ai-tool-give-attackers-cloud-access-in-minutes","Leaked Secrets and a Backdoored AI Tool Give Attackers Cloud Access in Minutes","2026-11-13T16:21:03.622+00:00",{"slug":40,"title":41,"published_at":42},"north-korean-facestealer-social-engineering-and-open-source-compromise-fuel-400m-crypto-theft","North Korean FaceStealer: Social Engineering and Open-Source Compromise Fuel $400M Crypto Theft","2026-11-13T15:21:17.928+00:00",{"slug":44,"title":45,"published_at":46},"compromised-github-accounts-weaponized-to-poison-thousands-of-repositories","Compromised GitHub Accounts Weaponized to Poison Thousands of Repositories","2026-11-13T10:20:30.167+00:00",{"slug":48,"title":49,"published_at":50},"fake-captcha-pages-trick-macos-users-into-running-cryptocurrency-stealing-malware","Fake CAPTCHA Pages Trick macOS Users into Running Cryptocurrency-Stealing Malware","2026-11-13T05:20:22.452+00:00",{"slug":52,"title":53,"published_at":54},"north-korean-social-engineering-nets-billions-from-crypto-exchange","North Korean Social Engineering Nets Billions From Crypto Exchange","2026-11-13T03:20:21.598+00:00",{"slug":56,"title":57,"published_at":58},"north-korean-social-engineering-campaign-steals-12b-via-fake-meetings-and-account-hijacking","North Korean Social Engineering Campaign Steals $1.2B via Fake Meetings and Account Hijacking","2026-11-13T01:20:21.778+00:00",{"slug":60,"title":61,"published_at":62},"north-korean-hackers-steal-16b-via-social-engineering-and-deepfakes","North Korean Hackers Steal $1.6B via Social Engineering and Deepfakes","2026-11-12T22:20:19.315+00:00",{"slug":64,"title":65,"published_at":66},"stealc-takedown-exposes-millions-of-stolen-credentials-from-everyday-users","StealC Takedown Exposes Millions of Stolen Credentials From Everyday Users","2026-11-12T17:21:32.836+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",535,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",527,{"slug":79,"name":80,"problem":81,"stories":82},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",456,{"slug":84,"name":85,"problem":86,"stories":87},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",311,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",258,{"slug":94,"name":95,"problem":96,"stories":97},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",129,[99,105,111,117,123,128,133,139],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",710,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",472,{"family":112,"item":113,"code":114,"title":115,"together":116},"nist-800-53","si-2","SI-2","Flaw Remediation",470,{"family":118,"item":119,"code":120,"title":121,"together":122},"mitre-attack","t1566","T1566","Phishing",468,{"family":5,"item":124,"code":125,"title":126,"together":127},"17","Control 17","Incident Response Management",426,{"family":112,"item":129,"code":130,"title":131,"together":132},"at-2","AT-2","Literacy Training and Awareness",395,{"family":134,"item":135,"code":136,"title":137,"together":138},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",356,{"family":140,"item":141,"code":142,"title":143,"together":144},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",298]