## 6 Conclusions
For example, how do the results vary between public and private organizations across different geographic regions? Another possibility would be to explore the topic of continuous auditing, comparing the effectiveness of this approach with traditional auditing in terms of early threat detection, incident response, and prevention of security breaches. This could also involve developing specific risk models that integrate continuous auditing as a critical variable in assessing cyber risk exposure. Does continuous auditing significantly reduce the time it takes to detect vulnerabilities compared to traditional methods? Regarding the integration of threat modeling into internal audit processes, researchers could explore methods to incorporate it at all stages- from the planning phase to execution and reporting- or develop and validate specific tools that internal auditors can use to conduct threat modeling efficiently and effectively. What would be the impact of automating threat modeling on the accuracy and efficiency of audit processes? Finally, studies could investigate how internal audits can systematically integrate penetration testing into their security assessments or explore the effectiveness of third-party penetration testing. For example, are penetration tests conducted by internal teams as effective as those carried out by external experts? Additionally, it would be relevant to include a cost-benefit analysis of how implementing the proposed assessment methods can help institutions understand the potential return on investment and make informed decisions. What is the optimal balance between investing in continuous auditing, threat modeling, and penetration testing to maximize cybersecurity without compromising the financial viability of organizations? Conceptualization, L.V.A.F. ; methodology, L.V.A.F. and R.R.N. ; validation, L.V.A.F., C.A.d.M.A., L.P.d.M. and R.R.N. All authors contributed equally to writing and revising the document. All authors have read and agreed to the published version of the manuscript. This research was funded by the University of Brasilia (UnB). Not applicable. The data and information presented in this study are available upon request to the authors. The authors acknowledge the University of Brasilia (UnB) for the financial support provided by the Grant n\({}^{\circ}\) 001/2025 DPI/BCE/UnB. The authors declare no conflicts of interest. The following abbreviations are used in this manuscript: \begin{tabular}{l l} AI & Artificial Intelligence \\ BACEN & Banco Central do Brasil \\ C2M2 & Cybersecurity Capability Maturity Model \\ CIS & Center for Internet Security \\ CMN & National Monetary Council \\ COBIT & Control Objectives for Information and Related Technologies \\ CRM & Cyber Risk Management \\ CSF & Cybersecurity Framework \\ IDS & Intrusion Detection System \\ IEC & International Electrotechnical Commission \\ IIA & The Institute of Internal Auditors \\ IPS & Intrusion Prevention System \\ ISO & International Organization for Standardization \\ IT & Information Technology \\ KPI & Key Performance Indicator \\ KRI & Key Risk Indicator \\ MTTD & Mean Time to Detect \\ MTTR & Mean Time to Repair \\ NIST & National Institute of Standards and Technology \\ Pentest & Penetration Testing \\ SFN & National Financial System \\ SIEM & Security Information and Event Management \\ SWIFT & Society for Worldwide Interbank Financial Telecommunication \\ UEBA & User and Entity Behavior Analytics \\ \end{tabular}