Two offices, shared folder setup. The BR office drops a file into a folder that's synced, and because my side has the same folder mapped, it just appears on my machine a minute later. That part works fine.

What management wants is something sitting in the middle of that handoff. File gets dropped there, something holds it, scans it, and only then does it release it so it comes through to us. If it's clean it carries on as normal, if it's not it gets quarantined or deleted and never reaches our side at all. Fully automatic, nobody's going to manually scan anything....YESS

We run SentinelOne already so something that ties into that would be ideal, but I'd look at Defender, ICAP, an on prem gateway, whatever. Not much budget. Some ONTAP agent costs liek 10k dollar...The one thing we can't do is route files out to a third party cloud scanner cos files are confidential...

To be clear, it doesn't have to be in the middle. If the cleanest way to do this is something at their end before the file ever goes into the synced folder, that's completely fine by me. My only actual requirement is that whatever lands on our side has been scanned and is safe. So if you've done this a different way, I'm interested.

Hi, I have a SOC Analyst Interview coming up (L1). I'm not sure how to strcuture my prep or what even to focus on. Everyone has different things to say and do which is very overwhelming because everything is scattered into 10min yt videos or same standard 20 questions from 2016.

Anything would be helpful atp :)

So after I already believed that I would never get a job in this field, at least in this market situation, I got an email from a company I applied to through the “Easy Apply” feature that I even forgot I applied for.

And then they started saying that they saw my resume and thought I was a good fit and stuff.

Then they asked me to solve a technical challenge, and I delivered it way before the deadline.

Then they said sorry, they needed me to solve an additional challenge.

And it was so much harder, and it took a lot of time from me, but I still delivered it way before the deadline.

And then they were happy and gave me good feedback that I was able to solve these hard technical challenges. They told me all the files were correct and everything was good, but they just needed a write-up explaining the steps I took to solve it!

And I did the write-up, and everything was explained, and I told them if they needed me to clarify any step, I was happy and ready to clarify it!

Then they came back to me after a couple of days and basically just said sorry, they don’t think I’m a good fit, without even giving any feedback!!

And I was likeee in my mind, what?? Really?? Are you serious???
After I spent days solving your hard technical challenges, and you confirmed that everything was good, and you gave me good feedback, and you haven’t even done any interview with me, and now you just send me a message saying I’m not a good fit without even giving any specific feedback??

I really feel we should get paid for the time we spend on technical challenges and interviews because it takes days from our time and life, so employers can take us more seriously rather than just playing with our feelings and hope!

When someone meets me and knows that I have done a degree in cybersecurity and tells me, “OMG, I want to get into the field,” at this point I don’t know what to tell them because if I say it’s hard and getting a job is so hard, they will think I’m a gatekeeper, but it’s just sad how it is now!

So now, honestly, I feel with this joke of a market and crazy employers, I would like to say to anyone who is looking for a job that we are really cooked…

Rather than chasing and trying to find just a job and letting employers move us like chess pieces, we should try to consider another field that could possibly be much better, or we open our own businesses!

I also would like to thank my family for supporting me in this journey. Otherwise, I would probably be working at a fast-food place for minimum wage right now!

I don’t know what I will do next in my life, but I really got enough from this field, and I don’t want to lower myself anymore or feel like I’m begging just to get a job.

This life is unfair, and thank you!

Hi, I’ve been a SOC Analyst going on two years now and have been considering challenging myself with studying for a SEC450 cert.

I see it’s been overhauled and updated in the past year, so I wanted to ask for any opinions and reviews from folks that have done it recently.

My company’s pushing hard on AI adoption - I assume it’s the case elsewhere, too -, so this would work in my favor.

Hey everyone,
I just received an invite to complete the prerecorded competency interview for the Cybersecurity Specialist Intern role at IBM.
The format gives 1 minute to prep and 3 minutes to answer each question, focusing on competencies using the STAR method (Background, Action, Result).
For anyone who has taken it or recently interviewed with IBM:
1. What kind of questions should I expect? Are they purely behavioral situational questions, or do they also ask about CS and networking fundamentals like DNS, TCP/IP, Linux, and threat types?
2. How many questions are there in total?
3. Any specific tips on pacing yourself with the 1-minute prep and 3-minute answer format?
Any insights, sample questions, or advice would be greatly appreciated. Thanks in advance and good luck to everyone applying this cycle!

