[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-115":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-115","SP 800-115","SP 800-115: Technical Guide to Information Security Testing and Assessment",16,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on planning and conducting technical security testing and assessments, analysing findings and developing mitigation strategies. It covers review techniques, target identification and analysis, vulnerability validation such as penetration testing, and the planning and reporting around them.\n\n**In practice.** Applying it well means having an assessment policy, defining scope and rules of engagement in writing, and choosing techniques that match the objective, from configuration review to penetration testing. Testers handle data from the assessment securely, and findings are prioritised and tracked to remediation. Evidence includes approved test plans, reports and remediation records.\n\n**Common gaps.** Typical gaps are tests with unclear scope or authorisation, findings that are not tracked to closure and repeated testing of the same assets while others are never assessed. The publication dates from 2008, so tooling examples are dated.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F115\u002Ffinal","Read the publication at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"unpatched-routers-hijacked-to-silently-sell-your-bandwidth","Unpatched Routers Hijacked to Silently Sell Your Bandwidth","2026-10-15T20:21:08.002+00:00",{"slug":23,"title":24,"published_at":25},"anthropic-ai-models-exploit-government-sites-during-testing","Anthropic AI Models Exploit Government Sites During Testing","2026-10-12T20:20:33.279+00:00",{"slug":27,"title":28,"published_at":29},"googles-ai-agent-pagebreak-uncovers-500-web-app-vulnerabilities","Google's AI Agent PageBreak Uncovers 500+ Web App Vulnerabilities","2026-10-06T20:20:53.594+00:00",{"slug":31,"title":32,"published_at":33},"ai-security-agents-need-rigorous-objective-evaluation-before-deployment","AI Security Agents Need Rigorous, Objective Evaluation Before Deployment","2026-09-23T19:21:46.139+00:00",{"slug":35,"title":36,"published_at":37},"attackers-exploit-vulnerabilities-8x-faster-than-organizations-can-patch","Attackers Exploit Vulnerabilities 8x Faster Than Organizations Can Patch","2026-09-17T14:22:50.313+00:00",{"slug":39,"title":40,"published_at":41},"siloed-security-testing-leaves-organizations-blind-to-chained-attacks","Siloed Security Testing Leaves Organizations Blind to Chained Attacks","2026-09-15T14:22:46.622+00:00",{"slug":43,"title":44,"published_at":45},"severity-scores-alone-dont-reveal-your-true-attack-surface","Severity Scores Alone Don't Reveal Your True Attack Surface","2026-09-11T14:20:35.937+00:00",{"slug":47,"title":48,"published_at":49},"ai-model-escapes-sandbox-via-misconfiguration-accesses-real-systems","AI Model Escapes Sandbox via Misconfiguration, Accesses Real Systems","2026-09-10T12:20:26.292+00:00",{"slug":51,"title":52,"published_at":53},"liquid-network-loses-320m-to-federation-wallet-exploit","Liquid Network Loses $320M to Federation Wallet Exploit","2026-09-08T18:21:19.842+00:00",{"slug":55,"title":56,"published_at":57},"ai-powered-tool-exposes-new-http-request-smuggling-attack-vectors","AI-Powered Tool Exposes New HTTP Request Smuggling Attack Vectors","2026-08-27T14:22:07.695+00:00",{"slug":59,"title":60,"published_at":61},"prevention-rates-hit-69-but-behavioral-blind-spots-leave-orgs-exposed","Prevention Rates Hit 69%, But Behavioral Blind Spots Leave Orgs Exposed","2026-08-18T16:22:17.155+00:00",{"slug":63,"title":64,"published_at":65},"ai-model-with-disabled-safeguards-exploits-zero-day-to-compromise-hugging-face","AI Model with Disabled Safeguards Exploits Zero-Day to Compromise Hugging Face","2026-07-22T00:21:00.024+00:00",[67,72,77,81,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",8,{"slug":73,"name":74,"problem":75,"stories":76},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",4,{"slug":78,"name":79,"problem":80,"stories":76},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"slug":82,"name":83,"problem":84,"stories":85},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.",3,{"slug":87,"name":88,"problem":89,"stories":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":92,"name":93,"problem":94,"stories":90},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[96,100,106,111,116,121,125,129],{"family":97,"item":98,"code":99,"title":99,"together":71},"itil","overview","ITIL",{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",7,{"family":107,"item":108,"code":109,"title":110,"together":105},"nist-csf","id-ra","ID.RA-1","Risk Assessment",{"family":101,"item":112,"code":113,"title":114,"together":115},"12","Control 12","Network Infrastructure Management",6,{"family":101,"item":117,"code":118,"title":119,"together":120},"18","Control 18","Penetration Testing",5,{"family":101,"item":122,"code":123,"title":124,"together":120},"13","Control 13","Network Monitoring and Defense",{"family":101,"item":126,"code":127,"title":128,"together":120},"16","Control 16","Application Software Security",{"family":130,"item":98,"code":131,"title":132,"together":120},"mitre-attack","ATT&CK","MITRE ATT&CK"]