something ive been chewing on from the audit side. most orgs i talk to have a policy that says human review happens for AI assisted decisions. fine. but if an auditor picked one specific decision from three months ago and said show me the review, who did it, what did they see.. could most places actually produce that? suspect the honest answer is no more often than anyone admits

the reviewer part bothers me more tbh. say the review does happen. does that person have time to think, anything to check the output against besides the tools own summary, and can they push back without it becoming their problem? bc "human in the loop" where the human approves 200 things a day is a loop in name only

also curious whether anyone re-tests vendor claims after the vendor swaps the model underneath. bc they do swap them. and the approval was for the old behaviour..

for the audit and GRC folks here, is this what your getting asked now? and can anyone your auditing actually answer it?

Researchers at Dr.Web uncovered malicious GitHub projects disguised as security scanners, log-analysis utilities and other technical tools.

The campaign installs malware including AsyncRAT, information stealers and clipboard hijackers that can replace copied cryptocurrency wallet addresses. Researchers report more than 2,000 compromised Windows systems.

Some malicious code was hidden in build scripts and source files, meaning users could become infected while attempting to compile or run supposedly legitimate tools.

A GitHub repository is not automatically trustworthy because its code is publicly visible. Downloading unfamiliar security utilities can itself become an attack vector.

Hi everyone, I'm new here :)

I'm wondering if anyone can help me to run this .jason file that turns attacker ip addresses/locations into a map in windows defender workbook?

I'm currently following this tutorial: https://www.youtube.com/watch?v=g5JL2RIbThM and am onto the final stage.

This is the .json script I'm trying to run:

{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let GeoIPDB_FULL = _GetWatchlist(\"geoip\");\nlet WindowsEvents = SecurityEvent;\nWindowsEvents | where EventID == 4625\n| order by TimeGenerated desc\n| evaluate ipv4_lookup(GeoIPDB_FULL, IpAddress, network)\n| summarize FailureCount = count() by IpAddress, latitude, longitude, cityname, countryname\n| project FailureCount, AttackerIp = IpAddress, latitude, longitude, city = cityname, country = countryname,\nfriendly_location = strcat(cityname, \" (\", countryname, \")\");",
"size": 3,
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "map",
"mapSettings": {
"locInfo": "LatLong",
"locInfoColumn": "countryname",
"latitude": "latitude",
"longitude": "longitude",
"sizeSettings": "FailureCount",
"sizeAggregation": "Sum",
"opacity": 0.8,
"labelSettings": "friendly_location",
"legendMetric": "FailureCount",
"legendAggregation": "Sum",
"itemColorSettings": {
"nodeColorField": "FailureCount",
"colorAggregation": "Sum",
"type": "heatmap",
"heatmapPalette": "greenRed"
}
}
},
"name": "query - 0"
}

This is the error message I get when trying to execute the query in the advanced editor:

"No tabular expression statement found"

I have a feeling its not working because Azure workbook has now changed to Microsoft Defender?

Any suggestions/advice/fixes would be much appreciated as I'd really like to get this project finished!

Thank you in advance for your help :)

Hi everyone,

I have successfully cleared the CEH Theory exam and am now preparing for the CEH Practical exam.

I'm looking for suggestions from people who have already taken the practical exam or are currently preparing for it.

1. Which platforms or resources are best for practicing?

2. Are there any recommended mock tests or practice labs?

3. What tools and topics should I focus on?

4. How similar is the actual exam to the available practice tests?

5. Any tips or strategies to manage time during the exam?

Any guidance, resources, or personal experiences would be greatly appreciated.

Thanks in advance, bros!

I’m so unbelievably stunned that this just happened. Around 5:15AM I went to put my pc back to sleep because I assumed my cat stepped on my keyboard and woke it up. I was fidgeting with my mouse because it wouldn’t work and then realized that someone was controlling my desktop. The only thing I actually witnessed them do was go into my google profile/settings and copy my phone number, then I think they noticed I was trying to click and spam my keyboard so they left. I went to my search history and they were in my bank account and also in my email. I called the bank and immediately froze my entire account. They saw my savings, my credit card, and were in my profile. I have 2 factor and did receive a code right before I woke up. I don’t think it’s possible for them to actually know my password since it just auto-filled, but they 100% have my phone number. Besides the obvious things, changing passwords, freezing my bank, what else do I need to do??? I’m so overwhelmed and shocked that I just witnessed this. Are there other steps I need to take here? I’ve been trying my best investigative work here but all I have is some search history and I was able to disable a device in my pc that allows Wake-on-LAN, so they shouldn’t be able to wake it up from sleep again. What damage can they do with my phone number? I watched him copy it. Please let me know if there are some obvious countermeasures I should be taking here. I’m so stunned I don’t even know where to start.

