Most organizations assume that corporate devices only run approved software. In reality, that assumption is often wrong. Users are inherently focused on being more efficient, finding workarounds to meet their timelines, etc. This natural behavior creates blind spots and risks for many organizations and highlights the importance of assessing authorized and unauthorized software use within an environment. CIS Control 2.3 exists because unauthorized software is everywhere—and it quietly increases...















