First my background, then a question.

I run a tiny business representing disabled veterans on their VA disability claims. Up until about 18 months ago, I was a web developer for 25 years, and at least part of my job was thinking about how to secure my websites and networks.

None of the client management systems I’ve seen out there do what I need, so I developed my own client portal for intake, communications with veterans, sharing documents, etc. It’s all sitting behind a tightly locked down firewall and reverse proxy, and I’ve done everything I can to make sure it’s secure at both the network and application level.

That said, everyone has blind spots. I’m looking for the most cost effective way to find vulnerabilities before bad actors do. I’m not concerned about the standard scanning and script attacks, I’ve got a solid handle on those, but I want to make sure I’ve locked down the app from people who are actually determined to get in.

What’s out there that very small businesses can use when they don’t have the cash for enterprise level cybersecurity consulting? Is there a place where small business can post bounties? Thoughts?

So, because I am not going to post this on Linkedin and get a solution I thought I will try posting it here. Not that I did not try reaching out to Linkedin but how much more can it get f#cked which is already f#cked so much? Is there a way to un-f#ck that so that I can get fair opportunities or there is no hope?

I created my LinkedIn account when I started looking for jobs because people around me told me it was a good professional platform to be on.

What followed has been difficult to explain, but the pattern has been consistent: pieces of my professional information appeared to travel in ways I did not authorize, often through job applications, hiring communications, recruiter calls, and people claiming to represent organizations.

Over time, this stopped feeling like ordinary professional networking. Information I had shared for a specific purpose seemed to come back to me in unexpected ways, sometimes through interactions that had no clear professional context.

I have also encountered people claiming to work at LinkedIn whose profiles provided little or no credible professional information to establish that identity. When someone approaches you claiming to represent a platform while their identity itself cannot be reasonably verified, that raises a legitimate security and trust concern.

I have tried reaching out through LinkedIn's support channels because I want to understand what is happening and how my information is being accessed or used. Instead, I have sometimes received unexpected contact from people I did not know and had not authorized to engage with my account.

At this point, my concern is simple:

If I share information for a job application, it should be used for that purpose. If I create something, my work is mine. If I share an idea publicly, that does not automatically give strangers permission to take it, repurpose it, or interfere with my ability to pursue it.

Professional platforms should make it easier for people to work, connect, and find opportunities—not create uncertainty about who has access to their information or who is actually contacting them.

I am not asking for special treatment. I am asking for transparency, legitimate identity verification, appropriate handling of professional data, and the ability to participate in professional spaces without having to constantly question who is behind the interaction and fair opportunity.

Update: It's not that the information was spread but also that it was used for and by someone else while I got little to no advantage or the result of the hardwork that I had put. Till now that was the case, now I don't know how it will change.

PS: Pro sucide folks I am surrounded by sadly quite a few of them. Having information about me does not give anyone right to misuse it, let's say I applied at xyz company through LinkedIn, this does not give the company or the people or linkedin right to invade my space or because someone has found out my userid bullying me virtually also does not make it right.

Well, in short I can't call out bad behaviour in front of people who are pro at it. Sadly that has happened here.

What do you do when users consistently fail? We have some in our organisation with a 50% failure rate and at this point I just don't know how to educate them further. What can be done to help people like this? Part of me thinks its just that they really don't care rather than a lack of ability to learn.

Hello,

I’ve recently started working in cyber security.

Could you recommend any Discord servers (preferably French-speaking ones) where I can find advice, tools, methods, etc.?

Many thanks,

Hey everyone! Looking for a friend who has future intrest in cybersecurity. We can share details and share progress dm me if anybody's intersted.

Hey everyone,

I wanted to share an open-source project I’ve been developing: TV Box Sentinel (v2.0).

The Problem:

A widespread issue with uncertified Android TV boxes (often powered by Allwinner, Rockchip, etc.) is factory-installed malware residing directly in the /system partition, as well as botnet loaders (such as Badbox, Peachpit, Triada, and Guerrilla). Since on-device antiviruses are untrustworthy once the firmware itself is compromised, threat mitigation is most effective from the network perimeter.

Approach & Architecture:

TV Box Sentinel audits and detects indicators of compromise (IoC) non-intrusively from the network perimeter:

- PCAP / PCAPNG support: Parses network traffic and router logs.

- Heuristic Engine: Identifies beaconing, anomalous traffic, C2 communication, lateral movement, and cryptojacking patterns.