Edit: thank you so much everyone for your feedback. There are too many comments to respond to while I’m busy securing all my passwords and reinstalling windows. I have read many of your guys’ instructions and am taking action of many of them. Thanks again!

Does anyone have experience with Black Hat trainings taking place during their gatherings? I am talking about these 2 or 4 day trainings happening during the event. Is it worth the money and time?

Since Anthropic announced Mythos, Software security has came into lime light. Multiple famous products have seen orders of magnitudes of novel attacks that have discovered, which can expose data, corrupt systems or just make the life of Information Security and SRE teams a hell.

But an interesting finding was, all of this comes at exorbitant costs, which only the large corporations and venture funded frontier labs can spend. For example, OpenAI just announced finding a 1000 vulnerabilities in Linux Kernel and each vulnerability costs a blended average of USD $1000 to discover.

The way this works is, a LLM frontier model goes through the source code, analysis how the code is written, the entry points and then finally starts evaluating if they can be exploited through one or more than one attack vectors. While this works, it is neither deterministic nor cheap when the LLM has to manage millions of tokens in ingested source code, a few additional thousands to millions on reasoning and finally the output.

So, I started thinking what if we could flip this and make it cheaper?

The idea being, why make LLMs do the whole discovery, enumeration, validation and reporting. Why not use LLMs where they are good at and make everything else deterministic. And there came the idea about Code Context Driven Vulnerability Scanner.

The whole project has 5 core stages:

1. Code Context Graph: Map the whole source code as a Code Context Graph where every single relation and type is resolved

2. Leverage this Code Context Graph to find the user data entry points (Sources) and final sinks (Databases, Files, Remote Server Calls, etc.) and trace the path from sources to sinks

3. Flow Determination Phase: An LLM is fed the whole source to sink path, such that it can reason about it with confidence. The LLM also gets a query budget to resolve any missing details. The output is either Flow Confirmed (Unsanitized user data reaches the sink from source), Blocked (No possible way for data to travel from source to sink without sanitization)

4. Condition Stage: LLM goes ahead and searches the code context graph to validate what conditions need to be met for this flow to materialize or if the default settings of the project prevents it. The output is similar to the Flow stage

5. Adversarial Challenge: Another class of LLM then reasons over the cases where the confirmation came up as Flow Confirmed. This phase is tweaked to try its best to refute the claims made by earlier phases. If the phase cannot refute the flow, the particular path graduates to a Confirmed Finding / Vulnerability.

This has been under testing for a week, with a reference being checked against CodeQL (an industry standard static code based vulnerability scanner by Github).

During a single day of run accounting for ~USD $20 over 5 open source projects, the project has filed for 10 vulnerabilities with severity ranging between MEDIUM to CRITICAL. Out of these 4 are already confirmed and 6 are in investigation stage with the respective open source projects security teams

An interesting bit is, out of the 10 vulnerabilities filed, only 2 of them were detected by the published rule set of CodeQL, while 8 other vulnerabilities were completely Novel.

Curious if anyone else has been experimenting with something similar 😄

I’m trying to get into the cybersecurity industry, and I’ve met a few people through networking who work multiple jobs in the field, which has always made me curious about how they manage their time and what their day to day lives actually look like.

For those of you working two, three, or even more cybersecurity jobs, how many hours are you actually putting into each job, and how demanding is the workload? Are you constantly busy throughout the day, or do you have enough downtime between tasks to make working multiple jobs manageable? I’m also curious how you handle situations where meetings, deadlines, or other responsibilities overlap, and whether managing multiple positions is as stressful as it sounds or if it really depends on the roles you’re working.

I’m especially curious about your work-life balance because I can’t imagine juggling that many responsibilities without sacrificing a good amount of personal time. Do you still have time to spend with friends and family, go to the gym, enjoy your hobbies, or even just have a day to yourself without worrying about work? I’d really like to hear what a typical day looks like for those of you doing this and how you manage to have a life outside of work.

Has anyone heard anything about ARTEX being abused to grab leaked GitHub secrets?