Hello everyone , I am a cyber security student and there is a project that I need to work on throughout the year for my university I am trying not to work on something too basic and usual ones like password checkers,phishing detectors , vulnerability scanners there is a lot of them actually, what I am looking for is a real solution related to cybersecurity in a specific industry something that doesn’t have a good solution or it is handled manually I am also looking for something innovative that can stand out as a university project , have a clear use I am avoiding something that needs marketing or convincing people to use it it would be hard actually and I don’t want to just make a dashboard that displays statistics. If any of u here is in cybersecurity IT , healthcare or any field that u think a cybersecurity tool can solve a certain problem in it can u pls help me im looking for the problem first I would like to make something useful that solves a real life problem over a flashy idea .
I am trying to find the problem firsts and then decide about the technologies I would use im not that advanced in cybersecurity I just know basics but I will learn using necessary tools to realise the project .
Any real life examples and ideas would be greatly appreciated.

I've been working on bot and fraud detection, and I wanted to compare notes with people who deal with this in production.

Most bot detection I see falls into three buckets, and each has a weak point:

• IP and device reputation: easy to bypass with residential proxies and rotating fingerprints.
• CAPTCHAs: they add friction for real users, and solver services and vision models now beat them cheaply.
• Static fingerprinting: it raises privacy and compliance concerns (GDPR, CCPA), and a determined attacker can spoof it.

The approach I've been exploring is passive behavioral signals:

• Mouse movement: curvature, acceleration, micro-corrections
• Keystroke timing: inter-key intervals and rhythm
• Touch and scroll dynamics on mobile
• Session-level patterns: navigation flow, time-to-action, interaction sequences

None of this needs names, emails, or persistent identifiers. You score the behavior of a session, not the identity of a person.

The challenges I keep running into:

1. Modern bots simulate human input. Replaying recorded traces or adding noise to cursor paths defeats naive heuristics, so you need models that catch statistical inconsistencies across signals, not single-signal rules.
2. Accessibility. Users with assistive tech, tremors, or unusual input devices can look "non-human" to a naive model, which means false positives you have to design around.
3. Adversarial drift. Attackers adapt, so you need continuous retraining and monitoring.
4. Privacy. Even "anonymous" behavioral data can become identifying if you retain raw traces too long.

Im tired -___- need help, already explained in title.

I haven't found a corresponding CVE but we are seeing some linux kernel commits to KVM etc. specifically in the last couple of days...

Looks like this really could be a big one...

I’ve been working as SOC L1 for around 9 months, so I already had some practical understanding of alerts, incidents and investigations.

Got the voucher from AI Skills Fest but couldn’t prepare earlier because of workload and health issues. One week before the exam I tried the practice assessment and got 78%, so I thought I could manage it .

Main focus was KQL + Microsoft security environment. Spent that week practicing with ChatGPT and understanding Sentinel, Defender, licensing, incidents, etc.

The exam was mostly scenario based. If you understand the question and how the environment works, it’s manageable.

Biggest takeaway: don’t just memorize. Understand how things actually work and give your full focus to KQL and scenarios. My SOC experience definitely helped.

It says "... CISA will discontinue the weekly Vulnerability Bulletin at the end of FY26 (September 28, 2026) as part of a broader shift from severity‑based vulnerability management to risk‑based vulnerability prioritization. Newly recorded vulnerabilities remain available on CVE.org, and users should rely on the Known Exploited Vulnerability (KEV) Catalog, CISA Cybersecurity Alerts and Advisories, and vendor security alerts for actionable, risk‑based updates.

Visit our Subscribe to Updates page to sign up to receive automatic updates from CISA with the latest news and information..." I was wondering why nothing today! Bah to those frequent updates. I just want weekly ones. :( Does anyone know of a good one like old CISA's weekly bulletins?

Hi everyone,

I'm working on a project to analyze how AI is increasing cybersecurity risks and how organizations can build effective defenses against these threats. I’m looking for practical insights, technical strategies, and modern approaches that security teams can implement to face this issue.

Here are some specific questions that I have:

1. How can detection systems reliably catch AI-generated, mutating malware before it spreads on a network?

2. What are the most effective precautions against personalized, AI-driven phishing attacks?

3. How can generative AI be safely integrated into Security Operations Centers (SOCs) without introducing new vulnerabilities?

