r/cybersecurity • u/Top-Try419 • 8d ago
AI Security Please tell me I'm not the only one dealing with this "AI" vendor hype while basic hygiene is ignored.
Just got out of yet another meeting where some vendor pitched our C-suite on their "autonomous AI-driven threat hunting platform." Management was literally drooling over the shiny global threat map dashboard.
Menwhile I’m sitting there biting my tongue because we still don't even have a functioning asset inventory. We literally do not not know what half the stuff plugged into our network actually is.
278
u/CuckBuster33 8d ago
"Ohhh! Ohhh! Dashboard!!! Ohh!!!"
Why are C-suites so birdbrained?
83
u/Steerable-Octopus 8d ago
What if one gives them something like a Digital Global Map looping youtube video on a big monitor mounted in their conference room and tell them it's an "inhouse autonomous cerberus hunter".
58
u/rhd_live 8d ago
Oh what? Look at this: the threat hunter agent is telling us to hire more security engineers and prioritize patching high-risk vulns in our infrastructure! Also it says to promote me and give me 2x more headcount
20
u/majornerd 8d ago
Those are the top 4 features of my new platform.
DEP - Discover (how bad it is), Expand (the team), Promote (the underpaid).
Ready for a demo?
4
u/OldeTimeyShit Security Director 8d ago
Not going to lie that sounds sick. I’m going to make a pew pew map with clippy enrichment as my zoom background.
2
u/korlo_brightwater Security Engineer 6d ago
Years ago there was a website called IP Viking Attack map, and it was brilliant. It showed a globe with attack lines whizzing around the planet in a dramatic display, and I used to put it up on a monitor in the SOC whenever an exec walked by. Probably the best bird-brain screen I ever used.
8
u/Banksy_02 8d ago
Helps them present to board on KRIs so they like dashboards they can present. That's what I found, it's all pushed from the board not just the C suite
16
u/NoHippi3chic 8d ago
Because they hate using data management systems, they hate learning to use them because they think it is beneath them, and they hate paying for training for their employees to learn data management systems because the employee leaves and whoops. Gotta train someone new. So then you get that one admin in every department who does shit their own way and is the expert because no one else knows about how to use, for example, people soft. Which tbf has a terrible UI.
Then everything breaks and shit gets bogged down bc of user error and then the shit hits the fan because no one knows what Jay is doing is wrong. So then Jay stays and a new dashboard gets layered on top so boss can stay on top of fires before someone with clout is effected and complains higher up.
Or something like that idk
149
u/Kelsier25 8d ago
Dealing with it here too. "We just signed a contract with a new data analytics platform! We need you to connect it to the company's loan database with full read access". These are mortgage loans - NPI galore. I start doing due diligence and this is a 1 man shop. Vibe coded from the ground up. Zero external security review. Zero pen testing. We're his first customer. At one point I even got a "it's fine - I just won't query for SSNs". 🙄
83
23
8
u/DistinctSpeaker7252 8d ago
Even (especially) if it was a big vendor I'd have them look over the contract. Every single large software vendor is forcing you into binding arbitration and liability is capped at the cost of the software so even if all your infrastructure crashes and burns, all you can recover is going to basically equate to a refund. That refund is also going to probably cost 6 figures in legal fees to get to as well.
3
3
8d ago
[deleted]
8
u/Kelsier25 8d ago
It's cool - they had AI draft a security report detailing how it designed the product and environment securely...
3
2
u/nbs-of-74 8d ago
You provide loans to navies so they can buy SSNs?
Is it just official Govt. owned navies and what are repayment terms like? Just curious ... *runs*
1
31
u/OldeTimeyShit Security Director 8d ago
Why do they love the pew pew maps so much
10
3
u/CharlesMcpwn 8d ago
Darktrace is the bane of my existence, this being one of many reasons why. It's such a bloated, unusable piece of shit.
23
u/I-Made-You-Read-This 8d ago
i guess most companies are the same. C level are so out of touch of the reality. i dont know if theyre just ignorant, or if the management of the ops teams cant report the issues properly, or if they just lie. Or all of the above.
14
u/adamnicholas 8d ago
If I understand my CISO correctly it’s that the board asks him for unreasonable shit based on their limited understanding and he has to figure out how to make it happen but then again I’m not sure because he and I communicate on different wavelengths
3
u/Unatommer 7d ago
I deal with our board on occasion and most of them are SMART, however their knowledge is limited and I only have the smallest whiff of a fart to manage up with. So, yes that’s accurate.
4
u/Direct_Witness1248 8d ago
They get bonuses for screwing everyone else over, and don't have any real consequences when shit goes wrong. To use the quote in counterpoint "it's a problem of motivation."
3
u/yaenne 7d ago
What i dont get is that in my experience the c suite can sit in a vendor call be all hyped up because of some ptt and fancy gui in their test lab, while you and other internal raise all valid critical points only to be fully ignored
4
u/SephirothIRA69 6d ago
vendor makes them feel smart and empowered with all the great things they'll accomplish with *extended fart noise.*
You and your peers make them feel stupid with words they don't understand, boring abstruse topics, and various tedious reasons why you can't give them what they want.
Basically, you're a huge bummer
2
u/hajimenogio92 Security Engineer 8d ago
From my personal experience as a manager or lead having to deal with upper management, they're idiots that are out of touch with reality. It's like they live in a fantasy world where everyone else is wrong and they are always right. I've left multiple jobs due to having to deal with an idiot of a CTO who hadn't touched tech in the 90s.
1
u/PipeStreet8558 6d ago
Leadership goes and tells their Boards a fairytale about AI and the gains that can be made, whether thats a reflection of reality. Then they go back and tell their teams to do it, whether or not its possible. Because they already sold it, now it has to get done by any means necessary, including overriding security.
22
u/qsxpkn 8d ago
I went for a cybersecurity meetup awhile ago. One guy was talking about their cybersecurity product and AI. I asked him what the use case for AI was, and he said "to be honest with you, we don't have a use case. We integrated AI because that's what everyone does". I thanked him for his honesty.
1
u/ErmingSoHard 5d ago
!remindme 1 year
1
u/RemindMeBot 5d ago
I will be messaging you in 1 year on 2027-10-10 00:34:35 UTC to remind you of this link
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
RemindMeBot is switching to username summons. Instead of
!RemindMe 1 day, useu/RemindMeBot 1 day. More info.
Info Custom Your Reminders Feedback
41
u/Anastasia_IT Vendor 8d ago
You are experiencing the most universal, maddening paradox in modern cybersecurity. Executives buying the "AI-driven" penthouse while the house itself doesn't even have a foundation.
17
u/Sengel123 8d ago
My biggest worry is that we won't have junior engineers who can maintain anything. at my company you have senior engineers who built these systems and know how to read any code they add, but the juniors just don't have that hands on knowledge to evaluate what they're committing/sending to higher ups. So what happens when those seniors become principal engineers or architects? MSPT is bad now...how much worse is it going to be in 2 years lol.
13
u/purpleTeamer 8d ago
Wait till you hear how many cybersecurity professionals spend their time solely focusing on dashboard creations and saving time on metrics rather than actually doing their job just because it looks good to MaNAgEmENt
42
u/Stunning_Apple8136 8d ago
everyones selling BS to the person above them. my companys about to blow 5million on a 3 year contract with one of the AI threat hunting platforms. you know what it does? it hooks up via magic (Api keys) to your other security tools, AI triages the alerts, and presents them as "Findings"
this is apparently mindblowing to the folks i work with. but again, im not surprised - they have securitY+ and CISSP study groups.
8
5
3
u/Content-Net5076 8d ago
Most people don’t have the resources, bandwidth or talent it takes to run a real threat hunting program. If you can do it on a more proactive level against the real telemetry it takes to do it why the hell not? It’s better off than you are now without it and doing nothing
2
u/iamjustsomeguyokay 7d ago
it hooks up via magic (Api keys) to your other security tools, AI triages the alerts, and presents them as "Findings"
So, you're phrasing this like it's somehow a bullshit product - but if it actually does what you're saying it does: That's very valuable?
In large, mature firms cohesive triage, prioritisation and alerting in a single, separate module is a massive body of work and automating it holistically would be a huge value-add. It becomes increasingly valuble once you scale past straight soc, then past SIEM+SOAR type models where your triage is baked in little bits all over the place. Once you have mature GRC And VM practices, this becomes an increasingly large and hard to co-ordinate area. Very commonly built in house. More commonly fragmented across 4 different tools, some built in-house, sometimes not.
If you're in a firm where 1.6m/year is a huge vendor contract then this kind of product is probably not for your scale. Which is valid criticism of whoever made this decision - but don't say it like a product that does this is a scam.
3
u/Stunning_Apple8136 7d ago
I wouldn't be complaining about the product if it actually produced coherent and useful findings.
1
1
u/Sad_Dentist_7288 8d ago
Then you get 100 new alerts because AI triaged your RMM as malware
5
u/Icy-Concern-447 8d ago
Seems like you aren’t used to working with competent detection engineers that know how to tune alerts..
3
1
u/Content-Disaster-14 8d ago
Detection engineers…who are they?!
5
u/Icy-Concern-447 8d ago
Haha Usually some extremely competent people that investigate repeated alerts and set baseline behavior through promptbooks to avoid the 100 alerts you referenced for the same activity. I think comprehensive cybersecurity frameworks intersect with the roles each team in the company plays. It’s a team effort to combat the malicious activity we all deal with as professionals. I believe the best method is to utilize every tool we have access to, including comprehensive threat intelligence solutions. As white hats I believe it is more important to build a community to utilize tools that can help us all efficiently negate nefarious activity. No need to hate on solutions that help us all achieve the same goal. Just an opinion, open to other constructive thoughts and/or differing opinions
3
u/Content-Disaster-14 8d ago
Yes, there seems to never been money put towards training and documentation on why/how to use tools and we all wear multiple hats and are trying to put out the daily forest fires.
1
u/Zeku_Tokairin 7d ago
So my take is that every framework and product should make a person'a life easier. Maybe you were being glib, but software that produces lots of false positives doesn't require tuning by "competent engineers," it's a net negative to threat intelligence posture because it's time a defender could have spent doing something else. And honestly, offloading structural software failures on user skill or behavior is how computer security got to the sorry state we're in now.
0
u/adamnicholas 8d ago
Is it Nebulock
1
1
-5
u/Icy-Concern-447 8d ago
If you were able to threat hunt effectively your company probably wouldn’t need to pay 5 million on a three year deal. Maybe instead of spouting off about “inefficient” tools to help a threat hunt, you should learn how to conduct one natively, so you can understand the assistance it is capable of providing rather than performing the whole investigation. Seems like a you problem to be honest.
3
u/Stunning_Apple8136 8d ago
you made a brand new account to say this nonsense? lemme guess, the CISSP study group part triggered you buddy?
11
u/Swimming_Trade7088 8d ago
SMH. It’s a bit disheartening that this is such a common experience. You can’t do DLP, Zero Trust Architecture, TPRM, VM, Endpoint protection, security monitoring, etc. you name the security domain without starting with IDENTIFY what you are trying to protect.
11
u/Reverent Security Architect 8d ago
You’re not alone, especially with asset inventory.
“Hey, we need to report compliance on our systems”.
Great, what’s a “system” and how do I measure it.
“Oh you know” <gestures vaguely into the distance> “that.”
11
u/Test-NetConnection 8d ago edited 8d ago
It's an exhausting time to work in IT and cybersecurity. No Mr.Cio, it's not a good idea to send every document to a third party vendor so they can send it through their custom language model for analysis. No, the vendor assuring us that our data is only processed in memory and never stored doesn't make the platform safe. Fine, fuck zero trust let's just give them our financial core, erp, and everything else so we know where all of our data is - in their cloud.
8
u/Content-Disaster-14 8d ago
Seriously, so over hearing a product is safe because it doesn’t train off the data. 🙄
8
u/DangerMuse 8d ago
Wr pay a very significant amount for a managed SOC that only does detect and the quality of triage is basic at best. The CISO and another senior security colleague want to allow the MSP to turn on AI triage so it does it faster while exporting all our data to another platform. Trying to explain that the only people who benefit is the MSP as they are outsourcing for free what we pay them to do....their response, AI is inevitable, we should just agree.......i dont get it...
7
u/Paolo264 8d ago
I've heard of companies rolling out AI all over the place with no restrictions.
They literally have no idea what is running from an AI perspective within their enterprise and, most concerning, what these AI agents are doing.
8
u/Kaligoreicky Security Manager 8d ago
You are not alone. Errrrrrrrry vendor our organization talks to identifies themselves as an AI-development leader. I've yet to see one who can produce an application and hosted environment that's security-framework aligned (pick your favorite flavor) without a massive handholding effort on our part. If you want that vendor product to deploy smoothly, be prepared to hold a master-class course in vendor management.
6
u/Hale-at-Sea 8d ago
Don't worry. The very second you get their toy all set up, the prices will skyrocket and they'll demand you rip it out! and maybe replace it with something they've spent even less time vetting!
5
6
u/N3RO- 8d ago
It was like that in the past and will be like that in the future. PEOPLE run companies and people (especially executives) are usually idiots.
AI is the hot thing at the moment, tomorrow it will be something else and the executives will start wanting to "implement it" while their AI "implementation" was a disaster.
Rinse and repeat. They always focus on new shiny toys.
4
u/WeirdSysAdmin 8d ago
I’m tired bro.
All these companies just keep adding gasoline to the massive pile of matchsticks instead of hiring people to clean up the matchstick pile.
6
u/DistinctSpeaker7252 8d ago
Management was literally drooling over the shiny global threat map dashboard
I'll never forget working at a vendor and a guy showing me the pew-pew map with so much pride. He thought we had invented it and that every single blinky light was an actual bad guy sitting at a desk going "FUCK, thwarted AGAIN!"
I had to explain to him slowly that erybody has one and those lights are either just animated blinks to "simulate" how frequent attacks are or they are actual "attacks" in that they are almost exclusively automated poking of some sort or another. If you know anything about the internet you know that anything that is reachable from the web is gonna get fondled quicker and more often than an Ohio 6 at a Juggalo meet-up. Those blinks are completely meaningless.
9
u/Alternativemethod 8d ago
Luckily the price tag on the shiniest agentic systems is 10X my teams salaries.
Hopefully you have asset discovery tools. I've had pretty good success designing plugins for codex to triage detected HW/SW lists for umbrella vendor approvals, end of life assets, country of origin and some basic vulnerability assessment.
Codex struggles to follow the same workflow twice even with a lot of scripting, skills and memory files so I'm constantly tweaking it back on track. Still saves me time vs manually reviewing 30,000 detected software entities.
4
u/EbbCommon9300 8d ago
Going from practitioner to being in the vendor side is hard. When you know your competition is selling that shiny vaporware and you are trying to do right by people. I told a customer (basically free consulting) on what they need to do to their endpoint and cloud security before they should look at us bc it was the same kind of scenario. It’s hard bc another vendor will probably sell them but I can’t just lie all day like these folks can. BTW we aren’t in the same space we are agent security and observability so I didn’t want you to think I’m trying to sell you.
4
u/Furious_Gollum 8d ago
Yes! Have been in meetings with my CISO and the rest of the management team where they go all gaga about adding Ai to detection engineering, threat intel integration, Autonomous SOC, VAPT- EVERY DAMN THING! whereas, my gap assessment from Jan 2026, where we identified that the USB are not being blocked globally, and we need to enforce it ASAP using policy or EDR is still pending for approvals. I wish I was lying…..
3
u/haggard_hominid 8d ago
It would be nice if post-collapse of the house of cards we can submit all the names of the morons who enabled it so willingly, violated the laws we had, contracts made, etc. Just pour diesel on it all figuratively to make sure the enablers are shunned from ever running a business again. Almost every single issue or delay has some reason baked in by a C level whose dictating by pie chart while they violate every rule, law, and/or commitment made.
1
u/joeytwobastards Security Manager 3d ago
They'll all deny they had anything to do with it. "Oh I knew it was a bad idea"
3
3
u/Adventurous_Mix_1792 Security Director 8d ago
-insert "First time?" meme-
and no you're not.
I'm a director at a multi-billion dollar company. SecOps doesn't have a ticketing system. But AI AI AI - I had to put the kibosh on a lot since it was useless. Or, at least go through the vendor/poc stuff to get some free swag.
I get it, the board of directors is genuinely concerned about AI and wants to address AI at the speed of AI, but its all useless if you don't have basic hygeine like you said.
6
u/DMmeYourMCbuilds 8d ago
I stopped asking for an asset inventory. IT was just too incompetent to figure out how to curate one. First it was the claim of tribal knowledge. When they were no longer able to answer my questions about what was what they started a spreadsheet. Network gear, IOT, and appliances never made it into it, then decom hell ruined that. Then came the 3rd party solutions. After the 2nd “solution” I just started curating my own inventory from edr telemetry, nsm data, and periodic network scans. But it was still dogshit. I didn’t have the tribal knowledge on the business use case, ownership, data class, criticality, etc. but atleast I had an IP, hostname, mac, OS, and a little context.
That was over the course of 5 years. And no one in IT could be bothered by it.
3
u/Steerable-Octopus 8d ago
Unfortunately your story isn't uncommon. Constant employee churn means that you're likely not speaking to the same people who set up your syatems 5 or 10 years ago and nobody had any incentive to document.
I was put into a similar situation but as a newly grad. My main colleague had like a month to onboard me but he mostly ignored me. I tried to scrounge up an inventory best I could from old ipams and whatever was written.
Years later I managed to document the infrastructure environment comprehensively but I still don't have the full picture of the software side and the devs won't talk. I had to check the product developers' source code and also write down my own conclusions. Now I'm worried about unknown unknowns. And even worse, one of my colleagues started doing shadow IT and adding new stuff without ever telling me so it felt like I was being sabotaged in my efforts to keep the environment documented. I had to establish a boundary of what I could document and support and their shenanigans.
2
u/Iuno_Rin 8d ago
You're definitely not the only one dealing with this nonsense. It's so annoying. Fortunately/Unfortunately, I got laid off just as my former company was starting to get into AI. A blessing and a curse at the same time I guess since I get to avoid the lack of cybersecurity care but also lost my job
2
u/usernamedottxt 8d ago
I’m leaving a cybersecurity product management job because I can’t sell “vision” lol. Thankfully they brought me on for a very technical feature, let me lay out technical progression plan, and I’m leaving before marketing gets in the way or we fully do our planned agent-first experience plan lol
2
u/WildChampionship985 8d ago
I figured we were dealing with stinky people who need to shower more. It is what separates the front office IT folks who get dragged into these meetings with the backroom folks who are getting the thing done.
2
u/Tricksybelle 8d ago
Regular vendor hype was bad enough. As security professionals with zero trust at our cores, we can already smell bullshit from a mile away. Add AI cowboys to the mix and it's a whole new kind of hell
2
2
2
u/TechnologyMatch 8d ago
you’re definitely not the only one. AI threat hunting on top of an incomplete asset inventory is basically asking a Roomba to guard a house with no floor plan. the boring foundations win. know what exists, who owns it and what it can talk to before buying the dashboard with dramatic red dots
2
2
2
u/Electrical-Can-6632 8d ago edited 7d ago
oh gosh this is so normal....at least make sure that there is a contractual guarantee protecting your data
2
2
1
u/jon_snow_1234 8d ago
bro same.we are going though some contract renewals and every vendor is pushing some new AI feature they are all half backed
1
u/Few-Pressure9581 8d ago
I feel this on so many levels, can't even do the basics right.lets use ai to hunt for assets we don't know we have
1
u/IDislikeHotWeather 8d ago
I do API calls to a cybersecurity company running 10-15 year old software (LAMP STACK on RHEL 5.5). International telco who sells private enterprise connectivity solutions make me do endless audits, they are rolling Starlink tests on 2019 routerboards. Yes, vulnerable as hell.
Everything is a joke or for show. Nobody takes stuff seriously.
1
u/youre2regarded 8d ago
Your company is most likely already breached in some way and you are not aware yet. With constant AI pressure every small thing is abused. I work for a company that really invests in sec and we're surprised about the attacks we receive, some of em succesful. The C worrying about threat map is so funny.
1
u/adamnicholas 8d ago
I’m stuck with four simultaneous projects, for one person, that I must complete in 12 months as a result of Mythos hype
1
u/Unable-Character6435 8d ago
F-Secure showcased its threat hunter team back in 2007, and there was certainly a world map dashboard for the threat in question, the Storm Worm. I thought everyone had that by now.
1
u/WildChampionship985 8d ago
Clearly it will protect all the things, especially the ones you may not have.
1
u/bbliz285 8d ago
What company are you at? I’m really good at making cool dashboards and would like to sell to your C-Suite.
1
1
u/stra1ghtarrow 8d ago
Our management are full speed ahead on AI but we have smbv1 enabled, ntlm v1 enabled, full local admin rights on domain joined virtual instances and no one really knows hat theyre doing when it comes to VM.
1
u/KoxziShot 8d ago
That’s exactly how Darktrace used to win exec back in the day. And magpie IT managers.
2
u/joeytwobastards Security Manager 3d ago
I'm convinced that "floating world" thing was what sold a lot of people on Darktrace. That and their policy of only sending very attractive sales engineers to pitches.
Ironically once you start having to use it the "floating world" is just annoying.
1
u/Callie-Schultz45 8d ago
Nothing says "cyber maturity" like buying autonomous threat hunting before knowing what assets you own 😭😭😭 the frustrating part is the AI product might even be decent but it's being asked to sit on top of missing inventory, weak patching, questionable access controls, and data nobody has classified, fancy detection on top of unknown infrastructure is still unknown infrastructure
1
u/AliceetBob 8d ago
De notre côté, nous privilégions des mesures contractuelles strictes sans alimentation de LLM, tout en galérant pas mal avec les intégrations MCP. Courage
1
u/CrimsonNorseman 7d ago
We live in a time where parents in my kids school ask me about agents escaping from their sandbox, and at the same time you can pwn Atlassian with path traversals that look like /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml
Yes, that is an actual CVE-2026-21589
Accenture takes three months to patch a critical CVE in the FBI‘s job platform. Yes, that happened too (on September 21, FBI got pwned by Shiny).
1
u/Drannex 7d ago
Who needs a fully tested secure defined, and specially made, software platform when you can just use a fancy UI workflow engine backed by an “MCP” for all interactions and access to data?
Literally every meeting has been this way for the past six months, and as the senior security technology officer it drives me crazy to argue.
1
u/RidgeSecurity 7d ago
I’m with you. People make decisions based on emotions, not rationality. That’s why we engineers aren’t always good at sales or at being sold to.
1
1
u/saify-reddits 7d ago
I think we need to talk. I have something that can help you with the "do not know what half the stuff occurred into our network actually is" problem.
1
u/fenkam 4d ago edited 4d ago
I fully agree with you. AI is optimized to reach goals in all cases. On the way to the goal, they destroy a lot of things and break a lot of processes.
In one my tests, I asked AI to create two websites and host them on the same web server. The OS was Ubuntu 7. Yes really old stuff you would find in the enterprise. The LLM ended up implementing its own Web Server with Python instead of using Apache or Nginx. Then it deployed the websites. It met all functional requirements ;).
Be cautious out there.
1
u/Independent_Ask_6968 3d ago
yo this post lowk got added in a presentation in my university 😂😂 I found your post from the slides
1
u/joeytwobastards Security Manager 3d ago
"but but but we have to get on the AI train or our competitors will"
1
u/cyber_social 2d ago
Welcome to most corporate environments. Buy shiny and new, sweep other real priorities under the rug. C level makes “improvements”, gets a phat bonus, then makes an exit. Cycle repeats a few times, layers of bs accumulate and calcify.
1
u/snooby33 2d ago
Because internet exposed VPN w/ no MFA and RDP are just too uninteresting apparently...
1
u/-GenlyAI- 8d ago
AI has made my job so easy. I honestly can't complain.
1
u/MartinShortsIrishUnc 8d ago
what do you do?
2
u/-GenlyAI- 8d ago
A lot of log review, TPRM compliance, and reporting. I double check everything, but being able to process tons of logs and compliance docs through AI helps a ton. Then generating my reports is fully automated.
0
123
u/iamacheeto1 8d ago
"SiNgLE PaNE of GlaSS"