[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F18":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","18","Control 18","Penetration Testing",153,"Center for Internet Security (CIS)","**What it asks for.** Organisations should test the effectiveness and resilience of their assets by finding and exploiting weaknesses in controls, processes and technology, simulating the objectives and actions of an attacker. It covers a defined programme, regular testing and remediation of findings.\n\n**In practice.** A mature programme sets scope, frequency and rules of engagement, and combines external and internal tests, with application and social engineering testing where relevant. Tests are performed by qualified testers, findings are prioritised and remediated, and fixes are validated by retesting. Evidence includes the testing programme, reports, remediation tracking and retest results.\n\n**Common gaps.** Tests are often narrowly scoped to satisfy a compliance requirement and repeated on the same targets each year. Findings may be accepted without remediation or retest, so the same issues recur.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fpenetration-testing","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"federal-agencies-issue-cybersecurity-guidance-for-frontier-ai-systems","Federal Agencies Issue Cybersecurity Guidance for Frontier AI Systems","2026-10-17T02:20:17.238+00:00",{"slug":23,"title":24,"published_at":25},"critical-beyondtrust-auth-bypass-actively-exploited-patch-immediately","Critical BeyondTrust Auth Bypass Actively Exploited — Patch Immediately","2026-10-16T22:21:05.267+00:00",{"slug":27,"title":28,"published_at":29},"governing-open-weight-ai-models-requires-structured-enterprise-risk-frameworks","Governing Open-Weight AI Models Requires Structured Enterprise Risk Frameworks","2026-10-16T18:21:38.63+00:00",{"slug":31,"title":32,"published_at":33},"senators-push-for-federal-ai-safety-standards-amid-security-breaches","Senators Push for Federal AI Safety Standards Amid Security Breaches","2026-10-14T16:20:32.423+00:00",{"slug":35,"title":36,"published_at":37},"linux-kernel-vhost-flaw-grants-root-and-enables-vm-escape","Linux Kernel vhost Flaw Grants Root and Enables VM Escape","2026-10-14T10:21:04.498+00:00",{"slug":39,"title":40,"published_at":41},"ai-worms-a-new-self-replicating-threat-on-the-horizon","AI Worms: A New Self-Replicating Threat on the Horizon","2026-10-13T22:21:28.999+00:00",{"slug":43,"title":44,"published_at":45},"eu-parliament-members-undermining-gdpr-know-who-represents-your-privacy","EU Parliament Members Undermining GDPR: Know Who Represents Your Privacy","2026-10-12T04:20:19.966+00:00",{"slug":47,"title":48,"published_at":49},"critical-citrix-netscaler-rce-flaw-demands-immediate-patching","Critical Citrix NetScaler RCE Flaw Demands Immediate Patching","2026-10-09T10:21:32.812+00:00",{"slug":51,"title":52,"published_at":53},"firmware-level-malware-pre-installed-on-budget-android-devices-worldwide","Firmware-Level Malware Pre-Installed on Budget Android Devices Worldwide","2026-10-09T10:20:27.189+00:00",{"slug":55,"title":56,"published_at":57},"single-ai-prompt-could-compromise-entire-aws-environment-via-agentcore-flaw","Single AI Prompt Could Compromise Entire AWS Environment via AgentCore Flaw","2026-10-08T22:21:21.853+00:00",{"slug":59,"title":60,"published_at":61},"ai-hiring-tool-triggers-gdpr-warning-over-lack-of-dpias-and-transparency","AI Hiring Tool Triggers GDPR Warning Over Lack of DPIAs and Transparency","2026-10-08T16:21:43.317+00:00",{"slug":63,"title":64,"published_at":65},"firmware-level-malware-preinstalled-on-budget-android-devices","Firmware-Level Malware Preinstalled on Budget Android Devices","2026-10-08T16:20:21.318+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",64,{"slug":73,"name":74,"problem":75,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",58,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",37,{"slug":83,"name":84,"problem":85,"stories":86},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",31,{"slug":88,"name":89,"problem":90,"stories":91},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",29,{"slug":93,"name":94,"problem":95,"stories":96},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",23,[98,103,108,113,119,125,130,135],{"family":99,"item":100,"code":101,"title":101,"together":102},"itil","overview","ITIL",72,{"family":5,"item":104,"code":105,"title":106,"together":107},"7","Control 7","Continuous Vulnerability Management",68,{"family":5,"item":109,"code":110,"title":111,"together":112},"12","Control 12","Network Infrastructure Management",65,{"family":114,"item":115,"code":116,"title":117,"together":118},"nist-800-53","si-2","SI-2","Flaw Remediation",63,{"family":120,"item":121,"code":122,"title":123,"together":124},"gdpr","32","Article 32","Security of processing",44,{"family":114,"item":126,"code":127,"title":128,"together":129},"ra-5","RA-5","Vulnerability Monitoring and Scanning",36,{"family":114,"item":131,"code":132,"title":133,"together":134},"ac-6","AC-6","Least Privilege",32,{"family":114,"item":136,"code":137,"title":138,"together":134},"sc-7","SC-7","Boundary Protection"]