[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F7":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","7","Control 7","Continuous Vulnerability Management",2577,"Center for Internet Security (CIS)","**What it asks for.** Organisations should continuously assess and track vulnerabilities across their assets and remediate them to shrink the window attackers can exploit. This requires a documented process, regular scanning and risk based remediation.\n\n**In practice.** A strong process combines authenticated scanning of internal and external assets, patch management for operating systems and applications, and prioritisation using severity, exploitability and asset criticality, for example by giving known exploited vulnerabilities top priority. Remediation targets are defined by risk level and tracked, and exceptions are approved and time limited. Auditors look for scan coverage, remediation metrics against targets, patch reports and the exception register.\n\n**Common gaps.** Scanning coverage is often incomplete, missing cloud, containers and network appliances, and unauthenticated scans give a false sense of security. Many organisations measure findings but not time to remediate, so old critical vulnerabilities persist.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fcontinuous-vulnerability-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},3555,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"internet-connected-refrigeration-units-expose-critical-infrastructure-to-root-level-attacks","Internet-Connected Refrigeration Units Expose Critical Infrastructure to Root-Level Attacks","2026-11-13T22:21:16.893+00:00",{"slug":24,"title":25,"published_at":26},"ai-powered-attack-tool-artex-enables-machine-speed-intrusions-by-low-skill-actors","AI-Powered Attack Tool Artex Enables Machine-Speed Intrusions by Low-Skill Actors","2026-11-13T22:20:40.075+00:00",{"slug":28,"title":29,"published_at":30},"actively-exploited-vulnerabilities-added-to-cisa-kev-catalog-demand-immediate-remediation","Actively Exploited Vulnerabilities Added to CISA KEV Catalog Demand Immediate Remediation","2026-11-13T21:21:21.381+00:00",{"slug":32,"title":33,"published_at":34},"exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations","Exposed Camera Software Exploited to Mine Cryptocurrency Across 13 Organizations","2026-11-13T21:21:00.22+00:00",{"slug":36,"title":37,"published_at":38},"cve-volume-hits-100k-ai-driven-discovery-outpaces-human-patching-capacity","CVE Volume Hits 100K: AI-Driven Discovery Outpaces Human Patching Capacity","2026-11-13T21:20:43.015+00:00",{"slug":40,"title":41,"published_at":42},"ai-powered-pen-testing-tools-lower-the-bar-for-attackers","AI-Powered Pen Testing Tools Lower the Bar for Attackers","2026-11-13T21:20:23.73+00:00",{"slug":44,"title":45,"published_at":46},"internet-facing-containers-with-sensitive-data-access-create-exploitable-attack-paths","Internet-Facing Containers with Sensitive Data Access Create Exploitable Attack Paths","2026-11-13T18:21:17.032+00:00",{"slug":48,"title":49,"published_at":50},"unpatched-check-point-gateways-leveraged-to-wipe-vmware-esxi-infrastructure","Unpatched Check Point Gateways Leveraged to Wipe VMware ESXi Infrastructure","2026-11-13T17:20:43.507+00:00",{"slug":52,"title":53,"published_at":54},"1252-cves-in-one-month-why-blind-patching-is-as-dangerous-as-not-patching","1,252 CVEs in One Month: Why Blind Patching Is as Dangerous as Not Patching","2026-11-13T16:20:44.156+00:00",{"slug":56,"title":57,"published_at":58},"seven-year-old-office-flaw-still-delivering-malware-via-phishing-emails","Seven-Year-Old Office Flaw Still Delivering Malware via Phishing Emails","2026-11-13T15:21:38.757+00:00",{"slug":60,"title":61,"published_at":62},"critical-citrix-netscaler-flaw-in-default-installations-demands-immediate-patching","Critical Citrix NetScaler Flaw in Default Installations Demands Immediate Patching","2026-11-13T15:21:00.274+00:00",{"slug":64,"title":65,"published_at":66},"unpatched-check-point-gateways-wiped-after-chained-exploit-attack","Unpatched Check Point Gateways Wiped After Chained Exploit Attack","2026-11-13T13:22:53.744+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",2414,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",2059,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",1193,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",499,{"slug":89,"name":90,"problem":91,"stories":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",359,{"slug":94,"name":95,"problem":96,"stories":97},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",275,[99,105,110,115,121,127,133,138],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-2","SI-2","Flaw Remediation",2705,{"family":106,"item":107,"code":108,"title":108,"together":109},"itil","overview","ITIL",1227,{"family":5,"item":111,"code":112,"title":113,"together":114},"12","Control 12","Network Infrastructure Management",1137,{"family":116,"item":117,"code":118,"title":119,"together":120},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",1109,{"family":122,"item":123,"code":124,"title":125,"together":126},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",903,{"family":128,"item":129,"code":130,"title":131,"together":132},"gdpr","32","Article 32","Security of processing",822,{"family":100,"item":134,"code":135,"title":136,"together":137},"ra-5","RA-5","Vulnerability Monitoring and Scanning",792,{"family":139,"item":140,"code":141,"title":142,"together":143},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",781]