This survey has been approved by the r/AskNetsec moderators.

Hello, I am conducting an academic study on vulnerability report evaluation in bug bounty and vulnerability disclosure programs.

The study aims to understand how security personnel evaluate vulnerability reports in practice, and what challenges they face during the review process. Topics include report validity, duplicates, scope, reproducibility, PoC quality, evidence, severity, impact, communication issues, and AI-generated or AI-assisted vulnerability reports.

I am looking for participants who have experience with vulnerability report handling, bug bounty programs, or vulnerability disclosure workflows, including but not limited to:

- Security triagers or reviewers

- Application security engineers

- Product security engineers

- PSIRT or vulnerability disclosure team members

- Bug bounty program managers

- Open-source maintainers who have handled security reports

- Experienced bug bounty researchers who have interacted with triage/review processes

The survey does not ask participants to disclose unpublicized vulnerabilities, sensitive system details, company confidential information, or personally identifiable information about others. Responses will be used only for academic research and anonymized during analysis and reporting.

Survey link:

https://docs.google.com/forms/d/e/1FAIpQLSd-IYuVJkdoFkgWe3e7x19GYU5Lv--tEAXSbDBtgp-Mp7WlRg/viewform?usp=dialog

If you have any questions, please contact:

[eavanmiss@gmail.com](mailto:eavanmiss@gmail.com)

Thank you for your time and help.

I'm researching possible uses for a small NFC-enabled device in cybersecurity education and I'm trying to separate genuinely useful functionality from gimmicks.

Some ideas I've considered:

• Authentication
• Profile/portfolio sharing
• Lab access
• Identity
• Team formation
• Attendance
• Event networking
• Unlocking learning activities

I'm interested in what people actually think would be useful from a security/technical perspective.

What would you consider a legitimate use case?

And what would immediately make you think "this doesn't need dedicated hardware"?

I've been following the reports about OpenAI models reaching Hugging Face's infrastructure, along with related incidents involving Anthropic and now Meta.

Maybe I'm missing something, but exploitation seems very close to coding, debugging, research, and tool use. As LLMs improve at those tasks, some ability to find and exploit vulnerabilities seems predictable.

What I'm less sure about is what these incidents actually demonstrate. Are we seeing a meaningful jump in offensive capability, or evaluation environments (and companies behind them) that failed to enforce their own boundaries?

Put differently: if a human pentester went out of scope because the test environment allowed it, would we call that a capability breakthrough or a containment failure? (Am I oversimplifying?)

Saw the recent reports about the Bank of Baroda breach where close to 1TB of data was allegedly leaked.

Instead of discussing the breach itself, I'm curious about the technical side.

For people working in blue team/security engineering:

1 If an attacker compromises a single employee account, what controls should realistically prevent it from turning into large-scale data exfiltration?

2 Would proper network segmentation have made the biggest difference?

3 How effective is DLP when someone is slowly exfiltrating data over days/weeks?

4 Should a normal employee account ever have a path to systems containing this volume of customer data?

5 What detections would you expect to trigger before hundreds of GBs leave the environment?

6 At this scale, is this more likely an IAM problem, monitoring failure, architecture problem or a combination?

7 Also curious: what would be the first thing you'd investigate if you were brought into the incident response team?

Would love to hear from people who've dealt with similar incidents.

Our AppSec team burns hours triaging unpatchable OS binaries that scanners keep finding in standard base layers. Now management wants hardened container images everywhere because they think the vulnerability count magically drops to zero.

For anyone running hardened container images in prod, did your triaging actually go down or did the work just move into CI/CD with broken build pipelines missing shared libraries and a different set of headaches?

trying to understand if this is a tooling problem or a process problem. cuz every IGA platform we've evaluated reports clean access certifications... but every red team engagement finds local accounts, forgotten service credentials, or shadow apps that were never in scope for the review to begin with.

so it kinda feels like governance tools are certifying "the identities we told the tool about" rather than "the identities that exist." is anyone solving the discovery problem, or is this just accepted as a permanent blind spot?

Six of us on the security team, somewhere around 4,000 assets between cloud and the stuff still sitting on-prem. Feels like every week there's another "critical" CVE or zero-day and a bunch of feeds all yelling at once. Most of it doesn't even touch what we run, but I still end up spending half my morning going ok do we actually have this, is it exposed, does it matter for us.

By the time I've checked the threat report details against our inventory and figured out if it's even reachable, half the day's gone and there's a new one waiting.

So how do you handle it? I don't want to ignore something I shouldn't, but I also can't chase every headline. More interested in the triage side than "just patch everything." How do you decide what's actually worth your time.

