[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F9":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","9","Control 9","Email and Web Browser Protections",332,"Center for Internet Security (CIS)","**What it asks for.** Because email and browsers are where users meet most threats, this control asks organisations to harden and filter them. It covers supported browsers and mail clients, filtering of malicious content and domain protections against spoofing.\n\n**In practice.** Good practice keeps browsers and email clients on supported, centrally managed versions with limited, approved extensions. DNS and web filtering block known malicious and unwanted categories, email gateways scan attachments and links, and SPF, DKIM and DMARC are configured with an enforcing DMARC policy. Evidence includes browser management policies, filtering configurations, DMARC reports and statistics on blocked messages and sites.\n\n**Common gaps.** DMARC is often left at a monitoring policy indefinitely, and browser extensions are rarely controlled. Filtering may not follow remote users who work outside the corporate network.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Femail-and-web-browser-protections","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},341,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"gootloader-malware-enabled-44-ransomware-attacks-via-seo-poisoning-and-weak-endpoint-defenses","Gootloader Malware Enabled 44 Ransomware Attacks via SEO Poisoning and Weak Endpoint Defenses","2026-11-13T17:21:02.612+00:00",{"slug":24,"title":25,"published_at":26},"typosquatting-ai-domains-deliver-malware-via-fake-verification-pages","Typosquatting AI Domains Deliver Malware via Fake Verification Pages","2026-11-13T16:20:24.722+00:00",{"slug":28,"title":29,"published_at":30},"seven-year-old-office-flaw-still-delivering-malware-via-phishing-emails","Seven-Year-Old Office Flaw Still Delivering Malware via Phishing Emails","2026-11-13T15:21:38.757+00:00",{"slug":32,"title":33,"published_at":34},"186-fake-ai-domains-lure-users-into-installing-browser-malware","186 Fake AI Domains Lure Users Into Installing Browser Malware","2026-11-12T17:23:03.655+00:00",{"slug":36,"title":37,"published_at":38},"search-poisoning-and-malware-as-a-service-infrastructure-dismantled-in-operation-endgame","Search Poisoning and Malware-as-a-Service Infrastructure Dismantled in Operation Endgame","2026-11-12T17:20:20.882+00:00",{"slug":40,"title":41,"published_at":42},"fake-casino-app-harvests-user-data-through-malicious-android-malware","Fake Casino App Harvests User Data Through Malicious Android Malware","2026-11-11T13:20:44.564+00:00",{"slug":44,"title":45,"published_at":46},"blind-eagle-weaponizes-fake-court-notices-to-deploy-asyncrat-variant-across-latin-america","Blind Eagle Weaponizes Fake Court Notices to Deploy AsyncRAT Variant Across Latin America","2026-11-10T18:21:44.944+00:00",{"slug":48,"title":49,"published_at":50},"ai-powered-sandbox-analysis-accelerates-soc-response-to-sophisticated-phishing-campaigns","AI-Powered Sandbox Analysis Accelerates SOC Response to Sophisticated Phishing Campaigns","2026-11-10T16:20:41.09+00:00",{"slug":52,"title":53,"published_at":54},"azure-hosted-fake-security-alerts-target-users-across-80-organizations","Azure-Hosted Fake Security Alerts Target Users Across 80 Organizations","2026-11-04T14:21:08.161+00:00",{"slug":56,"title":57,"published_at":58},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":60,"title":61,"published_at":62},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":64,"title":65,"published_at":66},"zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","2026-10-16T18:20:36.559+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",226,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",222,{"slug":79,"name":80,"problem":81,"stories":82},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",129,{"slug":84,"name":85,"problem":86,"stories":87},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",86,{"slug":89,"name":90,"problem":91,"stories":92},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",78,{"slug":94,"name":95,"problem":96,"stories":97},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",43,[99,105,111,116,121,126,131,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-3","SI-3","Malicious Code Protection",233,{"family":106,"item":107,"code":108,"title":109,"together":110},"gdpr","32","Article 32","Security of processing",208,{"family":5,"item":112,"code":113,"title":114,"together":115},"14","Control 14","Security Awareness and Skills Training",181,{"family":100,"item":117,"code":118,"title":119,"together":120},"at-2","AT-2","Literacy Training and Awareness",143,{"family":5,"item":122,"code":123,"title":124,"together":125},"2","Control 2","Inventory and Control of Software Assets",141,{"family":5,"item":127,"code":128,"title":129,"together":130},"13","Control 13","Network Monitoring and Defense",135,{"family":132,"item":133,"code":134,"title":135,"together":136},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",123,{"family":138,"item":139,"code":140,"title":140,"together":141},"itil","overview","ITIL",93]