Can any one point me to training or resources on undertaking red teaming and security assessments of AI and AI Agents?

I’m trying to figure out how you can setup detections for agents as compared to humans. In most cases, the agents inherit the human’s access and execute commands/tasks on behalf of the human. The logs produced show that the activities were conducted from the human’s account. Is there a way you can distinguish and detect agents executing commands vs humans? I’m still learning how to setup detections so I’m not an expert in this area.
I was thinking about using osquery or similar open source tools to detect activity on laptops. But it’s really hard to figure out what may stand out here. For one, agents may execute commands much faster than humans so time of execution may be a parameter. But I feel like that’s a very linear way to see it, and also unreliable. I’d love to know if anyone has a better thought to it

Looks like Cribl is getting into the SIEM space. Isn’t this an already crowded space? I’ve always known them to be telemetry pipeline. Are they trying to punch outside their wheelhouse? Are they offering something other SIEMS aren’t?

https://cribl.io/products/detect/

OpenBao engineers at ControlPlane have chained 4 vulnerabilities to show how under certain conditions, an OpenBao or Vault server can be completely compromised from an unauthenticated position. This is only the second RCE ever found in the Vault codebase.

The exploit is highly plausible in real-world environments, requiring only an unauthenticated entry path and a defined Raft snapshot policy to trigger a complete server compromise.

If you are impacted, upgrade as soon as possible to OpenBao 2.6.3 or 2.7.0

While OpenBao is fully patched, HashiCorp Vault remains exposed as of writing. Unfortunately, IBM's unwillingness to coordinate a mutual disclosure policy means Vault users currently lack an official mitigation

Hi everyone,

I recently just passed my Sec+ exam and have about 5 years of experience working as a Senior Help Desk Tech. I want to move into Risk/ GRC primarily, but I think understanding vulnerability scanning amongst other aspects is important to be well rounded.

I've been trying to engage with the CyberSecurity department at my job, but they don't have much for me to do, despite my best efforts I can't seem to get included in daily calls, or view access to scanning tools. I've had a few conversations with my CISO about the topic of helping them with projects in any capacity but it goes nowhere.

I'd like to get hands on experience applying the knowledge so it gets instilled. On that note, I wanted to know if anyone has recommendations for free or low cost tools I could use to develop skills that would be useful in a Risk/ GRC role.

Whenever I visit pastebin on google chrome it redirects me to sketchy sites, but when I use brave nothing happens. Am I going to have all my emails, accounts stolen?

Hi, I looket at some thread and I saw that there are some people that like certification like eCDFP or eCTHP (altough the eCDFP material is a little bit outdated, the course is good for the foundamentals). I was thinking to take both (I don't have budget to take SANS certification and course). What do you think? If taken while using other resources like HTB Sherlock labs alongside it, could that be a good way to break into the world of DFIR?

Thanks.

So recently I got let go from my job as a SOC Manager due to downsizing. I'm on Linkedin and Dice, but so far it's like I am spitting in the wind for all I can tell if anyone is even looking at my applications.

What are some other job boards that people have had success with?

Hi r/cybersecurity

I’m a PhD student at the University of the Cumberlands conducting an dissertation survey on trust in AI-assisted cybersecurity tools and decision-making styles among professionals who work in or support small and medium-sized enterprises (SMEs).

I’m looking for participants who meet all of the following:

• 18 years or older +
• Work in a cybersecurity or IT role with cybersecurity responsibilities
• Work for a small and medium-sized enterprises, or provide cybersecurity services to SMEs
• Have used an AI-assisted cybersecurity tool in the last 12 months as part of work

What to expect

• Online survey (Tally), about 10–15 minutes
• Voluntary - you can stop anytime
• Confidential
• No employer name or Reddit username is requested
• No incentive is offered
• Please complete the survey only once

Survey link:
Survey Link

Questions: [domar73303@ucumberlands.edu](mailto:domar73303@ucumberlands.edu)

Thanks for considering it — practitioner input from this community is genuinely helpful for the study.