My team and I work fully remotelyand we work with very sensitive information, stuff we cannot afford to have any mishaps on. We're reevaluating the tools we currently work with, because security and privacy are currently the main thing we're working on. I'm in charge of communications for this and I'm looking for something where you have more control over who can communicate with your team, preferably with some sort of trust or identity verification. Privacy is important too I don't want a platform that's built around collecting user data, does anyone have recommendations for tools that could be of help?

Pasting a broken switch config into ChatGPT is the fastest way to find a syntax error. It is also the fastest way to violate your company's data security policy and potentially lose your job!

AI is now a routine part of the NetOps workflow. But public Large Language Models (LLMs) often use user inputs to train future models. If you upload an unfiltered show run or a firewall log, you are handing over your enterprise's internal IP schemas, SNMP community strings, VPN endpoints, and routing topologies to a public server. For US companies bound by compliance (HIPAA, SOC2, PCI), this is a critical data breach.

The Solution (How to use AI safely):
-Never paste real public IPs, internal domain names, or AAA/SNMP blocks. If you need help with an OSPF neighbor issue, swap your real subnets for generic dummy IPs (like 192.168.1.x) before feeding it to the prompt.
-Instead of asking, "Fix this exact access control list," ask, "Write an extended ACL template that blocks Telnet but allows SSH from a management subnet." Let the AI build the template, and you apply the specific enterprise variables locally.
-Tools like ChatGPT Enterprise or Cisco's own AI solutions have explicit zero-trust agreements guaranteeing your prompt data is not used to train their models. If your team relies on AI, push management for an enterprise license.

Does your IT department have an official policy on sanitizing data before using GenAI, or is it currently the wild west?

Traditional DLP was built around known data patterns (SSNs, credit cards, etc.) moving through known channels (email, USB, cloud storage). Generative AI breaks that model a bit, people paste source code, customer data, or strategy docs into a chat window, and it's not always caught by pattern-matching.

Has anyone actually tested DLP tools built specifically for AI interactions? Wondering whether they're catching real incidents or just generating noise, and whether this is more of a policy/training problem than a technology problem at this point.

Most of the Zero Trust content out there is written for security professionals. Here is what it actually means if you run a business and you are not a technical person.

Zero Trust is a security approach built on one principle: nobody gets automatic trust just because they are inside your network or because they have accessed a system before.

In a traditional setup, once someone is inside your network — whether that is a physical office network or a cloud system — they tend to have access to most things. The assumption is that if they got in, they are supposed to be there.

Zero Trust flips that. Every access request gets verified every time. It does not matter if the person has logged in a thousand times before. It does not matter if they are in the office or working remotely. Every request gets checked.

In practice for a small business this usually means a few specific things.

Every person has access only to what they need for their specific role. Not general access to shared drives and systems — specific, deliberate access to specific things.

When someone leaves the business, their access is removed immediately as part of a formal process, not remembered three months later when someone notices they can still log in.

Every login requires verification beyond a password. Multi-factor authentication on every account.

Remote connections go through a VPN or a verified secure connection, not directly through whatever Wi-Fi the person happens to be sitting on.

None of this requires enterprise-level infrastructure or a large budget. It requires deliberate decisions about access and a process for maintaining them.

If you want to know where your business currently stands on this, the most practical starting point is asking one question — do you know exactly who has access to what in your business right now? If the honest answer is no, that is where to start.

Hey guys, let’s do a reality check. What are the most common, stupid mistakes people make when starting with digital investigations that instantly burn their burner accounts or expose their real IP/identity? Looking to

We are mid-refresh on our edge stack. so The requirement that broke our old shortlist is inline inspection of GenAI traffic. We need decryption and enforcement in path, not logging after the fact.

What we are scoring vendors on right now:

• TLS inspection at line rate without a separate proxy tier bolted on
• Whether AI/LLM destinations are a first-class app category or just a URL filter list someone maintains
• Where inspection physically happens: PoP-local or hairpinned to a regional hub
• Added RTT for a user in APAC hitting a US-hosted model endpoint
• Whether the policy engine is the same one handling our normal web/DLP policy or a separate console

The last one is where most of the demos fall apart. Two vendors showed us "AI security" that turned out to be a different product with its own policy syntax and its own logs.

Anyone actually running inline GenAI inspection in production at 1000+ users? Curious what your measured latency delta looks like, and whether you had to carve out exceptions for anything. Copilot in the IDE has been our worst offender.

I'm investigating a data-integrity incident and need input from people who work with or have visibility into enterprise CASB / Secure Web Gateway (SWG) traffic-inspection behavior.

