[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-8":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",240,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the organisation to obtain timely information about technical vulnerabilities in the systems it uses, evaluate its exposure and take appropriate action. It covers both finding weaknesses and deciding how to deal with them.\n\n**In practice.** Good practice combines an accurate asset inventory, regular vulnerability scanning, vendor advisories and threat intelligence to identify relevant weaknesses. Each finding is prioritised by severity, exploitability and asset criticality, then remediated within defined timeframes or covered by a documented exception with compensating measures. Auditors typically look for scan reports, remediation tracking, service level targets and evidence that exceptions are reviewed.\n\n**Common gaps.** Frequent gaps are scanning that excludes cloud, OT or third-party hosted assets, no prioritisation beyond severity scores, and exceptions that are never revisited.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1687,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"cve-volume-hits-100k-ai-driven-discovery-outpaces-human-patching-capacity","CVE Volume Hits 100K: AI-Driven Discovery Outpaces Human Patching Capacity","2026-11-13T21:20:43.015+00:00",{"slug":24,"title":25,"published_at":26},"1252-cves-in-one-month-why-blind-patching-is-as-dangerous-as-not-patching","1,252 CVEs in One Month: Why Blind Patching Is as Dangerous as Not Patching","2026-11-13T16:20:44.156+00:00",{"slug":28,"title":29,"published_at":30},"52-postgresql-vulnerabilities-patched-including-end-of-life-for-version-14","52 PostgreSQL Vulnerabilities Patched — Including End-of-Life for Version 14","2026-11-13T00:20:37.633+00:00",{"slug":32,"title":33,"published_at":34},"critical-patch-tuesday-1095-vulnerabilities-including-actively-exploited-outlook-flaw","Critical Patch Tuesday: 1,095 Vulnerabilities Including Actively Exploited Outlook Flaw","2026-11-12T19:20:21.43+00:00",{"slug":36,"title":37,"published_at":38},"ai-driven-autonomous-pentesting-enters-the-enterprise-security-toolkit","AI-Driven Autonomous Pentesting Enters the Enterprise Security Toolkit","2026-11-12T16:21:01.655+00:00",{"slug":40,"title":41,"published_at":42},"33-unpatched-vulnerabilities-trigger-global-rmm-platform-shutdown","33 Unpatched Vulnerabilities Trigger Global RMM Platform Shutdown","2026-11-11T13:20:25.816+00:00",{"slug":44,"title":45,"published_at":46},"nearly-half-of-eu-it-providers-take-over-3-months-to-apply-critical-patches","Nearly Half of EU IT Providers Take Over 3 Months to Apply Critical Patches","2026-11-11T07:20:22.845+00:00",{"slug":48,"title":49,"published_at":50},"half-of-large-enterprises-archive-unverified-vulnerabilities-leaving-real-risks-unaddressed","Half of Large Enterprises Archive Unverified Vulnerabilities, Leaving Real Risks Unaddressed","2026-11-11T06:20:21.61+00:00",{"slug":52,"title":53,"published_at":54},"1095-vulnerabilities-in-one-patch-tuesday-highlights-systemic-patching-risk","1,095 Vulnerabilities in One Patch Tuesday Highlights Systemic Patching Risk","2026-11-11T02:20:22.792+00:00",{"slug":56,"title":57,"published_at":58},"microsofts-record-patch-tuesday-highlights-growing-vulnerability-backlog","Microsoft's Record Patch Tuesday Highlights Growing Vulnerability Backlog","2026-11-10T22:21:20.335+00:00",{"slug":60,"title":61,"published_at":62},"microsofts-1093-vulnerability-patch-tuesday-underscores-urgency-of-rapid-patching","Microsoft's 1,093-Vulnerability Patch Tuesday Underscores Urgency of Rapid Patching","2026-11-10T22:20:23.21+00:00",{"slug":64,"title":65,"published_at":66},"actively-exploited-outlook-zero-day-among-1235-vulnerabilities-patched-in-windows-10-extended-securi","Actively Exploited Outlook Zero-Day Among 1,235 Vulnerabilities Patched in Windows 10 Extended Security Update","2026-11-10T21:21:00.812+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",732,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",710,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",499,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",311,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",211,{"slug":94,"name":95,"problem":96,"stories":97},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",145,[99,105,111,117,123,129,134,140],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-2","SI-2","Flaw Remediation",1581,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",1323,{"family":112,"item":113,"code":114,"title":115,"together":116},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",1120,{"family":118,"item":119,"code":120,"title":121,"together":122},"cis","7","Control 7","Continuous Vulnerability Management",1109,{"family":124,"item":125,"code":126,"title":127,"together":128},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",760,{"family":118,"item":130,"code":131,"title":132,"together":133},"17","Control 17","Incident Response Management",685,{"family":135,"item":136,"code":137,"title":138,"together":139},"mitre-attack","t1566","T1566","Phishing",528,{"family":141,"item":142,"code":143,"title":144,"together":145},"gdpr","32","Article 32","Security of processing",491]