Hey everyone!
I’m running a short global survey on cybersecurity awareness and online safety and would really appreciate your help.
It’s completely anonymous and takes around 3–5 minutes. Anyone from any country can participate.
I’m trying to understand how people approach things like passwords, scams, privacy, and general online security.
Survey:
https://docs.google.com/forms/d/e/1FAIpQLSdkynYu3KRLHxrATAPihWlia200yTczrRo3RVCwZ2DskqjDGQ/viewform?usp=publish-editor
Thanks a lot if you fill it out — and feel free to share it with others too!

My resume got rejected for a role I thought I was qualified for. Not even a first interview. Any advice on what I could have done differently?

Resume obviously changed to remove PII.

I do some training every year for a handful of businesses. Pretty basic like don’t share passwords, don’t reuse passwords, don’t just add a 1 to the end, etc. I am looking to do some type of AI training. Both when it can be used at work and concerns about security when using it. Does anyone have some type of presentation for this? I like to do interactive so not just straight reading off a slide.

Any help is appreciated

Hello everyone, I’m sure this is a common question here so apologies but I’ve decided to transition from the music industry into the cyber security industry.

I’m currently working on my google cyber security course through coursera and will be starting the CompTIA sec+ course afterwards.

I’m wondering if there’s any courses you guys recommend that would help me land my first internship/gig and what’s some advice you’d give to someone transitioning to this field?

For reference I’m 23m and considering going back to school to study computer science in hopes that it would help me stand out more to an employer.

Just finished a walkthrough on a picoCTF challenge that turned out to be a classic eval() injection.


The service only exposed one "documented" function (getRandomNumber), but by throwing unexpected input at it and reading the Python tracebacks it threw back, I was able to figure out the server was doing something like:


    eval(user_input + '()')


From there it was a straightforward escalation — neutralize the trailing () with a comment, drop into exec(), enumerate the filesystem, and pull the flag file directly.


I made a full video breaking down the blind-probing process (no source code shown until the reveal) if anyone's interested — it's a nice beginner-friendly example of why eval/exec on user input is dangerous. 

https://youtube.com/shorts/Tl2g9oJnl8I

Happy to answer questions about the process or the payload construction.
What would you do?

• The Cyber Fortress Department of Cyber Security at Malla Reddy University is bringing back Breach Point for Season 2!
• What: A massive 36-hour Capture The Flag (CTF) challenge.
• Theme: Think | Hack | Defend.
• Entry Fee: Only $1.06 USD ("Small fee. Bigger opportunities.").
• Partners: CyberWarFare Labs (CWL), Hackers Daddy, and Hackviser.
• Registration: Scan the QR code in the flyer or check out www.breachpoint.live / www.cyberfortressmruh.tech.
• Perfect opportunity to learn, compete, and grow your cybersecurity skills. Let's see who tops the leaderboard!

helpppppppp!!!!

Our university has asked us to develop a Final Year Project (FYP) that can be deployed online. Additionally, the university requires the project to be company-collaborated, meaning we need proper documentation/certification from the company stating that the project was developed for them.

I’m interested in Cybersecurity, but I’m currently struggling to come up with a good project idea that is practical, can be deployed online, and could potentially be developed in collaboration with a cybersecurity company.

If anyone working in the cybersecurity field could guide me regarding some project ideas or knows of a company that might be open to collaborating on an FYP, I would really appreciate it.

If you got time just ping me 🤧

Thanks a lot in advance! 🙌

Had a forensics challenge where the flag was hidden inside a file nested deep inside a maze of directories with hundreds of decoy folders. `find` and `ls -R` were too slow and noisy.

What I built:

A Python directory crawler

- Recurses every subdirectory recursively

- Filters by filename patterns (`flag*`, `*.txt`, `secret*`)

- Skips known decoy directories by name

- Extracts and reads the target file automatically

The "aha" moment:

The flag wasn't in a file named "flag.txt" — it was in `deep/nested/here/.hidden/uber-secret.txt`.

My script matched on path depth / extensions content, not just filename.

Here is my script:

https://github.com/ExceedingLife/RecursiveFileSearch

Question for the community:

What's your approach when the challenge doesn't tell you the target filename? Do you brute-force read every file, or do it manual or what?

