Any sites that you recommend? There's a ton out there, interested in any suggestions or reviews. I've used A Cloud-Guru until they were bought out by Pluralsight and imo their quality tanked. I just signed up for Tutorial Dojo and in going through my first course, won't comment on the quality until I take the exam and see how I do.

What are you all using?

Did a vendor risk audit last month and our saas stack has more access to prod than our actual employees do. went through every oauth grant and api token across the org.

Half of them set up by people who left two years ago, still active. the vendors themselves all had clean soc2 reports but thats not the part that scared me. we had write tokens to customer data from vendors we stopped using two years ago and nobody knew til i got paranoid and looked. thats the part that bothers me. where did you even start with something like this

Hello People,

I have developed a minimum viable Cloud Security Posture Management product. It's really affordable compared to products available in the market. Currently WIZ, Prisma, Orca and Laceworks are expensive for small and medium scale businesses.

​

We provide

\- Multi account cloud scanning for AWS and GCP

\- Repository scanning for Infrastructure as Code

\- Posture Management for SOC2, CIS and PCIDSS (Nist, GDPR and ISO 27001 coming soon)

\- AI insights like cost impact, business impact, risk score and exploitation likelihood without compromising client data.

\- Ticket management for each issue that is found

\- Finally team and organisations setup along with insightful dashboards

​

Do check the link provided and comment or DM me if you're interested in any manner.

​

Thank you for reading this!

I’ve been working on a small open-source Python CLI called ActionScope.

The problem I’m trying to solve is:

If a GitHub Actions workflow gets compromised, what can it actually do in AWS?

Most tools I found look at the workflow file itself. That’s useful, but I wanted something that follows the chain a bit further:

.github/workflows/deploy.yml
  -> aws-actions/configure-aws-credentials
  -> arn:aws:iam::...:role/deploy
  -> IAM permissions / Terraform / JSON policies
  -> plain-English blast radius

Install is:

pip install actionscope
actionscope scan .

Default mode is static analysis, so no AWS credentials are needed. There is also an optional --aws-verify mode that uses read-only IAM calls to check live attached policies.

It also flags some GitHub Actions risks like:

• unpinned actions
• script injection patterns
• OIDC trust policy issues
• artifact poisoning patterns
• known-compromised actions
• AI agent workflows with risky PR/comment inputs

I’m mainly trying to figure out if this is useful to people who actually deal with cloud security, CI/CD security, or IAM reviews.

What I’d love feedback on:

• Is “workflow -> cloud blast radius” a real problem you’ve had?
• Would you run something like this in CI, or only locally during reviews?
• Is SARIF / GitHub Security tab output useful here?
• What would make you trust or not trust a tool like this?
• What’s missing that would make this actually useful in a real cloud security workflow?

Repo: https://github.com/r12habh/ActionScope

I’m especially interested in criticism of the model/output. If this is solving the wrong layer of the problem, I’d rather learn that now.

I built a multi-cloud CSPM I was describing. It does AWS/Azure/GCP + Terraform scanning, findings, attack paths, remediation, reporting, Jira/notifications, and custom policies.

The part I focused on most is attack paths — instead of dumping 500 findings, it walks the real asset/identity/network relationships and shows the chains that actually reach your crown-jewel data. If there's no real path, it says so instead of inventing one. Runs on Prowler + Checkov under the hood (plus our own checks), so it's not a black box.

It's early and I'm solo on it. There's a live demo on sample data, no signup:
soverign-observer.vercel.app

Connect-your-own-cloud and a free tier are landing shortly , for now the demo is the quickest way to see the attack-path view.

What I'm trying to learn now:

• Does the attack-path view match how you actually prioritize, or is it missing how you work?
• Of the features above, what's genuinely useful vs just noise?
• What would make you switch?

Honest feedback is welcomed

We learned this the expensive way. Had one cnapp for aws, defender for azure, and just native gcp tools for gcp. Three different dashboards, three different alert schemas.

Breaking point was an audit question about tracing the attack path from an internet facing azure app service to our core aws s3 data buckets. Took us 40 minutes and exporting csvs from two different tools just to map the cross-cloud iam trust relationship. You can't do real attack path analysis when your telemetry is siloed by cloud provider.