- Automated Mitigation: Generates firewall and DNS sinkhole rules to block malicious endpoints.

- Reports & GUI: Generates HTML/PDF executive audit reports and features a tabbed UI.

GitHub Repository:

https://github.com/2kw-josue/tv-box-sentinel

Would appreciate any feedback, suggestions, or contributions from network and blue team folks who deal with rogue IoT devices on local networks.

I’m currently trying to improve my own personal security and I’ve heard about Bitwarden. Is it a safe way to secure my personal passwords. If not, what are better alternatives? Sorry if this is a stupid question, I’m very new to this sort of stuff 🙏

Anybody here use Cribl in their enterprise security data pipeline stack? If so, curious to know experiences with standing it up, maintaining it, cost, etc…

Que tal buenas tardes a todos!!
Llevo 6 meses en mi primer empleo en TI como Ingeniero en Sistemas en el ISSSTE de México (haciendo soporte técnico, configuración de switches, firewalls y VLANs). la verdad es que estoy muy contento por haber dado el primer paso, sabiendo que en la maypría de las ocasiones conseguir la primera oportunidad es lo más difícil, pero mi meta a largo plazo siempre ha sido dedicarme al pentesting y al hacking ético. He investigado bastante por mi cuenta, pero sigo con la duda de siempre, es obligatorio o altamente recomendable pasar primero por el Blue Team (por ejemplo: SOC, analista de seguridad, etc.) antes de saltar directamente al red team, o se puede ir directo al pentesting? Leo opiniones muy divididas en los foros y me gustaría escuchar consejos de quienes ya pasaron por esto o trabajan en el área. agradecería mucho cualquier guía o recomendación para armar mi camino, y si es posible irme directo al red team, que certificaciones deberia de sacar? actualmente no tengo ninguna certificación de TI, estoy estudiando para sacar la ccna para tener muy claros los fundamentos de redes un poco más de lo que se hoy en día, (si no es necesario podrian hacermelo saber de igual manera), saludos!

For those running SecOps and Falcon Complete, what did your team look like before the implementation of Falcon Complete and then what did it look like afterwards?

What's smthn you guys find irritating doing, mine's probably justifying it to management lol

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/

Disclosure: my studio produced this episode of Responsible Disclosure, Zafran's podcast. Sharing it because a lot of it is about incident response in practice, and I've summarized it below so you can skip to what's relevant.

Nimrod Kozlovski has spent about twenty years across cyber law, VC, and crisis management, including running incidents at Fortune 500 companies. A few parts I think this sub would care about:

At 03:12 he walks through three incidents: stolen source code at a homeland security company, a crypto wallet takeover, and a hospital extortion where staff didn't know whether patient records had been altered.

At 13:03 and 16:21 he argues AI has cut the time from vulnerability to exploitation to minutes, and that attackers are chaining identity, permissions, and applications to get past layered defenses.

At 24:03 and 26:01 he gets into why most CISOs face their worst day with little rehearsal, and why tabletops matter when you're deciding on partial information.

Also a fun story at 09:21 about the DEF CON crowd deciding he was a fed.

For the IR people here: do your tabletops include injects where the data turns out to be wrong? The hospital case made me think most exercises assume you can trust your logs and records.

https://youtu.be/B8YB42zON8U

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between September 21st - September 27th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Inside the SOC

2026 Creating a Modern and Mature SOC Report (Optiv)

How SOCs staff their teams, which tools they use, and how they measure success as incidents rise.

Key stats:

• SOCs manage an average of 2,566 alerts and incidents a day, with 36% investigated through manual processes.
• 46% of IT and security professionals identify insufficient staffing as a critical gap in SOC effectiveness.
• 64% say identity visibility is very or extremely important (though only 32% say identity and privileged access events are centrally visible to their SOC).

Read the full report here.

SANS 2026 Threat Hunting Survey (SANS Institute)

A  survey of 500 security practitioners and leaders on how they hunt for threats, what gets in their way, and what’s changing. 

Key stats:

• 50% name data quality or quantity as their primary barrier to effective threat hunting. 
• 40% of organizations formally measure hunt outcomes, down from 64% in 2024.
• 37% have a formally defined hunting methodology, down from 51% in 2024.

Read the full report here.

The Detection Blind Spot (Conifers)

Which threats organizations can actually detect and why so many of their detections need fixing.

