[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F2":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","2","Control 2","Inventory and Control of Software Assets",1377,"Center for Internet Security (CIS)","**What it asks for.** The organisation should track all software installed or running on its assets and ensure that only authorised, supported software can be installed and executed. Unsupported or unapproved software is a common entry point and should be found and removed.\n\n**In practice.** Mature teams maintain a software inventory with publisher, version, business purpose and support status, generated automatically from endpoint and server tooling rather than by hand. An approved software list is backed by technical enforcement, such as application allowlisting for high risk systems, and end of life software is either replaced or formally accepted as a risk with compensating controls. Evidence includes the inventory, allowlisting policies and records of unauthorised software being removed.\n\n**Common gaps.** Typical weaknesses are browser extensions, scripts, libraries and SaaS tools that never appear in the inventory, and allowlisting that stays in audit mode indefinitely. End of life software frequently lingers without a documented exception.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Finventory-and-control-of-software-assets","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1367,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"critical-drupal-rce-flaws-demand-immediate-patching","Critical Drupal RCE Flaws Demand Immediate Patching","2026-10-17T16:20:34.593+00:00",{"slug":24,"title":25,"published_at":26},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":28,"title":29,"published_at":30},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":32,"title":33,"published_at":34},"fake-ai-brand-impersonation-campaigns-target-enterprise-developers","Fake AI Brand Impersonation Campaigns Target Enterprise Developers","2026-10-16T22:20:50.472+00:00",{"slug":36,"title":37,"published_at":38},"critical-magento-rce-flaw-demands-immediate-patching","Critical Magento RCE Flaw Demands Immediate Patching","2026-10-16T22:20:34.131+00:00",{"slug":40,"title":41,"published_at":42},"openbsd-root-exploit-chains-decades-old-bug-to-bypass-kernel-protections","OpenBSD Root Exploit Chains Decades-Old Bug to Bypass Kernel Protections","2026-10-16T20:20:45.22+00:00",{"slug":44,"title":45,"published_at":46},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","2026-10-16T18:21:08.893+00:00",{"slug":48,"title":49,"published_at":50},"zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","2026-10-16T18:20:36.559+00:00",{"slug":52,"title":53,"published_at":54},"claude-code-desktop-flaw-enabled-html-based-credential-theft","Claude Code Desktop Flaw Enabled HTML-Based Credential Theft","2026-10-16T18:20:18.997+00:00",{"slug":56,"title":57,"published_at":58},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":60,"title":61,"published_at":62},"romulus-malware-platform-exploits-human-deception-via-clickfix-lures","ROMULUS Malware Platform Exploits Human Deception via ClickFix Lures","2026-10-16T15:20:34.428+00:00",{"slug":64,"title":65,"published_at":66},"windows-security-update-breaks-smart-app-control-feature","Windows Security Update Breaks Smart App Control Feature","2026-10-16T10:20:27.498+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",697,{"slug":74,"name":75,"problem":76,"stories":77},"patch-management","Automated patch management","Known holes get closed in days, not months.",508,{"slug":79,"name":80,"problem":81,"stories":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",485,{"slug":84,"name":85,"problem":86,"stories":87},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",396,{"slug":89,"name":90,"problem":91,"stories":92},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",240,{"slug":94,"name":95,"problem":96,"stories":97},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",154,[99,103,109,115,120,126,131,136],{"family":5,"item":100,"code":101,"title":102,"together":72},"7","Control 7","Continuous Vulnerability Management",{"family":104,"item":105,"code":106,"title":107,"together":108},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",535,{"family":110,"item":111,"code":112,"title":113,"together":114},"gdpr","32","Article 32","Security of processing",530,{"family":116,"item":117,"code":118,"title":118,"together":119},"itil","overview","ITIL",484,{"family":121,"item":122,"code":123,"title":124,"together":125},"nist-800-53","si-2","SI-2","Flaw Remediation",467,{"family":121,"item":127,"code":128,"title":129,"together":130},"si-3","SI-3","Malicious Code Protection",353,{"family":5,"item":132,"code":133,"title":134,"together":135},"16","Control 16","Application Software Security",314,{"family":104,"item":137,"code":138,"title":139,"together":140},"800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",262]