[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fde":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","de","DE","Detect (DE)",1,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The Detect function asks organisations to find and analyse possible cybersecurity attacks and compromises. It covers continuous monitoring of assets for anomalies and indicators of compromise, and analysis of adverse events to characterise them and decide whether an incident has occurred.\n\n**In practice.** Doing this well means collecting logs from networks, endpoints, identity systems, cloud services and key applications into a central platform, with detection use cases mapped to relevant threats. Alerts are triaged by a staffed function, enriched with threat intelligence, and correlated across sources. Incidents are declared against defined criteria and handed to response. Evidence includes log source coverage, detection rule inventories, alert handling metrics, and records of tuning and testing.\n\n**Common gaps.** Typical gaps include blind spots in cloud, SaaS and identity logs, untuned rules generating noise, and no testing of whether detections actually fire. Monitoring of external service providers and physical environments is often weak.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"ai-powered-attacks-are-shrinking-defender-response-windows","AI-Powered Attacks Are Shrinking Defender Response Windows","2026-08-27T14:21:20.344+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":28,"name":29,"problem":30,"stories":9},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",{"slug":32,"name":33,"problem":34,"stories":9},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[36,41,45,50,55,60],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","17","Control 17","Incident Response Management",{"family":37,"item":42,"code":43,"title":44,"together":9},"7","Control 7","Continuous Vulnerability Management",{"family":46,"item":47,"code":48,"title":49,"together":9},"mitre-attack","t1190","T1190","Exploit Public-Facing Application",{"family":51,"item":52,"code":53,"title":54,"together":9},"nist-ai-rmf","overview","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",{"family":56,"item":57,"code":58,"title":59,"together":9},"nist-sp","800-137","SP 800-137","SP 800-137: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations",{"family":56,"item":61,"code":62,"title":63,"together":9},"800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management"]