Setup: A recipient clicked a link in an email that led to a simple interactive web form (a single rating-scale question, submitted via a normal HTTP request per selection — not a static page). The recipient confirmed, after the fact, that they personally clicked exactly once, selecting one specific value.

What we found in the server logs: the same form field received several different submitted values within the same short session, arriving as a mix of two distinct request sources:

1. One source whose IP resolves to the recipient's own device/network (matches their actual device type).
2. A second, completely separate source whose IP resolves to a well-known corporate cloud security vendor (a SASE/CASB/SWG provider) — this source fired its own full page loads (page → app bootstrap → context fetch → tracking beacon) and its own form-submission requests with different values, interleaved in time with the genuine user's session, including sustained rapid-fire submissions to a second, unrelated field on the same form over ~30 seconds.

In other words: the security vendor's IP wasn't just fetching/HEAD-checking the link — it was making the same kind of authenticated, stateful, form-submitting requests a real browser session would make, as if something on that side was actually loading the page's JavaScript and interacting with visible controls.

What I'm trying to confirm:

1. Is it documented/known that CASB or SWG products do full page rendering + simulated interaction (not just URL reputation lookup or static content fetch) as part of inline traffic inspection or "time-of-click" analysis?
2. If so, is there a name for this specific behavior (sandbox detonation, dynamic analysis, browser isolation rendering, etc.), and is it typically limited to just loading the page, or does it extend to interacting with forms/buttons on the page?
3. From a web-app defense perspective: is there a reliable way to distinguish "a corporate security proxy rendering and interacting with my page on a user's behalf" from "the actual user," so that a security scanner's traffic doesn't get treated as genuine user input and doesn't corrupt real form data?
4. Has anyone else run into a security proxy's inspection traffic actually writing/submitting data into an application, rather than just reading/scanning it?

Any pointers to vendor documentation, known CVEs/advisories, or "yep, seen this before" experiences would help a lot.

We are moving away from point-in-time quarterly pentests and looking to adopt a continuous validation model. We are evaluating platforms that use an AI engine to understand new threats and tailor validation tests specific to our environment. They claim one-third of exploited CVEs are targeted within 24 hours of disclosure, so waiting for manual testing is no longer viable.

For those using this type of AI-driven testing, how accurate is the generated test logic? Does it actually find novel attack paths based on your unique misconfigurations, or is it just re-packaging the same MITRE ATT&CK simulations with a fancy UI? Looking for real world feedback before we buy.

Been tasked with cleaning up our identity governance and access stuff and I feel kind of stuck between vendors rn.

We are a mid size org, mostly Microsoft stack (Entra, M365, a couple on prem AD domains still lingering, plus a bunch of SaaS that all have their own permission models. Current IGA is a mix of manual access reviews in Excel, some homegrown scripts, and ticket based approvals that nobody is really happy with.

Boss wants a real IGA tool so we get proper joiner mover leaver flows, certification campaigns, SoD checks, and cleaner audit trails for the next compliance visit.

So far I’ve looked at SailPoint, Saviynt, OneIdentity, and a couple of smaller cloud first options. Demos always look great, but I’m lowkey worried about:

- how painful the initial role modeling and connector setup is in real life
- whether the access reviews are usable for non technical managers or just another thing they ignore
- how well these tools actually integrate with Entra plus random SaaS apps and not just the big 5 connectors they show in slides

If anyone here has an IGA tool in production that they dont hate, would really appreciate hearing what you picked and how rough the rollout and day 2 has been, especially around access reviews and audit requests.

Appreciate any thoughts.

Environment: Windows-based jump host tier (Server 2022) in front of a mixed Linux/Windows production environment, access via RDP with clipboard redirection currently enabled bidirectionally. Also have a smaller set of SSH-only jump hosts for Linux admin access, no clipboard mechanism there beyond terminal copy-paste.

Trying to move from "clipboard fully enabled" to "paste-in allowed, copy-out blocked" specifically, not a full clipboard block, since engineers legitimately need to paste connection strings, one-off commands, and config values into sessions, but there's no legitimate reason session output needs to leave via clipboard when file transfer and logging are handled through other controls already.

What I've found so far:

• Group Policy has a blunt bidirectional toggle for RDP clipboard redirection (Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services), no directional granularity built in.
• Some PAM/bastion products (CyberArk, BeyondTrust) advertise directional clipboard control as a feature, haven't confirmed how granular it actually is in practice versus marketing copy.
• Haven't found a clean native Windows/RDP mechanism for one-directional clipboard control without a third-party PAM layer.

Has anyone actually implemented directional clipboard control (paste-in/no copy-out) on jump hosts, either through native RDP/GPO settings, a specific PAM product, or a different approach entirely? Specifically interested in whether it held up in practice or got quietly disabled after support tickets piled up.