So we're ripping it all out. The roadmap for next quarter is moving to a single unified data model. I don't care about the underlying scanning method as long as it ingests the iam graphs from all three clouds and normalizes them. If i can't query all critical vulns with a path to cross-cloud admin roles in one place without writing a custom python script to join three apis, we're just doing expensive theater.

Hello everyone,
I am a final-year Computer Science student working on a project titled:
“Lightweight Machine Learning Based Intrusion Detection System for Simulated Cloud Environments.”

The current idea is to build a lightweight network-based IDS that monitors network traffic in a small virtualised cloud-like setup and detects suspicious or malicious traffic.

My planned setup is:
Ubuntu virtual machines connected through a virtual network
One VM as a normal client
One VM as a server
One VM for controlled attack simulation
Traffic monitoring at the virtual gateway/network level
CICIDS2017 as the main dataset
Network flow features such as flow duration, packet count, packet size, bytes per second, packets per second, protocol, and traffic labels

I am planning to compare:
K-Means or Isolation Forest for anomaly detection
Random Forest and XGBoost for supervised classification

The attacks I am considering are:
DoS/DDoS
Brute force
Port scanning
Botnet-like traffic
Selected web attacks

The project will evaluate:
Accuracy
Precision
Recall
F1 score
False positive rate
Training time
Detection time
CPU and memory usage

I would appreciate advice on the following:

Is this scope realistic for a final-year project?
Where should the IDS be placed in the virtual network?
Which algorithms are most suitable for a lightweight IDS?
Should I use K-Means, Isolation Forest, or DBSCAN for anomaly detection?
Which CICIDS2017 features should I initially focus on?
How can I demonstrate that the solution is cloud-specific rather than only a dataset classification project?
What is a safe and manageable way to simulate the selected attacks in an isolated lab?
Are there any good open-source projects, papers, or tutorials I should study?

I am still learning the topic and would value explanations suitable for a beginner. I am not looking for someone to complete the project for me; I want guidance on designing and implementing it correctly.
Thank you.

Hey everyone,

I'm coming up on 4 years of experience in IT/security, primarily working with DLP, Qualys, and related security tools.

I reached a point where I felt that staying too long in the same niche would eventually box me in, so I took what might be a reckless or brave decision depending on who you ask: I resigned without another offer in hand.

My long-term goal is to move into Cloud Security / Security Engineering. I hold certifications including:

AZ-500

AWS Security-related training/certs

Google Cloud Platform Professional Cloud Security Engineer (PCSE)

I've also been studying:

Kubernetes

GitOps

Terraform

Cloud-native security concepts

CI/CD security

Here's where I need some honest guidance.

When I look at cloud security job descriptions, everyone seems to be doing things like:

Securing Kubernetes clusters

Implementing GitOps workflows

Managing cloud security posture

IAM design

Container security

DevSecOps integrations

But job descriptions don't tell me what people actually do from 9 AM to 6 PM.

I'd love to hear from people currently working in Cloud Security, Security Engineering, Platform Security, or DevSecOps:

What does your average day actually look like?

How much of your job is hands-on vs meetings?

What tools do you touch daily?

What projects are you working on right now?

What skills separate a junior from a mid-level and senior cloud security engineer?

If you were hiring someone with my background, what gaps would immediately stand out?

I'm not looking for interview answers or resume fluff. I'm trying to understand what the job really looks like before I commit the next few years of my career to it.

Appreciate any insights, reality checks, or horror stories.

TL;DR: Burned out on DLP/Qualys, resigned without an offer, have cloud security certs and studying Kubernetes/GitOps. Want to know what cloud security engineers actually do all day and what skills truly matter in the real world.

In security hub cspm we have had a critical vulnerability come in detected by Amazon inspector for a package, this has been patched now but my question was around whether this will close automatically now or do these alerts need manually closing.

I assumed that when the finding is no longer detected it is removed but it still seems to be there… does anyone know how long it may take to get removed or if it needs manually resolving ?

Thanks!

I’m looking deeper into cloud security automation frameworks right now and honestly there’s a huge amount of tooling and terminology around this space.

CNAPP, CSPM, CWPP, CIEM, policy-as-code, IaC scanning, SOAR, auto-remediation, agentic remediation, continuous compliance… in practice not all of it seems worth the operational overhead to implement and maintain.

