The process of continuously assessing and improving an organization's security measures and defenses.