[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F18":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","18","Control 18","Penetration Testing",153,"Center for Internet Security (CIS)","**What it asks for.** Organisations should test the effectiveness and resilience of their assets by finding and exploiting weaknesses in controls, processes and technology, simulating the objectives and actions of an attacker. It covers a defined programme, regular testing and remediation of findings.\n\n**In practice.** A mature programme sets scope, frequency and rules of engagement, and combines external and internal tests, with application and social engineering testing where relevant. Tests are performed by qualified testers, findings are prioritised and remediated, and fixes are validated by retesting. Evidence includes the testing programme, reports, remediation tracking and retest results.\n\n**Common gaps.** Tests are often narrowly scoped to satisfy a compliance requirement and repeated on the same targets each year. Findings may be accepted without remediation or retest, so the same issues recur.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fpenetration-testing","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},167,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"ai-powered-security-tools-raise-questions-about-dependency-and-risk","AI-Powered Security Tools Raise Questions About Dependency and Risk","2026-11-12T21:20:37.136+00:00",{"slug":24,"title":25,"published_at":26},"ai-driven-autonomous-pentesting-enters-the-enterprise-security-toolkit","AI-Driven Autonomous Pentesting Enters the Enterprise Security Toolkit","2026-11-12T16:21:01.655+00:00",{"slug":28,"title":29,"published_at":30},"build-infrastructure-breach-exposes-100000-customer-secrets-to-ai-fraud","Build Infrastructure Breach Exposes 100,000 Customer Secrets to AI Fraud","2026-11-10T23:20:44.354+00:00",{"slug":32,"title":33,"published_at":34},"ai-agent-cybersecurity-benchmarking-highlights-real-world-attack-capability-risks","AI Agent Cybersecurity Benchmarking Highlights Real-World Attack Capability Risks","2026-11-10T17:22:56.354+00:00",{"slug":36,"title":37,"published_at":38},"qubole-iam-credential-abuse-exposes-customer-aws-environments-via-cross-account-trust","Qubole IAM Credential Abuse Exposes Customer AWS Environments via Cross-Account Trust","2026-11-09T16:21:48.8+00:00",{"slug":40,"title":41,"published_at":42},"42-million-civic-records-exposed-via-unprotected-database","42 Million Civic Records Exposed via Unprotected Database","2026-10-29T21:21:20.918+00:00",{"slug":44,"title":45,"published_at":46},"ai-agent-wallets-need-granular-token-approval-controls","AI Agent Wallets Need Granular Token Approval Controls","2026-10-28T14:21:23.497+00:00",{"slug":48,"title":49,"published_at":50},"cisa-updates-scubagear-and-scubagoggles-to-strengthen-cloud-configuration-auditing","CISA Updates ScubaGear and ScubaGoggles to Strengthen Cloud Configuration Auditing","2026-10-28T10:21:43.05+00:00",{"slug":52,"title":53,"published_at":54},"ai-driven-external-pentesting-highlights-need-for-proactive-perimeter-security","AI-Driven External Pentesting Highlights Need for Proactive Perimeter Security","2026-10-28T10:20:21.375+00:00",{"slug":56,"title":57,"published_at":58},"cisa-releases-free-tools-to-catch-cloud-security-misconfigurations","CISA Releases Free Tools to Catch Cloud Security Misconfigurations","2026-10-27T16:20:44.309+00:00",{"slug":60,"title":61,"published_at":62},"university-of-copenhagen-breach-exposes-525000-records-via-poorly-secured-test-environment","University of Copenhagen Breach Exposes 525,000 Records via Poorly Secured Test Environment","2026-10-27T12:21:06.322+00:00",{"slug":64,"title":65,"published_at":66},"dormant-ai-agents-retain-excessive-access-posing-silent-data-risk","Dormant AI Agents Retain Excessive Access, Posing Silent Data Risk","2026-10-26T06:20:24.081+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",64,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",61,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",38,{"slug":84,"name":85,"problem":86,"stories":87},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",31,{"slug":89,"name":90,"problem":91,"stories":92},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",29,{"slug":94,"name":95,"problem":96,"stories":97},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",26,[99,105,110,115,120,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-2","SI-2","Flaw Remediation",73,{"family":106,"item":107,"code":108,"title":108,"together":109},"itil","overview","ITIL",72,{"family":5,"item":111,"code":112,"title":113,"together":114},"7","Control 7","Continuous Vulnerability Management",69,{"family":5,"item":116,"code":117,"title":118,"together":119},"12","Control 12","Network Infrastructure Management",66,{"family":121,"item":122,"code":123,"title":124,"together":125},"gdpr","32","Article 32","Security of processing",49,{"family":100,"item":127,"code":128,"title":129,"together":130},"ra-5","RA-5","Vulnerability Monitoring and Scanning",36,{"family":100,"item":132,"code":133,"title":134,"together":135},"ac-6","AC-6","Least Privilege",32,{"family":100,"item":137,"code":138,"title":139,"together":135},"sc-7","SC-7","Boundary Protection"]