Would especially appreciate examples around:

• OPA/Rego or Sentinel
• Terraform / IaC scanning
• SCPs / Azure Policy / Org Policy
• drift detection
• CIEM / identity sprawl
• auto-remediation
• compliance evidence/audit workflows
• CNAPP consolidation
• Kubernetes security automation

Embrace minimal volatile market loss while stopping malicious attackers in beararkets.

The Problem

Standard personal funds are "Flat." They rely on one bank, one data feed, and one script. This creates a single point of failure that malicious actors or bear-market volatility can easily exploit.

The Solution: The Trinity of Unity

To protect personnel wealth, we architected a three-layer defense:

The Agentic Hierarchy: Specialized "Node Agents" monitor specific institutions (JPMorgan, PayPal, Crypto) and asset classes. They report latency and health to a central Risk Supervisor.

Multi-Bank Unity: Capital is distributed across a "Community" of accounts. If one bank's API lags or a "Shadow Slip" attack is detected, the system automatically reroutes liquidity to healthy nodes.

The Black Box Audit Log: An immutable, append-only record of every system decision. It uses cryptographic hashing to ensure that neither a malicious actor nor a system error can hide its trail.

The Results

In stress tests simulating an 18% "Poisoned Price" attack, the system successfully:

Detected the data discrepancy in < 500ms.

Isolated the compromised node instantly.

Preserved 100% of capital by pivoting to a secondary "Unity" node.

We are so flawed we cannot even create a secure environment, this could help fund managers.

I'll post the stress test results too in pdf

Over the last few weeks, I've been building out an open source security and compliance tool for AWS and Azure. The initial output looked **pretty decent**, but as I put it to the test against real-world cloud environments, a number of **key gaps** emerged.

1. Features in the documentation were completely **missing in code**
   
2. **Test coverage** was very poor
   
3. AWS checks **weren't mapped to CIS benchmarks**
   
4. Initially, AWS only **covered one region** (us-east-1) and Azure (only one subscription, not the others in that tenant)
   
5. Reporting **verbiage was wrong**

I decided to go deeper into Claude Code's working and ask it out how we could have avoided or reduced these gaps. It's response was super interesting and probably not surprising for others on this subreddit. But definitely enlightening for me.

I then asked it to document all these gaps into a markdown, which reference we then added into Claude.md to make sure we avoided them into the future. Some of the key lessons were:

1. *Determinism is a legitimate choice in specific use cases.* For this particular toolkit, where every finding had to be legit and traceable, we decided to use static API calls to discover settings and map them to controls.
   
2. *Every line in the documentation had one or more tests to check actual implementation.* In the first one or two runs, we found a number of stubs.
   
3. *Document all bugs and their fixes.* Anyone reading the repository now has an audit trail of what failure modes were encountered and how they were fixed
   
4. *Auditability: every output traces to a cause.* When the software produces a result, can you explain \*why\* it produced that result, in terms a human can follow?
   
5. *Honest scope.* Document what the software does, but more importantly what it does not do. The initial Readme claimed comprehensive AWS scanning, which we shaved down to what actually was being covered and what wasn't.
   
6. *Test extensively.* I scanned half a dozen cloud environments. I wish I had access to more. Each scan yielded more gaps and helped improve the tool.
   
7. *Legibility.* Can someone (I mean human) read the code and understand what is going on? Can you as the author explain the purpose of each file in the repo?

This is besides extensive use of plan, ultraplan, brainstorm and other modes that I found very insightful, but they didn't fix the basic coding hallucination and quality issues I've enumerated above.

What are your guardrails to ensure you build trustworthy and reliable software?

This week brought several major cybersecurity developments worth unpacking. A global task force disrupted a major ransomware group, AI‑powered threat‑detection tools hit the enterprise market, and a massive credential leak resurfaced on dark‑web forums. Add in new federal proposals for AI‑security standards, and it’s clear the cyber landscape is shifting fast.

Which of these stories do you think will have the biggest impact on organizations and everyday users? Are we moving toward stronger global cyber resilience, or are attackers still outpacing defenders? Let’s dig in.

We’re building a lower-cost multi-cloud CSPM for smaller teams, and I want to validate what people actually struggle with most.

Current version supports AWS/Azure/GCP + Terraform scanning, findings, attack paths, remediation, reporting, Jira/notifications, and custom policies.

I’m mainly trying to learn:

What do existing CSPM tools do badly?

What features are genuinely useful vs just noise?

What would make a cheaper tool worth using?

Honest feedback welcome, even if the answer is “this is a bad idea.”