MOST FREQUENT FINDINGS BY CSF FUNCTION
FUNCTION
Govern
Identify
Protect
Detect
Respond
Recover
TOP FINDINGS OCCURRENCES
Insufficient Vendor Risk Management( 91); Weak Password Policy( 71); Password Reuse( 58)
Outdated Technologies( 341); Admin Interfaces Exposed( 201); No HSTS( 121)
Outdated Technologies( 681); Missing HTTP Headers( 578); Information Disclosure( 540)
Insufficient Security Monitoring( 150); Insufficient Cloud Monitoring( 120); Corporate Network Monitoring( 83)
Insufficient IR Procedures( 54); Insufficient IR – Financial( 16); Insufficient IR – OT( 16)
Key Vaults Missing Soft Delete( 10); Missing Business Continuity Plan( 8); No Disaster Recovery Plan( 7)
E. Methodology
Each assessment was conducted in Cye ' s exposure management platform and scored against the six NIST CSF 2.0 functions, with detailed findings, severity levels, affected assets, and recommended mitigations. Results were parsed automatically; scores and top findings were extracted; and the data was aggregated by industry, organization size, and country while preserving client confidentiality. AI risk maturity scores were derived by mapping CSF 2.0 function scores to the four NIST AI RMF 1.0 functions, with AI-related findings identified through keyword analysis and NIST subcategory classification. Findings reflect the 2026 assessment cycle.
About Cye
Cye combines its advanced exposure management platform with expert cybersecurity services to transform how organizations protect their business. With CRQ at its core, Cye manages cyber exposure with financial – impact clarity, visualizes attack routes to critical assets, and creates tailored mitigation plans that are continuously validated. Founded in 2012, Cye has partnered with hundreds of organizations worldwide in developing their cyber resilience. Visit us at cyesec. com.
© 2026 Cye, All rights reserved. www. cyesec. com | info @ cyesec. com
37