[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fid-ra":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","id-ra","ID.RA-1","Risk Assessment",436,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Identify category asks the organisation to understand the cybersecurity risk to the organisation, its assets and individuals. It covers identifying and recording vulnerabilities in assets, using threat intelligence, identifying threats, assessing likelihood and impact, and prioritising responses.\n\n**In practice.** Vulnerability scanning and other assessments feed a risk process that weighs threat, likelihood and business impact. Threat intelligence is consumed and applied to the organisation's own technology, and risk assessments are repeated when significant changes occur. Results drive prioritised treatment plans with owners. Evidence includes vulnerability reports, risk assessments, threat intelligence summaries and the resulting treatment decisions.\n\n**Common gaps.** Risk assessments are often generic and not linked to real vulnerability or threat data. Vulnerability lists are produced without business context, which makes prioritisation difficult.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},432,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"critical-beyondtrust-auth-bypass-actively-exploited-patch-immediately","Critical BeyondTrust Auth Bypass Actively Exploited — Patch Immediately","2026-10-16T22:21:05.267+00:00",{"slug":24,"title":25,"published_at":26},"active-exploitation-of-fortinet-and-beyondtrust-flaws-highlights-patch-urgency","Active Exploitation of Fortinet and BeyondTrust Flaws Highlights Patch Urgency","2026-10-16T20:21:00.599+00:00",{"slug":28,"title":29,"published_at":30},"vodafone-spain-fined-400k-after-ignoring-known-vulnerability-for-months","Vodafone Spain Fined €400K After Ignoring Known Vulnerability for Months","2026-10-16T12:20:31.802+00:00",{"slug":32,"title":33,"published_at":34},"beyondtrust-zero-day-exploited-for-months-before-patch","BeyondTrust Zero-Day Exploited for Months Before Patch","2026-10-16T08:21:15.847+00:00",{"slug":36,"title":37,"published_at":38},"pwnescape-linux-kernel-flaw-allows-guest-vms-to-read-host-memory","PwnEscape: Linux Kernel Flaw Allows Guest VMs to Read Host Memory","2026-10-15T22:20:53.307+00:00",{"slug":40,"title":41,"published_at":42},"unpatched-collabora-rce-flaw-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora RCE Flaw Lets Attackers Backdoor Nextcloud Servers","2026-10-15T22:20:38.386+00:00",{"slug":44,"title":45,"published_at":46},"ai-powered-oss-scanner-fast-tracks-vulnerability-disclosure-for-open-source-maintainers","AI-Powered OSS Scanner Fast-Tracks Vulnerability Disclosure for Open Source Maintainers","2026-10-15T20:21:23.114+00:00",{"slug":48,"title":49,"published_at":50},"multiple-critical-vulnerabilities-found-in-cisa-malcolm-network-traffic-analyzer","Multiple Critical Vulnerabilities Found in CISA Malcolm Network Traffic Analyzer","2026-10-15T18:22:08.348+00:00",{"slug":52,"title":53,"published_at":54},"critical-rce-flaws-in-nextjs-demand-immediate-patching","Critical RCE Flaws in Next.js Demand Immediate Patching","2026-10-15T16:21:23.504+00:00",{"slug":56,"title":57,"published_at":58},"langflow-rce-flaw-actively-exploited-via-unvalidated-command-injection","Langflow RCE Flaw Actively Exploited via Unvalidated Command Injection","2026-10-15T10:21:22.699+00:00",{"slug":60,"title":61,"published_at":62},"zero-click-sneakpeek-flaw-silently-exfiltrates-developer-credentials-from-claude-code","Zero-Click 'SneakPeek' Flaw Silently Exfiltrates Developer Credentials from Claude Code","2026-10-14T22:21:07.285+00:00",{"slug":64,"title":65,"published_at":66},"record-1413-microsoft-vulnerabilities-highlight-patch-prioritization-crisis","Record 1,413 Microsoft Vulnerabilities Highlight Patch Prioritization Crisis","2026-10-14T18:21:00.409+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",281,{"slug":74,"name":75,"problem":76,"stories":77},"patch-management","Automated patch management","Known holes get closed in days, not months.",280,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",94,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",64,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",53,{"slug":94,"name":95,"problem":96,"stories":97},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",48,[99,105,111,116,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",393,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","si-2","SI-2","Flaw Remediation",287,{"family":112,"item":113,"code":114,"title":114,"together":115},"itil","overview","ITIL",252,{"family":100,"item":117,"code":118,"title":119,"together":120},"12","Control 12","Network Infrastructure Management",205,{"family":5,"item":122,"code":123,"title":124,"together":125},"rs-mi","RS.MI-3","Mitigation (CSF 1.1)",143,{"family":127,"item":128,"code":129,"title":130,"together":125},"gdpr","32","Article 32","Security of processing",{"family":106,"item":132,"code":133,"title":134,"together":135},"ra-5","RA-5","Vulnerability Monitoring and Scanning",127,{"family":137,"item":138,"code":139,"title":140,"together":141},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",112]