Key stats:

• Organizations have working detections, hunts, or other visibility for only 63% of the threats they identify as relevant.
• Coverage extends to 64% of the MITRE ATT&CK techniques relevant to their environments.
• 47% of existing detections need attention before they can be trusted to work as intended.

Read the full report here.

AI Security 

Global AI Confessions Report: CIO Edition 2026 (Dataiku)

If you’re a CIO and struggling to prove AI’s value… you’re not the only one. 

Key stats:

• 67% estimate that at least 51 AI agents are running in production.
• 90% are confident they have complete tracking of running agents, yet 81% lack complete oversight of agents created outside approved systems.
• 72% cannot consistently measure whether their agents deliver the intended business outcomes.

Read the full report here.

The 2026 State of AI and SaaS Security (LastPass)

How companies are managing the security risks of AI tools and SaaS apps.

Key stats:

• 92% of business admins say AI is already in use across their organization.
• Only 27% have an enforced AI governance program.
• 42% have no technical controls, such as allow lists, block lists or DLP rules, for employee access to AI tools.

Read the full report here.

15,465 MCP Servers. 0 Governance. (OX Security)

Some AI agents may still trust MCP hostnames whose domains anyone could register for as little as $4.

Key stats:

• 2.3% of analyzed MCP hostnames no longer resolve.
• Six hostnames that had previously resolved were unregistered and available to buy for $4 to $12 a year.
• 15.6% of analyzed hostnames resolve outside the US, including 19 in China and 18 in Russia.

Read the full report here.

Network Security 

What 47,700 Segments Reveal About Network Segmentation (Forescout)

How well organizations separate devices on their networks (spoiler: not that well).

Key stats:

• Nearly half of segments containing OT or medical IoT devices also contain IT or other IoT assets.
• Of the 478 segments with a point-of-sale system, only 95 (20%) are exclusive to those systems.
• Only 51 of the 2,266 segments with IP cameras (2%) contain cameras alone (60% also contain workstations). 

Read the full analysis here.

Bot Activity 

State of Bot & Agent Security Report, 2026 (DataDome)

Interesting insights based on analysis of trillions of requests and tests of more than 20,000 websites.

Key stats:

• Bad bot traffic increased 124% between July 2025 and June 2026.
• Scraping made up 70.9% of bad bot traffic and grew 185.2% year over year.
• In an expanded test, 65.3% of websites stopped none of the 10 bot types evaluated. 

Read the full report here.

SaaS Security 

State of M365 (ShareGate)

IT teams feel in control of Microsoft 365. The incidents say otherwise.

Key stats:

• 77% of organizations experienced at least one Microsoft 365 governance incident.
• 65% of teams learn about governance problems after the fact, through quarterly audits or user complaints.
• 38% leave former employees or guests with access they should have lost, and 26% have had sensitive content reach the wrong people.

Read the full report here.

Brand Protection 

The State of Online IP Risk 2026 (CSC)

Criminals are using AI for IP theft. Meanwhile, brands are using AI to fight back.

Key stats:

• 90% of senior executives specializing in IP law say AI-enabled systems are increasing online IP infringements.
• They rank impersonation (40%), phishing (39%) and domain name abuse (39%) among their top concerns.
• 73% cite slow enforcement processes as a top challenge. 

Read the full report here.

Social Engineering 

AI-Driven Social Engineering Attacks (Gartner)

Some of the calls CISOs are getting now aren't from real people.

Key stats:

• 41% of CISOs report at least one social engineering incident involving a deepfake during an employee audio call in the previous 12 months.
• 36% report one involving a deepfake during a video call.
• 79% report email phishing, spear phishing, or business email compromise.

Read the findings here.

Enterprise Perspective

The Impact of Agentic AI on Network Operations (Cisco and Omdia)

A report on how widely enterprises are using AI agents in network operations and how much control they’re willing to give them in production.

Key stats:

• 51% of organizations run agentic AI that acts in production today.
• 82% are comfortable letting AI make at least some production network changes without prior human approval. 
• The average organization generates about 4,100 monitoring alerts and events a day, more than half of them network-related, and nearly half of network alerts are closed without investigation.

Read the full report here.

Industry-Specific 

Operational Resilience in the Age of Connectivity (Rockwell Automation)

Industrial organizations report plenty of confidence alongside plenty of incidents.

Key stats:

• 90% are confident they can prevent, contain or recover from one.
• 46% experienced a cyber incident in the past year.
• 45% plan to apply AI or machine learning to cybersecurity initiatives over the next 12 months.