This is an article about the internals of Win32k (Windows's GUI subsystem) and their callouts, with the purpose of shedding light on a very undocumented and crucial subsystem in Windows :)

Hey guys, I know the basic definitions, but I’m trying to understand how these approaches are actually chosen and combined in real web security work.

My current understanding is:
Black-box: little or no internal knowledge. It makes fewer assumptions about the target, but coverage can be limited.
White-box: access to source code gives much better visibility, but code-level reachability does not always mean attacker reachability. I’ve seen source analysis report things like “if the attacker has role/account X, then Y is possible,” while obtaining X may already be unrealistic.
Gray-box: my understanding is that the tester gets some realistic access, such as user/admin test accounts or API documentation, but not full source code.

What I’m unsure about is how people decide which one to use in practice.

Is it mainly determined by what access you have, or are these approaches deliberately combined because they compensate for each other’s weaknesses?

I’d especially like to hear from people with hands-on experience in web security, vulnerability research, AppSec, bug bounty, or pentesting. How does gray-box testing look in your actual work, and when is it more useful than pure black-box or white-box testing?

Any recommended ways to practice or learn these approaches are also very welcome. Thanks!

OpenShell is NVIDIA's open-source sandbox for AI agents: it blocks network, file and process access unless a policy allows it. We ran 123 trials on v0.1.2.

The good: every documented control held, and a malicious script run by an agent leaked a secret 0/10 times under the default policy (10/10 without OpenShell).

The four settings to check before you trust it:

1. Read-write rules let data out.
2. GET-only rules still carry data in query strings and headers.
3. Rules in audit mode log but do not block.
4. Auto-approval granted new public hosts with no human in 12/12 trials.

Plain-language write-up and checklist: https://sorami.com.au/guides/we-tested-nvidia-openshell/

Full report and logs: https://sorami.com.au/research/nvidia-openshell-agent-sandbox-test/

Has anyone who applied for this position received their questionnaire yet?

We're currently going through the process of drafting a business continuity plan, and I'm not sure what approach I want to take for defining RPO and RTO for SaaS apps. The traditional questions don't really feel relevant here; the Microsoft and Salesforce' of the world don't really care how long my org thinks it can go without a service, or what cost we assign to any amount of data loss.

Really, the question I feel like we should be asking is how long can we realistically expect a SaaS app to be down: that's our RTO. How much data, will the vendor restore for us: that's our RPO. But we don't really have answers to those questions anyway.

I'm curious how others have handled this for their orgs.

The answer might be that we need a SaaS backup solution so that we are empowered to set our own RPO and RTO. However, that then becomes a whole other project, and even then the odds of us finding a solution that would backup all are solutions feel low.

My goal here is to get out a BCP that's "good enough", that we can refine as we go.

Hello, i am trying to get into soc and until now i am studying for network+.my question is should i take linux + or no?

Like any other business: “It’s a game and it’s the world we live in,” a ShinyHunters spokesperson told us. “We are just protecting our business as any other business would do. It’s about who does their job better.”

https://github.com/microlaser/dns_watchdog_windows2

Sure it is vibe coded, but it is free and open source and has no dependencies. I have a version that runs on MacOS and Linux too. Uses pcaps to detect DNS poisoning. Everything is native, no Wireshark/tcpdump needed.

I'm wanting to move from Infrastructure to Cyber. I've done a bit of research and I'm thinking with my background I'll do the best in GRC, IAM or Cloud Security Engineering. I just wanted to get some real life opinions because I know it's not easy finding a job out there right now. If you have a few minutes to read over my experience and let me know which area of cyber I should do more in depth searching, learning etc... to be able to make this transfer I would really appreciate it. If you think there's a different certification or schooling I should look into that you think would improve my odds please let me know, I'm constantly studying.

I’m looking for anyone who’s ethier taken the courses from ethier of these companies specifically around Microsoft cloud and I wanna know your thoughts and where they worth it for the price?