[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F2":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","2","Control 2","Inventory and Control of Software Assets",1377,"Center for Internet Security (CIS)","**What it asks for.** The organisation should track all software installed or running on its assets and ensure that only authorised, supported software can be installed and executed. Unsupported or unapproved software is a common entry point and should be found and removed.\n\n**In practice.** Mature teams maintain a software inventory with publisher, version, business purpose and support status, generated automatically from endpoint and server tooling rather than by hand. An approved software list is backed by technical enforcement, such as application allowlisting for high risk systems, and end of life software is either replaced or formally accepted as a risk with compensating controls. Evidence includes the inventory, allowlisting policies and records of unauthorised software being removed.\n\n**Common gaps.** Typical weaknesses are browser extensions, scripts, libraries and SaaS tools that never appear in the inventory, and allowlisting that stays in audit mode indefinitely. End of life software frequently lingers without a documented exception.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Finventory-and-control-of-software-assets","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1484,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"compromised-update-server-grounds-german-military-drones","Compromised Update Server Grounds German Military Drones","2026-11-13T18:20:23.075+00:00",{"slug":24,"title":25,"published_at":26},"critical-citrix-netscaler-flaw-in-default-installations-demands-immediate-patching","Critical Citrix NetScaler Flaw in Default Installations Demands Immediate Patching","2026-11-13T15:21:00.274+00:00",{"slug":28,"title":29,"published_at":30},"malware-hidden-in-drone-software-update-grounds-german-military-fleet","Malware Hidden in Drone Software Update Grounds German Military Fleet","2026-11-13T14:20:41.076+00:00",{"slug":32,"title":33,"published_at":34},"critical-apache-http-server-rce-flaw-demands-immediate-patching-action","Critical Apache HTTP Server RCE Flaw Demands Immediate Patching Action","2026-11-13T11:22:30.389+00:00",{"slug":36,"title":37,"published_at":38},"windows-zero-day-exploits-staged-rollout-gap-to-escalate-privileges-to-system","Windows Zero-Day Exploits Staged Rollout Gap to Escalate Privileges to SYSTEM","2026-11-13T11:21:52.625+00:00",{"slug":40,"title":41,"published_at":42},"check-point-zero-day-exploited-for-root-access-via-ipc-interface-flaw","Check Point Zero-Day Exploited for Root Access via IPC Interface Flaw","2026-11-13T11:20:59.093+00:00",{"slug":44,"title":45,"published_at":46},"critical-citrix-netscaler-flaws-demand-immediate-patching-1794565253454","Critical Citrix NetScaler Flaws Demand Immediate Patching","2026-11-13T10:20:53.412+00:00",{"slug":48,"title":49,"published_at":50},"chained-firewall-flaws-enable-root-access-and-wiper-deployment-on-esxi-hosts","Chained Firewall Flaws Enable Root Access and Wiper Deployment on ESXi Hosts","2026-11-13T08:21:56.51+00:00",{"slug":52,"title":53,"published_at":54},"arcticrat-uses-hidden-vnc-and-ai-to-silently-loot-banking-apps-on-android","ArcticRAT Uses Hidden VNC and AI to Silently Loot Banking Apps on Android","2026-11-13T08:20:24.252+00:00",{"slug":56,"title":57,"published_at":58},"mcp-server-pinning-drift-exposes-ai-coding-assistants-to-malicious-dependencies","MCP Server 'Pinning Drift' Exposes AI Coding Assistants to Malicious Dependencies","2026-11-13T06:20:23.867+00:00",{"slug":60,"title":61,"published_at":62},"critical-apache-http2-rce-flaw-demands-immediate-patching-1794536440453","Critical Apache HTTP\u002F2 RCE Flaw Demands Immediate Patching","2026-11-13T02:20:40.403+00:00",{"slug":64,"title":65,"published_at":66},"52-postgresql-vulnerabilities-patched-including-end-of-life-for-version-14","52 PostgreSQL Vulnerabilities Patched — Including End-of-Life for Version 14","2026-11-13T00:20:37.633+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",754,{"slug":74,"name":75,"problem":76,"stories":77},"patch-management","Automated patch management","Known holes get closed in days, not months.",559,{"slug":79,"name":80,"problem":81,"stories":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",535,{"slug":84,"name":85,"problem":86,"stories":87},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",428,{"slug":89,"name":90,"problem":91,"stories":92},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",253,{"slug":94,"name":95,"problem":96,"stories":97},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",171,[99,104,110,116,121,126,131,136],{"family":5,"item":100,"code":101,"title":102,"together":103},"7","Control 7","Continuous Vulnerability Management",758,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-800-53","si-2","SI-2","Flaw Remediation",563,{"family":111,"item":112,"code":113,"title":114,"together":115},"gdpr","32","Article 32","Security of processing",538,{"family":117,"item":118,"code":119,"title":120,"together":82},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":122,"item":123,"code":124,"title":124,"together":125},"itil","overview","ITIL",484,{"family":105,"item":127,"code":128,"title":129,"together":130},"si-3","SI-3","Malicious Code Protection",356,{"family":5,"item":132,"code":133,"title":134,"together":135},"16","Control 16","Application Software Security",317,{"family":105,"item":137,"code":138,"title":139,"together":140},"sa-12","SA-12","Supply Chain Protection",262]