[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-f":3},{"item":4,"lessons":16,"controls":55,"related":84},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-f","Article 21(2)(f)","Assessing the effectiveness of measures (Article 21(2)(f))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (f) requires policies and procedures to assess the effectiveness of cybersecurity risk management measures. Entities must check that their controls actually work, not just that they exist.\n\n**In practice.** The entity defines metrics and testing for key controls, runs internal audits, technical tests such as penetration testing and configuration reviews, and reviews results with management. Findings are tracked to remediation and feed back into the risk assessment. Evidence includes an assurance plan, audit and test reports, metrics dashboards and management review minutes.\n\n**Common gaps.** Effectiveness is often inferred from policy existence or tool deployment. Metrics tend to measure activity, such as number of scans, rather than outcomes such as time to remediate or reduction in exposure.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},9,[19,23,27,31,35,39,43,47,51],{"slug":20,"title":21,"published_at":22},"ai-powered-pen-testing-tools-lower-the-bar-for-attackers","AI-Powered Pen Testing Tools Lower the Bar for Attackers","2026-11-13T21:20:23.73+00:00",{"slug":24,"title":25,"published_at":26},"ai-powered-autonomous-attacks-breach-10-organizations-with-minimal-human-effort","AI-Powered Autonomous Attacks Breach 10 Organizations With Minimal Human Effort","2026-11-13T12:20:26.721+00:00",{"slug":28,"title":29,"published_at":30},"ai-powered-security-tools-raise-questions-about-dependency-and-risk","AI-Powered Security Tools Raise Questions About Dependency and Risk","2026-11-12T21:20:37.136+00:00",{"slug":32,"title":33,"published_at":34},"ai-driven-autonomous-pentesting-enters-the-enterprise-security-toolkit","AI-Driven Autonomous Pentesting Enters the Enterprise Security Toolkit","2026-11-12T16:21:01.655+00:00",{"slug":36,"title":37,"published_at":38},"cruciferra-maas-crypter-hides-infostealers-and-rats-from-security-tools-at-scale","Cruciferra MaaS Crypter Hides Infostealers and RATs from Security Tools at Scale","2026-11-12T13:20:21.227+00:00",{"slug":40,"title":41,"published_at":42},"ot-resilience-gap-cisos-overconfident-engineers-know-better","OT Resilience Gap: CISOs Overconfident, Engineers Know Better","2026-11-12T06:20:18.783+00:00",{"slug":44,"title":45,"published_at":46},"ai-powered-red-teaming-tools-like-artex-lower-the-bar-for-autonomous-attacks","AI-Powered Red Teaming Tools Like ARTEX Lower the Bar for Autonomous Attacks","2026-11-12T00:20:48.496+00:00",{"slug":48,"title":49,"published_at":50},"hidden-ai-backdoors-can-survive-standard-evaluations-via-dormant-neuron-manipulation","Hidden AI Backdoors Can Survive Standard Evaluations via Dormant Neuron Manipulation","2026-11-11T12:20:24.174+00:00",{"slug":52,"title":53,"published_at":54},"ai-agent-cybersecurity-benchmarking-highlights-real-world-attack-capability-risks","AI Agent Cybersecurity Benchmarking Highlights Real-World Attack Capability Risks","2026-11-10T17:22:56.354+00:00",[56,61,66,71,75,79],{"slug":57,"name":58,"problem":59,"stories":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":62,"name":63,"problem":64,"stories":65},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",4,{"slug":67,"name":68,"problem":69,"stories":70},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",2,{"slug":72,"name":73,"problem":74,"stories":70},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":76,"name":77,"problem":78,"stories":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":80,"name":81,"problem":82,"stories":83},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[85,91,95,100,105,109,114,117],{"family":86,"item":87,"code":88,"title":89,"together":90},"cis","18","Control 18","Penetration Testing",3,{"family":86,"item":92,"code":93,"title":94,"together":90},"13","Control 13","Network Monitoring and Defense",{"family":96,"item":97,"code":98,"title":99,"together":90},"nist-800-53","si-4","SI-4","System Monitoring",{"family":101,"item":102,"code":103,"title":104,"together":70},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":86,"item":106,"code":107,"title":108,"together":70},"7","Control 7","Continuous Vulnerability Management",{"family":110,"item":111,"code":112,"title":113,"together":70},"mitre-attack","t1059","T1059","Command and Scripting Interpreter",{"family":96,"item":115,"code":116,"title":89,"together":70},"ca-8","CA-8",{"family":101,"item":118,"code":119,"title":120,"together":70},"id-ra","ID.RA-1","Risk Assessment"]