## 3 Background
### Techniques for Auditing Cybersecurity  
Continuous auditing transforms traditional audit practices into a real-time, technology-driven assurance process. Unlike periodic reviews, this approach involves the ongoing monitoring of controls and transactions [39]. [PERSON] et al. [40], 2024, observed that many internal audit functions have been slow to adopt such technologies, as the benefits, such as improved risk detection, take time to materialize. This suggests that organizations need patience and clear objectives when implementing these tools.  
Continuous monitoring has stood out as an effective resource for mitigating risks by enabling the early identification of control failures and allowing agile responses to cybersecurity issues [41]. Modern solutions capable of real-time control, monitoring, and automated anomaly detection in financial environments promote constant vigilance over critical operations, making it possible to immediately detect suspicious behavior or non-standard activities [42]. This format transforms the audit function into a proactive risk management tool, aligning internal auditing with the dynamic and growing pace of cyber threats. [PERSON], [PERSON], and [PERSON] [43], 2023, proposed an analytics-based solution that describes threats, predicts future malicious behavior, and suggests protections in real time, reinforcing the efficient integration between technology and risk governance.  
In this context, it is worth noting that the evolution of continuous auditing aligns with advances brought by artificial intelligence (AI), especially in enhancing the ability of financial organizations to anticipate and respond to cyber threats [44]. The application of AI has revolutionized cybersecurity risk management, particularly in the financial sector, by automating both incident detection and responses [42].  
Recent research and industry guidance highlight that AI and machine learning techniques allow for the automation of the analysis of large volumes of data, making processes more efficient and accurate [45]. The systematic review conducted by [PERSON] and [PERSON] [41], 2023, corroborates that using machine learning models for threat detection significantly improves organizational cyber risk management. However, it introduces governance challenges, such as model bias.  
In practice, AI assists internal auditors and risk managers by performing rapid log analysis, prioritizing alerts, and predicting attack patterns [46]. Additionally, solutions such as AI-assisted risk scoring expand traditional assessment methods, while intelligent tools support continuous control testing, including automated vulnerability scanning and compliance checks [47].  
The growing complexity of the digital environment requires increasingly comprehensive and adaptive approaches to cybersecurity auditing. New models, such as the one proposed by [PERSON] et al. [48], 2024, exemplify advances in this regard by offering an empirically validated framework to assess the effectiveness of cyber controls in real-world scenarios, focusing not only on compliance but also on the maturity and readiness of security controls. Furthermore, [PERSON] et al. [49], 2023, discuss the need to adapt audit practices to the adoption of emerging technologies, such as cloud computing and artificial intelligence, highlighting that auditors must continually improve their methods as the technological landscape evolves.  
However, challenges persist in consolidating universal guidelines and consistent practices for comprehensive cybersecurity audits, as [PERSON] and [PERSON] [50], 2023, determined in their review of global best practices. Even with consolidated frameworks,such as ISO 27001 and NIST CSF, internal auditors still encounter obstacles in ensuring complete and consistent assessments of cyber controls, especially when considering sector-specific details, such as local regulations and the particular threat profile of the Brazilian banking sector.