[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fpr-at":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","pr-at","PR.AT-1","Awareness and Training",209,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Protect category asks that staff are given cybersecurity awareness and training so they can carry out their duties with security risks in mind. CSF 1.1 also called out privileged users, third parties, senior executives and security personnel specifically, and CSF 2.0 keeps the category with general and role specific training.\n\n**In practice.** Everyone receives baseline awareness training, while privileged users, developers, executives and security staff receive training suited to their roles. Third parties with access understand their responsibilities. Effectiveness is measured, for example through simulations and reporting behaviour. Evidence includes training plans, completion records and measurement results.\n\n**Common gaps.** Training is often one size fits all and measured only by completion. Executives and third parties are frequently excluded, despite being frequent targets.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"phishing-smishing-attacks-target-election-officials-ahead-of-2026-midterms","Phishing & Smishing Attacks Target Election Officials Ahead of 2026 Midterms","2026-10-16T16:21:30.17+00:00",{"slug":23,"title":24,"published_at":25},"ai-powered-android-defenses-target-voice-cloning-and-messaging-scams","AI-Powered Android Defenses Target Voice Cloning and Messaging Scams","2026-10-15T20:20:20.548+00:00",{"slug":27,"title":28,"published_at":29},"help-tds-hotejka-exploit-20000-cloudflare-pages-domains-for-tech-support-scams","Help TDS & Hotejka Exploit 20,000+ Cloudflare Pages Domains for Tech Support Scams","2026-10-15T16:20:52.987+00:00",{"slug":31,"title":32,"published_at":33},"seo-poisoned-fake-vpn-site-harvests-credentials-before-serving-legitimate-installer","SEO-Poisoned Fake VPN Site Harvests Credentials Before Serving Legitimate Installer","2026-10-14T18:22:16.905+00:00",{"slug":35,"title":36,"published_at":37},"deepfake-voice-cloning-exposes-gaps-in-identity-verification","Deepfake Voice Cloning Exposes Gaps in Identity Verification","2026-10-14T14:22:39.372+00:00",{"slug":39,"title":40,"published_at":41},"chinese-language-phishing-as-a-service-market-disrupted-after-1b-malicious-messages","Chinese-Language Phishing-as-a-Service Market Disrupted After 1B+ Malicious Messages","2026-10-14T14:21:21.247+00:00",{"slug":43,"title":44,"published_at":45},"billion-message-phishing-ecosystem-targeting-microsoft-users-dismantled","Billion-Message Phishing Ecosystem Targeting Microsoft Users Dismantled","2026-10-14T14:20:50.56+00:00",{"slug":47,"title":48,"published_at":49},"hirudo-malware-swaps-banking-apps-to-steal-credentials-and-bypass-security","Hirudo Malware Swaps Banking Apps to Steal Credentials and Bypass Security","2026-10-14T13:20:20.786+00:00",{"slug":51,"title":52,"published_at":53},"dprk-uses-simple-phishing-to-harvest-ukraine-war-intelligence","DPRK Uses Simple Phishing to Harvest Ukraine War Intelligence","2026-10-13T22:21:00.206+00:00",{"slug":55,"title":56,"published_at":57},"fake-sextortion-protection-firms-defraud-vulnerable-victims","Fake Sextortion Protection Firms Defraud Vulnerable Victims","2026-10-13T20:20:46.443+00:00",{"slug":59,"title":60,"published_at":61},"hardware-implant-in-reseller-crypto-wallets-drains-86m","Hardware Implant in Reseller Crypto Wallets Drains $86M","2026-10-13T12:21:47.245+00:00",{"slug":63,"title":64,"published_at":65},"fake-claude-ai-ads-trick-users-into-running-malware-via-clickfix","Fake Claude AI Ads Trick Users into Running Malware via ClickFix","2026-10-09T22:20:47.165+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",110,{"slug":73,"name":74,"problem":75,"stories":76},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",107,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",94,{"slug":83,"name":84,"problem":85,"stories":86},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",47,{"slug":88,"name":89,"problem":90,"stories":91},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",42,{"slug":93,"name":94,"problem":95,"stories":96},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",18,[98,104,109,114,120,125,130,134],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","14","Control 14","Security Awareness and Skills Training",154,{"family":105,"item":106,"code":107,"title":108,"together":81},"gdpr","32","Article 32","Security of processing",{"family":5,"item":110,"code":111,"title":112,"together":113},"de-cm","DE.CM-1","Continuous Monitoring",69,{"family":115,"item":116,"code":117,"title":118,"together":119},"nist-800-53","at-2","AT-2","Literacy Training and Awareness",68,{"family":115,"item":121,"code":122,"title":123,"together":124},"si-3","SI-3","Malicious Code Protection",55,{"family":99,"item":126,"code":127,"title":128,"together":129},"9","Control 9","Email and Web Browser Protections",48,{"family":99,"item":131,"code":132,"title":133,"together":86},"2","Control 2","Inventory and Control of Software Assets",{"family":135,"item":136,"code":137,"title":137,"together":138},"itil","overview","ITIL",40]