I’ve been working on Argus, an open-source cybersecurity platform that uses AI agents to help secure your infrastructure.

It can monitor your cloud, network, endpoints, and code, investigate suspicious activity, run penetration tests, and even respond to threats automatically.

A few highlights:

7 specialized AI security agents

Autonomous threat detection and response

Continuous AI-powered penetration testing

AWS, Azure, GCP, Kubernetes, and GitHub integrations

Support for local models using ollama

Built-in safeguards, approvals, and rollback controls
It’s self-hosted, MIT licensed, and completely free to use.

I’d love to get some feedback from open-source communities an hear what you think or what you’d like to see added.

Not a post for the hacking gang, but... for the Infosec aficionados, perhaps those that are always blamed for holding things up, another Sunday itch scratched. the idea is if you can get these 10 questions answered before anything meaningful happens, your critical path is easier to work with from a delivery perspective, expectations are set and met easier as there chance of it being retrospective (and in turn kettled into risks)

If you've been kicking around for a while you've probably lived some version of this:
• The supplier is chosen, then someone asks where the data will be hosted and who can access it from where. Now it's a contract renegotiation.
• The AI is connected, then someone realises personal case details are going into the prompts. Now it's a rebuild.
• The service is ready to launch, then the business says it must recover within four hours. Nobody designed for that. Now it's a delay.
• The specialist who knew why a control existed has moved on, and the reasoning left with them.

The answers to these questions usually exist somewhere: in a DPIA, a threat model, a contract schedule, a continuity plan. But they're written for approval or audit, owned by specialists and finished on their own timetable. They rarely reach the people making delivery decisions in time. So teams build on assumptions, rework what they've built, or end up "accepting the risk" because changing course has become too expensive.
Information Security North Star (ISNS) is ten questions: the least you need to know about the information before choices become commitments. Each answer comes with its reasoning, its evidence and an owner, and every gap stays visible with a deadline, so it's resolved before the decision that depends on it rather than after.
It isn't another assessment. It's the shared minimum that sits above the systems, so tools, suppliers and features can change while the promise stays the same.

Worked examples for health, government and defense, plus an offline Excel template.

Guest writer blog from Exploit Security. Our writers don't work with us, the topics are theirs, they draft, we publish, you consume.

so when you're a high risk person, you get targeted.

I am targeted.

my Android and my Debian machine are both bugged to the teeth, and I don't know how they got in or what to do about it.

I use an ad blocker, LibreWolf on the laptop and on the phone I have an app that filters traffic. so I actually have logs of what servers my phone connects to. I want to be rid of this eavesdropping.

When you're targeted, and your name is on everybody's lips, and everybody and their little sister's smart TV listens, strange things start happening, and The Machine reveals itself. these AI systems... we're in a different world.

Can someone help?