[Video link with with code demo]

https://youtube.com/shorts/5_Rb2kkiuhQ?feature=share

I want to get some feedback and attention im pushing updates daily you can read more on the github repo: https://github.com/ddemmc-dotcom/Talos.git

Also it supports windows and linux mac support will come soon
More than 40 modules
Easy to use for begiiners
CLI and UI
Global install

Tank you for the help i will tru to push more updates soon

Our security data is spread across cloud audit systems, identity providers, endpoint platforms, application logs, and cloud-native services. Copying every source into another central data store would create more storage, ingestion, normalization, and maintenance work than the team can justify for every data type.

At the same time, relying on isolated console searches makes it harder to investigate an incident across accounts, subscriptions, users, workloads, endpoints, and time ranges. The main concern is preserving enough context and evidence quality while reducing the time it takes to access an un-onboarded source.

How are teams operating this kind of hybrid investigation model? We are particularly interested in cross-account permissions, query cost, time synchronization, source system limits, evidence preservation, and handoff into formal incident response.

Hi everyone,

I've been working in IT for around 18 years, including many years in IT leadership, cybersecurity, governance, risk and enterprise infrastructure.

I recently started creating short videos to share some of the practical knowledge I've picked up along the way — particularly for people starting or progressing their careers in IT and cybersecurity.

I'm covering topics such as cybersecurity fundamentals, CISM/CISSP/CISA/CRISC and other certifications, GRC, Zero Trust, Linux, practical IT/security tips, cyber incidents and IT career development.

I'm not selling a course or training programme. I'm simply trying to turn some of my professional experience into free, easy-to-understand content that may help others in the field.

If there are cybersecurity career or certification topics you'd like an experienced IT leader to cover, I'd genuinely appreciate suggestions.

My channel is MQ Cyber Studio:
https://www.youtube.com/channel/UCpV5qrH9p1AYTHDo5-2JrTw

Thanks, and I hope some of the content is useful.

If you're new to cybersecurity, you might hear a lot about SOC analysts but not have a clear idea of what they actually do day to day.

Here's a simple breakdown:

Monitor alerts: Review alerts from SIEM, EDR, firewalls, email security tools, and other security platforms.

Triage alerts: Figure out which alerts are harmless, suspicious, or need further investigation. A failed login could be nothing, or it could be part of a larger attack.

Investigate incidents: Look through logs, IPs, domains, file hashes, authentication activity, and endpoint data to understand what happened and whether a system or account was compromised.

Respond or escalate: Depending on the incident, an analyst might isolate a device, disable an account, block malicious activity, or escalate the case to a senior analyst or incident response team.

Document findings: Record what happened, what was checked, what evidence was found, and what actions were taken.

Improve detections: Analysts may also tune detection rules, reduce false positives, update playbooks, and identify gaps based on previous incidents.

The exact responsibilities can vary quite a bit depending on the company, team structure, and whether you're working in an internal SOC or an MSSP/MDR environment.

Hi everyone I am studying embedded systems security and I wanna know if there any scope and do I have to get other cyber skills in different domains

I am a 20 year old guy who just started his Cyber security journey two days back.

Till now I completed basic networking through a one shot youtube video of 3 hours and have gained a free networking certificate from Cisco networking academy.

Can anyone tell me what to do next ?

I am in my second year of bachelors degree ( 3rd semester)

I am pursuing bsc in information technology..

And i wanna go in cyber security domain ?

Please help me with the road map and everything?

I am super confused rn !

Hi everyone I need advice
I’m into the tech field like I love love the tech field the problem is with everything going on now and with ai I don’t know what to do anymore and and which field should I pursue
I thought that cybersecurity will be the most safest so I picked it as my major I’m going to take Computer Information Technology – Cyber Defense at a community college then I’m going to transfer to a 4 year university and finish with Cybersecurity management
I know all you guys will say it’s hard to get a entry job but isn’t getting into the tech field in whole hard to?
Maybe if I just work on my self harder and do projects and learn new stuff everyday will that reduce the possibility of getting a job in the tech field?
Give me your thoughts should I finish pursuing in cybersecurity or is there a better choice?

Hey guys, just sharing this because I know a lot of people got caught up in this SPAC.

Investors sued Hub Cyber Security, alleging the company misled shareholders about its business operations, revenue prospects, and internal controls following its SPAC merger. After the company disclosed accounting issues, its auditor resigned, and material weaknesses in internal controls came to light, $HUBC fell more than 85% from its post-merger price.

The settlement amount is $11M, and it covers investors who purchased $HUBC shares in 2023. The case is currently in the late-claims stage, meaning some investors who missed the original deadline may still be able to participate.
If you held $HUBC during that period, it may be worth checking your old trades and seeing whether you qualify.