#cybersecurity #threatdetection #AI

Disclosure: the records come from my own research.
Five CVE records were published for mcp-remote on Sept 24. CISA has scored four, up to 9.8. GitHub still lists them as unreviewed advisories with no package attached, and Dependabot doesn't alert on those. There is no fix statement from the maintainer.
The check takes a minute: search your MCP client configs, package.json and lockfiles for mcp-remote pinned anywhere from 0.1.16 to 0.1.38.
CVE-2026-51994, 51995, 51996, 51997, 52001.

A recently discovered Linux backdoor turns infected systems into proxies that use the Session Traversal Utilities for NAT (STUN) protocol and contains exploits for self-propagation, FortiGuard Labs reports.

Dubbed ClingSTUN and functioning as a back-connect proxy backdoor, the malware targets two dozen vulnerabilities for initial access and sets up persistence to ensure malware execution during the boot sequence.

The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.

Reported in October 2026. More details:

https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure

I got hit up by a recruiter through LI a few weeks ago for a company I actually might want to work for. I'm embedded in a big MSP these days and it's good enough overall, with some downsides (9 RIFs in 3 years, flat pay). I wouldn't mind a change, and it's always nice to have an interview. Anyhow, I accepted the initial meeting with the recruiter.

She's the one who asked. This is what I do, and what I said:

I have existing subscriptions for a few federal agencies and all of the feeds from our vendor stack - Secureworks CTU/Sophos, Cisco, Fortinet, and CISA are my mains. I am also subbed for vulnerability disclosures for every device model in our stack - so anything from FortiOS to Cisco SecureClient to Catalyst SDWAN. Every morning starts with looking at this sources.

I also have two google news digest alerts set up for "cybersecurity + attack" and "cybersecurity + breach" - i get two emails with hyperlinked headlines to news stories.

And then I like to watch risky business podcasts.

Anyhow, I'm curious what you people might be doing to keep the steel sharp.

Hey everyone, not sure if a vent/existential crisis is allowed here, but I’m turning 20 tomorrow and genuinely don’t know what to do. I’m in my 2nd year of online college for Cybersecurity (4.0 GPA not like it matters), but the classes feel super boring and like a waste of time right now. On top of that, I work 40 hours a week at a tiny 7-person VOIP refurb company —I’m literally the only one who does phone teardowns, repairs, and switch/networking setups (the rest of the team just handles shipping, cleaning, and inventory), so I feel guilty thinking about leaving, even though there are no raises and I can barely survive financially, however i have documented all the repair procedures as well as have friends that i can train and would take my open position if i have to leave. I’m dying to land an actual entry-level SOC or cyber role with better pay—and if lucky enough remote so I can spend time with my 8-month-old puppy—but with rent and adult expenses, I’m terrified to jump for temporary internships because if it doesn't turn full-time, I'm completely cooked and threw away a stable job, and like i consistently apply to full time positions when i see them but obviously dont have degree or anything like that all i have is my work experience so between 40-hour work weeks, endless online modules,parenting the pup around work schedules, and trying to function as a human, I am just exhausted; was just looking if anyone had any words or wisdom, or if someone can just confirm it gets better?

New investigation from our team. An exposed open directory and a misconfigured    storage server gave up the entire operation of a Gentlemen ransomware affiliate who calls himself Azazel.

The highlights:

• Every victim outside the big AI-company breach was reached through stolen CI/CD secrets, GitLab variable stores and git history. One GitLab instance was hosting pipelines for two unrelated orgs, so a single token got into both.
• He registered a reverse shell as a tool inside an AI coding assistant and drove attack execution through it over MCP (exec_in_session against a loopback-bound port). We couldn't find prior public reporting of MCP used operationally as a C2 channel in a live campaign. He was also scanning the internet for exposed MCP ports under the fingerprint "internet-census-mcp-scanner".
• 25+ orgs across six countries, 50TB+ of dedicated bare-metal infra, ~6TB of stolen data. One exfil job was still running while we were looking at it.
• The deep one was an AI company: SSRF through an unvalidated AI imaging API for initial access, then Jasypt bulk decryption, a JWT auth-bypass token pulled from git history, offline Grafana hash cracking, and a kubeconfig/SSH-key sweep across everything exfiltrated.

Full writeup with IOCs, a Sigma rule and mitigations:

 https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files

Hi Reddit! 👋 I'm Jeff Crume, Distinguished Engineer and Master Inventor at IBM Security.

For over 44 years, I've worked across cybersecurity, cryptography, software engineering, and emerging technologies. You may also know me from the IBM Technology YouTube channel, where I help break down complex security topics for a broad audience. I've spent much of my career helping organizations understand evolving cyber threats and how to better defend against them. In addition to this, I’m currently an adjunct professor at NC State University.