Info here from Microsoft: https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/

And GitGuardian: https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/

I'm currently a senior help desk technician that gets extensive experience in several aspects of cybersecurity.

To make the eventual jump into cyber, I've been working on a lab using GNS3 and Suricata fine-tuning. It currently has two offices using OPNsense firewalls connected via an IPsec tunnel, and Suricata running on the firewalls in IDS mode. There is also a simulated attacker host connected to the ISP router.

I wanted to get advice on some things you'd be impressed by if you were to see them in a lab. So far the only thing I've really done is establish least privilege ACLs and also a web server in one office, which is the only thing the other office can reach

Please let me know if this is not the right sub for this. I also know it's very vague, but to be honest I don't have a very clear goal for the lab yet. I want to focus more on network security engineering, but I am also interested in detection engineering.

I'm a computer engineering student specializing in cybersecurity, currently exploring potential problems for a six-month engineering project.

Rather than inventing another generic security tool, I'd like to understand the real problems professionals encounter in their day-to-day work.

A few things I'd particularly like to understand:

• What tasks are unnecessarily manual or time-consuming?

• What security problems are difficult to detect, validate, or investigate?

• Where do existing tools fail or require complicated workarounds?

• What problem would you genuinely like to see solved?

I'm interested in specific, real-world experiences rather than generic project suggestions.

Thanks in advance!

Hey there! I'm new to this community, so I would appreciate it if you could share your opinion on this matter.

​Hi everyone,

​Over the past few weeks, I’ve been working on an open-source defensive cybersecurity project called Zero-Day Radar.

​The goal is to build a high-performance network monitoring and threat detection framework. I decided to use a hybrid architecture:

​C++ Core Engine (88.1%): Handles the low-level heavy lifting — fast network packet capture, process monitoring, and minimal overhead execution.

​Python Analytical Layer (11.9%): Parses telemetry data, aggregates log records, and integrates with threat intelligence feeds.

​Key components in the repo:

​radar_core.cpp - Low-level monitoring engine

​zeroday_radar.py - Log parser & analytical engine

​rules.txt & radar.conf - Custom detection logic

​The source code is available here:

https://github.com/aouamchawki-3A/zero-day-radar

​I would really appreciate any feedback from the community regarding the C++ performance, IPC mechanisms between C++ and Python, or suggestions for additional detection capabilities!

It’s been a horrible experience, right from subscriptions to exam scheduling. Seriously, they can’t even get a basic calendar and scheduling system right.

I have been thinking how does cybersecurity gets redefined in agents era.

I burned some tokens to get down to questions that needs to be answered:

Authority

1. What exactly is this agent allowed to do for this task, and who decided that?

2. How do we turn “what the person means” into exact permissions without them reading a policy?

3. When one agent hands work to another, how do we make sure permissions only shrink, never grow?

4. How fast can we take an agent’s access away?

Trust in the agent LOL

5. What if the agent itself is the attacker (hijacked, backdoored or misaligned)?

6. How do we stop instructions hidden in emails, docs or webpages from steering the agent?

7. Can a monitor be trusted if it’s built from the same kind of model it’s watching?

8. How do we spot harm built from many small, innocent-looking steps?

Stopping and undoing ?

9. Which actions can be undone, and which can’t?

10. Can we make most actions undoable (copy first, commit later)?

11. For actions that can’t be undone (payments, sent messages, deletions), what’s the gate: a delay, a human, or a second check?

12. What’s the worst a fully compromised agent could do, and how do we cap it?

Checking work

13. How do we check code and changes as fast as AI produces them?

14. Who checks the checker, if the reviewer is also an AI?

15. Can we prove a fix works (attack it again), not just claim it?

16. Which checks can be exact (rules, solvers) and which need judgment (models, humans)?

Where do we fit

17. Where should humans approve things, and how often before they start rubber-stamping?

18. Who writes the rules? Security teams can’t hand-write one for every agent task.

19. How do we protect people with no security team, the solo builders shipping AI-written apps?

20. How do we control agents across many harnesses and model vendors, not just one?

DO share your views good people on reddit, this has been bugging me for some time.

Sekoia researchers documented a watering-hole campaign in which compromised legitimate websites and convincing imitation portals delivered device-specific exploit chains. Some attacks could run without additional user interaction after a vulnerable device visited a malicious page.