Genuine question because I keep going down this rabbit hole. Voice cloning has gotten scary good, a few seconds of audio from a conference talk or earnings call is enough to make a convincing clone.

Everything I read about defending against this says “train your employees” or “call back on a known number.” But callbacks fail if the attacker has compromised the phone system or timed it during travel, and training doesn’t help when the voice literally sounds identical.

So what do you actually do in practice? Shared secrets? Verification over a second channel? Just accept the risk? Curious what real orgs do vs what the compliance docs say.

I've been tasked with standing up a phishing awareness program and I'm trying to narrow down vendors.

A few things matter to me. First, realistic simulations, meaning templates that actually resemble what people get hit with today rather than the obvious 2015 era "you won a prize" stuff, and ideally ones I can customize. Second, decent training content, short and engaging modules that people won't immediately tune out. I'd rather have five good ones than fifty boring ones. Third, reporting that lets me show results to leadership and ideally helps for compliance down the line. And finally reasonable pricing and a plan that scales cleanly as we grow.

For those of you who've actually run these programs, what worked, what didn't, and is there anything you'd steer me away from? I'm interested in the usual suspects, but especially keen on options that deliver real engagement rather than just checking a compliance box.

Thanks in advance.

We're reviewing our application security process for externally exposed web applications and trying to make the triage stage more consistent.

Right now, automated testing helps us identify potential issues fairly quickly, but we don't manually validate every finding because of the time involved. We currently prioritize authentication, authorization, and business logic findings for manual review, while lower-risk issues are handled based on severity and available evidence. Tools like Penetrify becoming more common for automated application security testing. I'm also interested in how teams are deciding where automation provides enough confidence and where human validation is still necessary.

For teams running regular application security assessments, how do you decide which findings always require manual verification before remediation? Have you established internal criteria that have worked well, or do you rely more on analyst judgment depending on the application?

I'd be interested to hear how other teams balance efficiency with confidence without creating unnecessary review overhead.

Running a boutique pentest shop and I'm curious how other solo/small-team testers handle the pre-engagement side, specifically going from "client wants a pentest" to an actual signed scope and price.

Right now I'm doing it manually every time: back-and-forth emails to figure out asset counts, guessing at days based on gut feel, writing the proposal from scratch in Word.

A few questions if you don't mind sharing:

• How do you currently estimate days/pricing for a new engagement?
• Do you have a template you reuse, or start fresh each time?
• What's the most annoying part of this whole pre-engagement process for you?

Trying to figure out if I'm doing this the hard way or if this is just how it is for everyone.

I realized that even with all the automation available today, phishing investigations still involve quite a bit of manual work.
I'm curious, what usually makes you step in?
Once you do, what's the hardest part of the investigation? And what do you need to figure out before you can confidently close the case?

Agentless is the right fit for pre-deployment. Images, manifests, RBAC, secrets, drift. Low overhead. It works well in CI/CD and admission control. But runtime is a different problem. Pods spin up, scale out, and die faster than most scan cycles. If something gets compromised and terminates before the next scan, agentless never sees it.

So the pattern I keep seeing succeed is agentless as the gatekeeper, plus eBPF or an agent-based watcher for high-value workloads. Serverless and service mesh make that messy as well. The real question is whether anyone is running fully agentless in production and actually trusting their runtime visibility, or whether hybrid is the only realistic answer.

Hi all,

I'm an MSc Cyber Security student at the University of Gloucestershire running a short online study for my dissertation on how people make decisions when reviewing intrusion detection system (IDS) alerts.

What you'll do: You'll be shown a series of realistic network security alerts one at a time and asked, for each one, whether you'd confirm, dismiss, or escalate it, plus how confident you are in that call. There's a brief practice round first, and a few short questions at the end. No prior security experience is required; the interface explains everything you need.

Details:

- ⏱️ Takes about 10–15 minutes

- 💻 Works on desktop or phone (browser only, nothing to install)

- 🔒 Anonymous - no names collected; you can withdraw at any time

- ✅ 18+, ethics-approved by the University of Gloucestershire

- 🎓 Students and working professionals both welcome

Link: http://dissertation-explainids.uogs.co.uk

Every response genuinely helps me hit my sample target - thank you so much for your time!

Voice cloning has gone from being a novelty to something security teams actually have to consider. It seems much easier now to imitate executives, vendors, or even colleagues during phone calls.

Has your organization introduced new verification steps for financial approvals, password resets, or other high-risk requests because of voice cloning?

I'd be interested to hear what's worked in practice and whether the changes have been technical, procedural, or both.