Continuous monitoring means maintaining ongoing awareness of security, threats and:

1. Monitoring watches for more than active attacks. 2. Three things are named as being kept in view. 3. Continuous monitoring maintains ongoing awareness of information security, vulnerabilities and threats. 4. So the answer is vulnerabilities. _Source: NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems and Organizations'_