Future research should focus on the following areas:
Traditional security assessments (vulnerability scans, penetration tests, compliance audits) answer but rarely answer "Are we secure?" security control validation - picus
SCV is the continuous, automated process of testing security controls (firewalls, EDR, SIEM, email gateways, etc.) against real-world adversary behaviors—. Future research should focus on the following areas: