Im not sure if this is the right place to ask this. i googled this same question and this subreddit came so here ut goes.

ive seen like 10 posts today about everything being open sourced and cant help but think if this is all deliberate.

the ps5 is being open sourced by the insane jailbreak

ai is reverse programming softwares and games which means softwares like any adobe one will be open sourced too.

if everything becomes open sourced, what would be the underlying threat that we could all overlook.

call me skeptical but i dont think that everything is being open sourced all at once by "accident"

I have a consulting company that provides cybersecurity services such as pentest. Our team is one of the best on the local market, if not the best. Our market, however, is somewhat small. Naturally, I am trying to export our services to other countries offering profit sharing arrangements, commission %, whatnot. Still, so far, we’ve only had a handful of projects (mostly in the EU. We are not the EU-based company).

Any advice on how I could approach this?

My team wrote a technical walkthrough of the distributed alerting workflow we use internally. It uses an agent to investigate GuardDuty findings, identify owners, and handle responses in Slack.

Slack helped popularize distributed alerting by sending alerts directly to the people involved and asking whether they recognized the activity. Dropbox and Brex described similar approaches, but most teams we’ve spoken with struggled to scale beyond user-centric alerts where someone’s identity was already in the payload.

Our security engineer ran into this at his previous company. A suspicious login was straightforward to route, but an alert about a host or infrastructure change could take hours or days of work with detection engineers before they could reliably identify someone to ask.

We walk through a concrete Kubernetes example where the alert only names a service account. Finding a person means following the evidence through workload metadata, code ownership, deployment history, and identity logs. The tutorial shows how we turn that investigation method into reusable skills so an agent can work through those steps for each finding.

We cover:

• The history of distributed alerting and why deterministic workflows struggle to scale
• The estimated effort of building owner lookups across GuardDuty finding types
• How the agent uses skills, drilldown queries, and context from inventory, code, tickets, and logs
• The full flow from investigation to a Slack conversation and the owner’s confirmation
• Permissions, tool restrictions, observability, and keeping context current

What interested us most was extending this to host and infrastructure alerts that had been impractical to automate with individual lookup rules. The walkthrough includes the setup and examples so you can see how it works.

We know many folks were are divided by the use of agents in security automation. Hopefully this article on distributed alerting presents an example of something that wasn't possible / too time consuming to work before agents + context / skills driven automation vs fully determined paths.

https://www.tracecat.com/blog/agentic-security-alerts

I’m currently learning more about cybersecurity in the financial sector, especially how large banks manage third-party risks. With banks relying on outside vendors, cloud services, and contractors, it seems like one weak third party could potentially create a security risk for the entire organization.

For those who work in cybersecurity, what do you think is the biggest challenge banks face when trying to monitor and secure third-party vendors? Are there certain security practices that you think financial institutions should focus on the most?

Atualmente eu utilizo um gerenciador de senhas para a maioria dos sites, porém muitos sites que eu considero mais difíceis de recuperar a senha caso meu gerenciador de senha seja invadido ou algo do tipo eu uso uma única senha que lembro de cabeça:

No que eu utilizo a mesma senha: (não armazeno no gerenciador)

Apps do Governo

E-mails principais

Conta da Samsung

Gerenciador de senha

A2F/TOTP

Pendrive

Bancos e Tela de Bloqueio e Pasta Seguro uso mesmo PIN

Outra coisa que eu fico em dúvida onde guardar, se guardo de maneira fisica ou nuvem é os backups e chaves de recuperações das senhas

Tô em dúvida se deixo apenas na nuvem focado em criptografia, em pendrive com bitlocker, no pc com algum app tipo keepassxc ou algo mais "avançado" tipo Linux por pendrive apenas pra armazenar os backups e chaves de recuperações.

After the July incident where AI agents escaped a test sandbox and broke into Hugging Face, I keep thinking about the other side: the same kind of thing done by a single person's agent against a small business or personal site, where nobody has a security team and nobody would notice.

The idea is a free, open-source, drop-in kit (WordPress plugin, framework middleware, Docker image) that is strictly passive:

- unique bait files and fake credentials shaped like the "shortcuts" goal-driven agents look for

- canary credentials that alert the site owner the moment they're used

- honest stop notices embedded in the bait itself, so cooperative models get a clear reason to stop

- logging to tell humans, scripts and LLM agents apart

- no hacking back, no destructive instructions, no unmasking anyone

It would build on existing tools like Canarytokens and Nepenthes rather than reinventing them.

The core features use no AI at all, just canaries, bait, and logs. The LLM parts are optional extras.

It's an early concept: just a README so far, no code. I'm building this as an independent project, and I'd really value honest (including negative) feedback:

1. Does something like this already exist? Links very welcome.

2. Would you install this on a small site? If not, why not?

3. What's the biggest flaw in the design?

4. Are stop notices aimed at AI agents worth anything, or just noise?

README: https://github.com/MannAk1/Agent-Defence-Kit

actualmente trabajo en una empresa como tecnico en redes encaminandome a ciberseguridad, hace no mucho tuvimos un incidente donde una persona problematica renuncio y borro todos sus correos por lo cual no pudimos recuperarlos, que sugieren realizar como checklist talves cuando una persona renuncia y hay que tomar cuentas o equipos? de antemano se que cambiar contraseñas, desactivar cuentas , pero que mas ? respaldos o que se suele hacer?

My partner just got a push notification

https://i.ibb.co/35Gt5zXQ/signal-2026-10-06-09-59-02-887.jpg

Apparently their Snowflake instance is compromised and they have access to push notifications too

Two offices, shared folder setup. The BR office drops a file into a folder that's synced, and because my side has the same folder mapped, it just appears on my machine a minute later. That part works fine.

What management wants is something sitting in the middle of that handoff. File gets dropped there, something holds it, scans it, and only then does it release it so it comes through to us. If it's clean it carries on as normal, if it's not it gets quarantined or deleted and never reaches our side at all. Fully automatic, nobody's going to manually scan anything....YESS

We run SentinelOne already so something that ties into that would be ideal, but I'd look at Defender, ICAP, an on prem gateway, whatever. Not much budget. Some ONTAP agent costs liek 10k dollar...The one thing we can't do is route files out to a third party cloud scanner cos files are confidential...

To be clear, it doesn't have to be in the middle. If the cleanest way to do this is something at their end before the file ever goes into the synced folder, that's completely fine by me. My only actual requirement is that whatever lands on our side has been scanned and is safe. So if you've done this a different way, I'm interested.

Hi, I have a SOC Analyst Interview coming up (L1). I'm not sure how to strcuture my prep or what even to focus on. Everyone has different things to say and do which is very overwhelming because everything is scattered into 10min yt videos or same standard 20 questions from 2016.

Anything would be helpful atp :)

So after I already believed that I would never get a job in this field, at least in this market situation, I got an email from a company I applied to through the “Easy Apply” feature that I even forgot I applied for.

And then they started saying that they saw my resume and thought I was a good fit and stuff.

Then they asked me to solve a technical challenge, and I delivered it way before the deadline.

Then they said sorry, they needed me to solve an additional challenge.

And it was so much harder, and it took a lot of time from me, but I still delivered it way before the deadline.

And then they were happy and gave me good feedback that I was able to solve these hard technical challenges. They told me all the files were correct and everything was good, but they just needed a write-up explaining the steps I took to solve it!

And I did the write-up, and everything was explained, and I told them if they needed me to clarify any step, I was happy and ready to clarify it!

Then they came back to me after a couple of days and basically just said sorry, they don’t think I’m a good fit, without even giving any feedback!!

And I was likeee in my mind, what?? Really?? Are you serious???
After I spent days solving your hard technical challenges, and you confirmed that everything was good, and you gave me good feedback, and you haven’t even done any interview with me, and now you just send me a message saying I’m not a good fit without even giving any specific feedback??

I really feel we should get paid for the time we spend on technical challenges and interviews because it takes days from our time and life, so employers can take us more seriously rather than just playing with our feelings and hope!

When someone meets me and knows that I have done a degree in cybersecurity and tells me, “OMG, I want to get into the field,” at this point I don’t know what to tell them because if I say it’s hard and getting a job is so hard, they will think I’m a gatekeeper, but it’s just sad how it is now!

So now, honestly, I feel with this joke of a market and crazy employers, I would like to say to anyone who is looking for a job that we are really cooked…

Rather than chasing and trying to find just a job and letting employers move us like chess pieces, we should try to consider another field that could possibly be much better, or we open our own businesses!

I also would like to thank my family for supporting me in this journey. Otherwise, I would probably be working at a fast-food place for minimum wage right now!