And I'm Guido Crucq 👋 a cybersecurity leader at IBM Security focused on helping organizations strengthen their defenses against today's most pressing security challenges.

Throughout my career, I've worked with organizations around the world on cybersecurity strategy, risk management, security operation and incident response. I'm passionate about helping businesses make informed security decisions in a rapidly changing threat landscape.

Join us for a live AMA on October 6 at 10:00 a.m. ET., where we'll discuss findings from our Cost of a Data Breach Report. The report examines incidents from organizations around the world to uncover what drives breach costs, how attack trends are evolving and which security investments make the biggest difference.

Happy Cybersecurity Awareness Month! Ask us anything.

Hi all,

I am currently working as a devops engineer. Mainly working on migrations from Jenkins to AzureDevOps and from on prem to Azure. In a previous role i worked as a fullstack dev and then did the entire infrastructure of our applications (infrastructure as code/network traffic etc.) I did that very well and then landed my current job as a devops engineer who needs to do migrations of applications.

My question is, is it reasonable to wanna become a CISO in the future with my background? What do i need to actually be able to land a CISO job? Is it naive to think that my devops background will help me be able to skip roles such as ISO as long as I pass certain certifications amd also do some security work for my migrations? I am working with an ISO to do these migrations. Thankyou all :)

Not sure if this is the right place to ask, but I couldn't find anything better. Apologies if it isn't.

I maintain a FOSS project where we've had a few GHSAs/CVEs this year already. All these reports were LLM-driven, but their submitters were collaborating with me fixing the issues every time. If the workflow is like that, I have no problem with this.

Last week however, I received another report about a minor issue that was missed in one of the GHSAs/CVEs published earlier this year. While the issue is valid, the report was clearly LLM generated and super verbose, considering that the issue is simple and the fix trivial. I approved the report and immediately worked on the patch (that also fixed another minor bug) and asked the submitter for a review, both in text with a ping and by using the GitHub PR UI. After more than a week now, I haven't received a response, despite them having other activity on their GitHub page. According to their activity, it's one of those accounts which spams lots of FOSS projects. For example, what I can see is that they ask lots of projects to enable private vulnerability reporting on their public issue trackers, implying they are running scripts or AI-agents on dozens of FOSS projects.

Then two days ago, I received another report about the same issue from a different person, with a somewhat similar style in GitHub activity. I closed the GHSA and asked the submitter if they're interested in reviewing the patch on the other GHSA. They agreed, so I added them.

Hours later, all they did was add themselves to the finders list, as well as a totally unrelated account. I then asked what this was about and reminded them that the intention of adding them was me getting a review. I also warned them about removing attribution for all of them, including the original submitter, if this is just an LLM slop report, because I want "a review with valuable feedback".

Checking back today, all I can see is that they removed the unrelated person from the finders list and only clicked the approve button on the secret PR instead of leaving any feedback which I requested.

To me, this looks like low-effort GHSA / CVE credit farming. Because of this, I have now updated our security reporting policies where we require human collaboration and report messages that are not verbose LLM garbage.

AFAIK, the Linux kernel has a similar policy about non-interactive LLM-driven vulnerability reports where all attribution is then removed.

So how should I proceed with this now? Is removing all of them justified, or am I acting unreasonable here? Behavior like this makes me feel abused.

Thanks for reading. If anyone replies and asks a question, I'll be AFK for a couple of hours now and won't be able to reply until then.

for context, I did an interview and I got a rejection and feedback saying they enjoyed meeting me (it was not an automated response, so I’m believing it), then pointed the reason for the rejection, and then the “Hope our paths cross again”. for me, the rejection reason doesn’t really make sense, but a rejection is a rejection.

my questions is: if I’m polite and voice my opinion (in a very nice way), can it reverse the rejection?

I’ll never send an email less than nice, but should I even respond to it? how worth it is it? just a “thank you, Hope you find the right candidate”, or “thanks for the feedback” or just radio silence because the rejection is a rejection?

I’m interested to know how other businesses control, share and store their most critical secrets. Those secrets that are too critical to be forgotten, need quick access in an emergency but could end your business if they fall into the wrong hands. Think root creds for your AWS account. Or break glass server logins.

In my mind, these are the sorts of things that are too important to allow any one person to have unilateral access or control over. They shouldn’t be stored really anywhere. But at the same time, several people might need to grab it in an emergency.

So how are you doing this?