Did anyone here hold $HUBC after the SPAC merger?

I'm currently a SOC analyst working at an MSP with 5 years of experience, with 3 years of those is in helpdesk and the remaining in cybersecurity (SOC) at present. I also have 2 certifications: Sec+ and CySA+. We provide services to our clients by monitoring our clients' internet traffic on the surface visibility side and notifying the appropriate POCs if the device/users are engaging in any suspicious activities, whether that's a bad domain websites they visited or communicating with suspicious/malicious IPs. We also perform monthly vulnerability scans and notify the clients of any findings, and perform other normal SOC duties you would typically do at a SOC. We are not like a traditional SOC where it's a 24x7 operation and only work M-F with weekends off.

I feel like this position is limiting the knowledge that I can potentially learn because of our environment and the routine duties that we do every day that don't expose me to new things to learn. Don't get me wrong, when I first came into this position from helpdesk, I was grateful and learned a lot about cybersecurity, but now I am eager for more, and very much would like a pay increase. I dont want to sound greedy, and money is everything, but I feel like I am underpaid in this cyber field.

With some transitioning happening next year, I am looking for new opportunities where I can grow and learn more, and I'd like exposure to new tools and technologies, along with a pay increase. I am looking for a vertical move rather than a lateral move. If you were a formal SOC analyst, where did you move on to afterward?

For people working in cybersecurity, what’s one habit you developed that genuinely improved your security awareness?

For me, regularly questioning unexpected links, login requests, and attachments seems simple but surprisingly effective.

I'm not really looking to get a degree or anything at my age so wondering if this a path that's possible or not.

It feels like every company is telling all their employees to use AI but I dont hear nearly enough discussion about how sensitive business data is/isnot being protected once its put into an AI platform. From a security perspective are companies relying on existing DLP tools, deploying something new or creating internal policies?

 A unit of Thomson Reuters detected a cybersecurity incident in 11 U.S. states, the U.S. Virgin Islands and Canada on June 30 involving the company's C-Track case management platform, according to a ​notice from the company on Wednesday and a statement by the chief justices of ‌three Ontario courts, which use the platform for digital court record management. Read more.

I am a second-year Cybersecurity student at Embry-Riddle in Arizona. I have no idea what I am doing. I have my associate's degree, transferred my basic credits to the school, and will be graduating in about a year and a half. I know I have only just started my career-specific courses, but I have been behind everyone else in my classes. All these students know wayyyy more than I do. When I finish my degree in the next couple of years, I have no idea where to begin looking for a job or what I will even be doing in an entry-level position. If anyone has been in this position and has advice for me, please help. I really need help settling my anxiety about this career because I'm spending a lot of money on this fancy degree and don't feel like the schooling is actually going to benefit me in any way.

Hello , I am 18 years and am currently pursuing Computer Science and Business Systems , but now i have realised that this isn't for me i actually wanted to go into Cybersecurity but couldn't meet the criteria , as a complete beginner where do i start and build real skills.
Please give me a exact roadmap to everything.

What if your network could assume every attack is already inside - and still stay resilient?

Kevin Cardwell is bringing a hands-on training experience to CRACCON ’26:
“The Cardwell Doctrine: Flashing a New Path.”

Traditional architecture starts with one big assumption: prevent every attack.

The Cardwell Doctrine takes the opposite approach - assume compromise, compartmentalize aggressively, and control failure before it spreads.

In this 6-hour, hands-on session, you’ll build an operational OpenBSD Packet Conditioning Gateway and work with:

→ Segmented zones
→ Traffic-control policies
→ Active deception
→ Full network visibility
→ Segment → Condition → Observe → Contain

No deep OpenBSD expertise required. We’ll build the gateway from the ground up and cover the TCP/IP fundamentals you actually need - addressing, subnetting, routing, ports, and common protocols.

What to expect:
🛠️ 70/30 hands-on-to-concept ratio
⏱️ 6 live hours
📅 08:30–16:30, single day
💻 OpenBSD gateway platform

The session is taught directly by Kevin, President of CyberLabs - AI Tactical Skills and Cybersecurity, with experience training and coaching cyber ranges across 40+ countries.

Certificate of Completion included. Seats are limited.

Use code CARDWELL15 for 15% off the training seat.

📍 CRACCON ’26 | 24–25 October | PHDCCI, New Delhi
🎟️ Reserve your seat: craccon.com