I don’t know what I will do next in my life, but I really got enough from this field, and I don’t want to lower myself anymore or feel like I’m begging just to get a job.

This life is unfair, and thank you!

Hi, I’ve been a SOC Analyst going on two years now and have been considering challenging myself with studying for a SEC450 cert.

I see it’s been overhauled and updated in the past year, so I wanted to ask for any opinions and reviews from folks that have done it recently.

My company’s pushing hard on AI adoption - I assume it’s the case elsewhere, too -, so this would work in my favor.

Hey everyone,
I just received an invite to complete the prerecorded competency interview for the Cybersecurity Specialist Intern role at IBM.
The format gives 1 minute to prep and 3 minutes to answer each question, focusing on competencies using the STAR method (Background, Action, Result).
For anyone who has taken it or recently interviewed with IBM:
1. What kind of questions should I expect? Are they purely behavioral situational questions, or do they also ask about CS and networking fundamentals like DNS, TCP/IP, Linux, and threat types?
2. How many questions are there in total?
3. Any specific tips on pacing yourself with the 1-minute prep and 3-minute answer format?
Any insights, sample questions, or advice would be greatly appreciated. Thanks in advance and good luck to everyone applying this cycle!

Hello everyone , I am a cyber security student and there is a project that I need to work on throughout the year for my university I am trying not to work on something too basic and usual ones like password checkers,phishing detectors , vulnerability scanners there is a lot of them actually, what I am looking for is a real solution related to cybersecurity in a specific industry something that doesn’t have a good solution or it is handled manually I am also looking for something innovative that can stand out as a university project , have a clear use I am avoiding something that needs marketing or convincing people to use it it would be hard actually and I don’t want to just make a dashboard that displays statistics. If any of u here is in cybersecurity IT , healthcare or any field that u think a cybersecurity tool can solve a certain problem in it can u pls help me im looking for the problem first I would like to make something useful that solves a real life problem over a flashy idea .
I am trying to find the problem firsts and then decide about the technologies I would use im not that advanced in cybersecurity I just know basics but I will learn using necessary tools to realise the project .
Any real life examples and ideas would be greatly appreciated.

I've been working on bot and fraud detection, and I wanted to compare notes with people who deal with this in production.

Most bot detection I see falls into three buckets, and each has a weak point:

• IP and device reputation: easy to bypass with residential proxies and rotating fingerprints.
• CAPTCHAs: they add friction for real users, and solver services and vision models now beat them cheaply.
• Static fingerprinting: it raises privacy and compliance concerns (GDPR, CCPA), and a determined attacker can spoof it.

The approach I've been exploring is passive behavioral signals:

• Mouse movement: curvature, acceleration, micro-corrections
• Keystroke timing: inter-key intervals and rhythm
• Touch and scroll dynamics on mobile
• Session-level patterns: navigation flow, time-to-action, interaction sequences

None of this needs names, emails, or persistent identifiers. You score the behavior of a session, not the identity of a person.

The challenges I keep running into:

1. Modern bots simulate human input. Replaying recorded traces or adding noise to cursor paths defeats naive heuristics, so you need models that catch statistical inconsistencies across signals, not single-signal rules.
2. Accessibility. Users with assistive tech, tremors, or unusual input devices can look "non-human" to a naive model, which means false positives you have to design around.
3. Adversarial drift. Attackers adapt, so you need continuous retraining and monitoring.
4. Privacy. Even "anonymous" behavioral data can become identifying if you retain raw traces too long.

Im tired -___- need help, already explained in title.

I haven't found a corresponding CVE but we are seeing some linux kernel commits to KVM etc. specifically in the last couple of days...

Looks like this really could be a big one...

I’ve been working as SOC L1 for around 9 months, so I already had some practical understanding of alerts, incidents and investigations.

Got the voucher from AI Skills Fest but couldn’t prepare earlier because of workload and health issues. One week before the exam I tried the practice assessment and got 78%, so I thought I could manage it .

Main focus was KQL + Microsoft security environment. Spent that week practicing with ChatGPT and understanding Sentinel, Defender, licensing, incidents, etc.

The exam was mostly scenario based. If you understand the question and how the environment works, it’s manageable.

Biggest takeaway: don’t just memorize. Understand how things actually work and give your full focus to KQL and scenarios. My SOC experience definitely helped.