[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-5":3},{"item":4,"lessons":16,"controls":34,"related":61},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-5","Requirement 5","Requirement 5: Protect All Systems and Networks from Malicious Software",4,"PCI Security Standards Council","**What it asks for.** Organisations must deploy anti-malware protection on system components in the cardholder data environment and connected systems, keep it current and active, and protect people against phishing. Where a system is judged not at risk from malware, that judgement must be documented and periodically re-evaluated.\n\n**In practice.** Doing this well means anti-malware or endpoint detection runs on every in-scope system that can be affected, receives automatic updates, performs scans or continuous behavioural analysis, and cannot be disabled by ordinary users. Removable media is scanned or controlled, logs from the tooling feed central monitoring, and technical controls such as email filtering reduce phishing exposure. An assessor will expect configuration exports, update and scan evidence, the list of systems considered not at risk with the reasoning behind it, and a targeted risk analysis where periodic scan frequency is chosen by the organisation.\n\n**Common gaps.** Typical failures are servers or appliances left without protection because they were assumed safe, users or administrators able to switch agents off, and stale risk evaluations for excluded systems. Anti-phishing is often treated as awareness training alone, without technical measures.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30],{"slug":19,"title":20,"published_at":21},"hirudo-trojan-replaces-legitimate-banking-apps-to-steal-credentials","Hirudo Trojan Replaces Legitimate Banking Apps to Steal Credentials","2026-10-14T12:20:48.409+00:00",{"slug":23,"title":24,"published_at":25},"ai-powered-rathat-malware-bypasses-mfa-to-steal-banking-credentials-on-android","AI-Powered RatHat Malware Bypasses MFA to Steal Banking Credentials on Android","2026-09-22T18:21:20.981+00:00",{"slug":27,"title":28,"published_at":29},"banking-trojans-manic-grandoreiro-toxicpanda-20-target-mobile-and-desktop-users","Banking Trojans Manic, Grandoreiro & ToxicPanda 2.0 Target Mobile and Desktop Users","2026-08-22T10:20:21.885+00:00",{"slug":31,"title":32,"published_at":33},"grandoreiro-banking-trojan-returns-with-stronger-evasion-capabilities","Grandoreiro Banking Trojan Returns With Stronger Evasion Capabilities","2026-08-20T14:20:35.506+00:00",[35,39,44,48,52,57],{"slug":36,"name":37,"problem":38,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":40,"name":41,"problem":42,"stories":43},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,{"slug":45,"name":46,"problem":47,"stories":43},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":49,"name":50,"problem":51,"stories":43},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":53,"name":54,"problem":55,"stories":56},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,{"slug":58,"name":59,"problem":60,"stories":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[62,67,73,78,83,87,91,95],{"family":63,"item":64,"code":65,"title":66,"together":9},"gdpr","32","Article 32","Security of processing",{"family":68,"item":69,"code":70,"title":71,"together":72},"nist-sp","800-124","SP 800-124","SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise",3,{"family":74,"item":75,"code":76,"title":77,"together":72},"cis","10","Control 10","Malware Defenses",{"family":79,"item":80,"code":81,"title":82,"together":72},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":74,"item":84,"code":85,"title":86,"together":43},"13","Control 13","Network Monitoring and Defense",{"family":74,"item":88,"code":89,"title":90,"together":43},"2","Control 2","Inventory and Control of Software Assets",{"family":92,"item":93,"code":94,"title":94,"together":43},"itil","overview","ITIL",{"family":74,"item":96,"code":97,"title":98,"together":56},"7","Control 7","Continuous Vulnerability Management"]