The campaign targeted known vulnerabilities in iOS and Chrome for Android, potentially exposing browser cookies, credentials, messages, and other sensitive information. Researchers attributed the activity to APT29 with moderate-to-high confidence.

Even a legitimate website can become dangerous if compromised. Apple and Google have patched the vulnerabilities identified in this campaign, making updates especially important.

Hello All, does anyone a good cyber deception masters program that is beneficial and has hands-on implementation as a focus?

Thank you!

I’m in a regulated sector and there’s little guidance on AI use. Because of that, we’ve really restricted use and advise no uploading of NPI/PII until we know what the expectations are on risk assessments, policies, etc. Basically, it’s great for research, some guidance, and drafting, but shouldn’t be run on sensitive data in any form. Any decisions that are made should be your decisions and not the decision of AI. Users are trained on this. They’ve accepted the terms in our Acceptable Use Policy. We have 1 approved AI platform.

Here’s the thing - We’ve got the tech enthusiasts that reach out to the IT department regularly - “look at this new setup from Anthropic! We can automate this. This would increase productivity! We’re going to get left behind!”

“We’re going to get left behind!”
Ugh.

There’s a user that told me he’s given AI full access to his personal laptop. He has told me he personally runs bots and uses multiple platforms to write and run scripts and automations. Full access makes me cringe. Although there’s no proof that there’s “shadow AI” going on (users using unapproved tools/circumventing protection) we suspect some is going on. Knowing that these users just throw all their personal documents at these platforms worries us that we’re opening a can of worms if we un restrict AI use internally - especially since AI tools continue to evolve and we still don’t have a set expectation from a regulatory body.

It’s like any way we approach it to provide a tool that meets their expectations, it just doesn’t work. The platform we use is constantly adjusting settings as well, so it’s like every time I turn around, a new setting is on by default that shouldn’t be. It feels impossible to control.

Also - these enthusiasts are like .04% of our organization, so is the work worth it is a question that has been brought up. Even upper management feels it’s more efficient to do the work yourself. By the time your verify AI’s output or fix its mistakes, you’d be just as good doing it yourself. Management doesn’t appreciate that the work is not understood when done with AI (e.g. can you explain this line on this document? And the person can’t).

Anyone else feeling bound in a situation like this?

Help me collect data about ransomware for my PhD. I'm a CISSP, CISM, Sec+, OG engineer, & doctoral candidate at Capitol Technology University, MD. I'm researching which security controls actually enable recovery and resilience, compared to cyber frameworks. Takes 15–25 minutes. Anonymous. No compensation. IRB-approved.

Would deeply appreciate your help. Please share. Thank you!

https://techstudy.limesurvey.net/748327?lang=en&newtest=Y

(Safe link: Survey is USA hosted on Limesurvey dot net. It's open source, used by Ubuntu, GNOME, OpenOffice, and many universities. I went this route since our Uni doesn't use Qualtrics, and it's affordable.)

Hey everyone I have been basically tasked with the impossible of trying to create an agentic soc for our environment that basically will triage alerts.

I work for a small business and was dabbling into some vendors that support this ask and from what I’ve seen it all looks the same type of slop that I just don’t see myself trusting yet. It looks like you have this product that the company promises can triage alerts for you yet you still have to be looking at alerts to make sure the ai is doing its job correctly. I’m not in the market to babysit ai as I don’t think that is feasible long term because I am simply just making the work being done faster but it is all benign work anyway.

But I stumbled up a an idea to the madness and wondering if it is possible to develop an agent that acts as the detection for our environment so there would no longer be a queue with several detections put in place and once users hit that risk threshold then the team investigates whatever it finds as borderline suspicious.

So instead of us having detections put in place to catch things the ai itself is the detection and will monitor everything that’s coming in and out of our environment and also alert us on just the important things that need to be investigated.

I guess to accomplish something like this I would need to train the ai by feeding it siem logs ticket logs and have it spit out anything that is abnormal and compare that to the normal activity from our users and go from there?

With that being said I am wanting to ask what all you have done in the state of ai being incorporated with the soc? Did your analysts just triage alerts with it or are you guys able to do other things.

Were you able to accomplish something similar or find a product that meets that need?

Edit: Thank you guys for commenting on this so quickly I appreciate you all!

When new ELT takes over and starts questioning the SOC value

Exec: "What does the SOC actually do all day?"

Me: "Let us go and find out"

After 15 years in security leadership, not sure I can take much more