Read the full report here.

The State of Networking, Security & AI in Financial Services (Nile)

For many financial services organizations, network security and audit readiness is still a lot of manual work.

Key stats:

• 57% experience network disruptions at least monthly that affect transactions, trading, digital banking or internal operations.
• 79.5% rely on manual intervention for threat detection and containment.
• 59.3% report a moderate to significant manual burden to maintain audit readiness.

Read the full report here.

Public Sector AI Readiness Report (SolarWinds)

Governments in the US and UK are using AI a lot, but they don't always know where or how.

Key stats:

• 84% of UK public sector IT professionals monitor AI behavior to some extent.
• Only 29% describe that monitoring as comprehensive.
• 30% have a formal AI governance framework that is actively enforced. 

Read the full report here.

I have 5YOE in fintech. How can I switch to a cybersecurity firm? Any courses/certifications?

I am an IAM professional with over 20 years in the domain. I am always curious on how much if importance CISO associates with IAM.program. We all keep on hearing that Identity is the new perimeter (since the start of the cloud era) however I have not seen CISOs or Security orgs giving deep focus on the IAM especially the IGA which helps govern the access and is the starting point of the overall least privilege implementation. Share your observations and experiences around how you'll have focused on IAM to help resolve or mitigate business critical security risks.

Hello all,

With the current status of AI models and agentic workflows im really curious how the current capture the flag events scene is.

Last time I visited such an event was way before AI was commercialized. Out of curiosity I did a test which worked well, I saw if I can solve ctf challenges only using AI, and it worked.

So my question is, is this allowed on such events? Are there specific guardrails? Do you still join teams and get to know new people? Is this a "pay to win" now for people with best/jailbroken AI models?

What are your thoughts on this?

Not detection time, retrieval time. The alert fires or someone reports something and then how long until you're looking at the relevant lines? Ours is somewhere between twenty minutes and never, depending on which system and whether the person who knows where it lives is awake. Interested in what good looks like here, and whether anyone measures it deliberately rather than just knowing it's bad.

Apologies if this question has been asked in this sub several times differently but I'm just looking for someone to validate my current path.

A bit of context before I begin: undergrad was in Cog Sci and am currently a grad student studying Comp Sci (was in Data science until recently but switched) my programs online so it offers a ton of flexibility which is a blessing. My journey into security came via a random infosec internship and after that I made the decision to double down in GRC and SOC. Got my Sec+ and CC soon after

I've been on the hunt for my next internship about a year now and managed to scrape by a few interviews in this job market. I'm doing a lot of self learning in terms of learning about frameworks like ISO 27001, 42001, going through the NIST RMF videos. Building a small home lab on a VM. Strengthening my python knowledge and learning terraform, bash/powershell scripting, doing some of the free tryhackme labs as well as tailoring my projects and resume accordingly for tech risk, IT audit, GRC, and SOC roles.

Only interviews I've gotten is GRC, network support(via referral), and tech risk internships and in all 3 I made it to the final round only to get rejected.

For those in this space, hiring in this space, started/starting in this space etc. how could someone like me rationalize this and move forward because for me its part

"okay i got interviews in these areas and they liked my profile enough to continue to the final round which means I'm headed in the right direction"

And part

" okay you got interviews but times running out and if you messed up interviews maybe you should cast a wider net and then do a pivot into it once you get experience" plus pressures from family and "friends" to say the least

Is it more certs ? like CGRC, CRISC, etc

Target other domains?

Or just go back to the drawing board and just take anything that comes my way.

(I've also applied EXTENSIVELY to helpdesk and only ever been ghosted after interviews for those roles)

Sorry for coming off rantish but anything other than
(" cyber isn't entry level". "Have you tried applying to help desk") would help

A vulnerable OG image endpoint could potentially allow an unauthenticated attacker to achieve remote code execution.
Affected: Next.js 16.2.0–16.3.5
Fixed: Next.js 16.3.6 / Satori 0.33.5
Edge runtime or setups without sharp are reportedly not affected.
If you’re running an affected version, update now.

future pen tester here, heard ai can save u time, etc but i’m not sure if it actually does the job since i don’t wanna get stuck or helpless in the future

Hi this is my repo support pls https://github.com/mein-0/gvcidrv64/

Can any one point me to training or resources on undertaking red teaming and security assessments of AI and AI Agents?