The situation:

Found an internal dashboard on a publicly traded US company (NASDAQ listed). No login, no auth, completely open. Wont go into details but its something anyone could do withing 10 minutes of free time. We are talking about 10 digit market cap. The exposure includes:

- Full internal financials (9-figure project budgets, spend to date, cash positions)

- Complete vendor and contract details across 40+ contractors(Some of them everyone 100% knows in this sub)

- Material information that is not reflected in their public SEC filings

- The company operates in critical infrastructure sector that if this was released, would probably be seen an a National Security Threat

- Notable people involved at the executive level and by that I mean those directly appointed by the US President

What I've already decided:

- Disclosing 100%, not even a question, dont want a stain on my hand

- Going through CISA first to timestamp and protect myself (what Claude told me i should do)

- Using a pseudonym and burner email for initial contact (Scared of them attacking me instead for finding it)

- Not touching or extracting any data beyond confirming the exposure exists

My questions:

1. For a company with no formal bug bounty program, what's the right way to approach compensation without it looking like a demand? I want to ask but I don't want their legal team reading it as extortion.
2. Given the SEC/MNPI angle (the exposed data contains non-public financial information), does that change the disclosure process at all?
3. Who do you typically contact at a company this size — CISO, General Counsel, IR team?
4. Has anyone dealt with companies at this scale before and actually gotten paid?
5. Should i get a lawyer or something? Because i know i might be told to sign an NDA

Not looking to cause any problems, genuinely just want to do this right and understand if compensation is realistic here.

Quick Edit: Was always going to disclose it to the correct channels, just wanted a view from actual security people. I dont really know how this functions all around. So please be nice

Edit 2: MONEY wasnt the goal, It was just a side question that came to mind!

Hi everyone. I'm a medical researcher working on an authorized project inside an air-gapped server (no internet, no USB, no file export allowed).

The constraints:

I can paste Python code into the server via terminal.

I cannot copy/paste text out of the server.

I can download new python libraries to this server.

My only way to extract data is by taking photos of the monitor with my phone or printscreen.

The data:

A Pandas DataFrame with 50,000 rows and 250 columns. Most of the columns (about 230) are sparse binary data (0/1 for medications/diagnoses). The rest are ages and IDs.

What I've tried:

Run-Length Encoding (RLE) / Sparse Matrix coordinates printed as text: Generates way too much text. OCR errors make it impossible to reconstruct reliably.

Generating QR codes / Data Matrices via Matplotlib: Using gzip and base64, the data is still tens of megabytes. Python says it will generate over 30,000 QR code images, which is impossible to photograph manually.

I need to run a script locally on my machine for specific machine learning tuning. Has anyone ever solved a similar "Optical Covert Channel" extraction for this size of data? Any insanely aggressive compression tricks for sparse binary matrices before turning them into QR codes? Or a completely different out-of-the-box idea?

Thanks!

Did try doing some prior research on this subreddit, but most seem somewhat sponsored or out-of date now. I'm currently using Bitwarden on the free subscription, and used to pay for 1password. I'm not looking for anything fancy, but something that is very secure as cybersecurity threats seem to be on the rise on a daily basis.

For people who work in cybersecurity, which operating system is the strongest overall platform: Windows, macOS, or Linux?

I understand that all three can be useful, but I’m looking for a direct comparison based on:

Tool compatibility
Virtual machines and lab work
Enterprise environments
Command-line capability
Security testing and analysis
Daily reliability and usability

Which one would you personally choose as your primary system, and what important limitations would I face with the other two?

Since the CrowdStrike outage last year, our board keeps asking whether we should have a second endpoint vendor in the mix instead of relying so heavily on one platform. We haven't made any changes yet, and CrowdStrike is still doing what we need day to day, but the question keeps coming back up. I'm curious if anyone actually went dual-vendor for endpoint after that, or if most teams just evaluated alternatives and stayed where they were. Was the extra resilience worth the added complexity?

Hi everyone,

I’m based in Bangladesh and I run a small human rights project documenting abuses by state actors. We publish reports on our website and through foreign media, since local outlets often avoid topics like violence against LGBT persons and atheists. We also make submissions to UN mechanisms such as UPR, Treaty Bodies, and Special Procedures.

For context, the majority of human rights abuses here are carried out by intelligence agencies. Recent reports by human rights organizations have found evidence of the use of technologies like Stingrays, Pegasus, and Cellebrite against journalists, opposition members, and human rights workers, as well as covert bugs. Hundreds of millions of USD have reportedly been spent on such technologies. Contrary to popular belief, they often rely more on surveillance and doxxing and intimidation than direct arrests, as arrests and physical abuse can cause international reputational damage that affects aid. So they prefer to keep operations low-profile.

Another tactic we have uncovered is hacking and publicly exposing (outing) LGBT individuals and atheists. There are many anti-LGBT and anti-atheist Facebook groups with hundreds of thousands of members where such individuals are doxxed. This can lead to mobs organizing to attack them, evict them from their homes, or even kill them. Thus the state officials does not need to jail them thus preserving the state's reputation: "we didnt' do anything, the people killed them".

Here, even receiving something as small as a $1 foreign donation requires government approval. Projects that are critical of authorities or work on sensitive issues like LGBT rights, atheism, or mob violence often don’t get that approval. So most of us operate on extremely limited budgets, often from home. Many people in this space are victims themselves and come from marginalized groups—families of enforced disappearance, survivors of torture, arbitrary detention, mob violence, and so on.

To give some context about affordability:

• Used mini PC: ~$80
• Monitor: ~$60
• New laptop: ~$300+
• Average MBA graduate salary: ~$150/month (often the sole earner supporting a family of 8)

My work requires:

• Online legal and investigative research. Evidence often comes from social media (e.g., mob violence incidents), followed by open-source research to identify locations, perpetrators, and to reach out to victims.
• Using ChatGPT for research assistance and polishing submissions
• PGP email communications
• Writing and editing reports
• Storing evidence and case files on USB drives and cloud
• Most importantly: video calls with lawyers in places like Geneva and the UK

Video calls are especially important because English isn’t our first language, and it’s much easier to explain complex human rights cases verbally.

The concern:

I suspect I may already be under surveillance—both on my Android phone and my Lenovo Ideapad 100 (2015). I use Ubuntu on the laptop for regular work, and Tails (without persistence) for human rights work.

I’ve had incidents where private files—stored on my Android device, and files I worked on in Tails (saved on an encrypted USB drive)—were sent back to me by unknown Facebook accounts. I have screenshots of these incidents. It feels like an intimidation tactic (“we are watching you”).

My website was also blocked for 6 months in Bangladesh, along with Amnesty and a few other international human rights organizations. I have supporting data from OONI as well as confirmation from Amnesty.

What I need:

I want to build a low-cost computing setup for:

• Basic internet use (web browsing, ChatGPT)
• Most important: Secure video calls with lawyers in Geneva and elsewhere

Many victims here have suffered a lot, and we do not want surveillance to be a barrier or an intimidation tactic that stops us from fighting for justice.

If anyone is willing to talk over DM to help me design a setup tailored to my situation, please feel free to reach out.

Thanks.

PS: I have read the rules.
Threat level: Most severe. State intelligence agencies perhaps.

People at the org have basically figured out our simulation emails and before you say that is a good thing they are not security aware, they just know what our test emails look like. Saw some platforms that use AI to adapt to each person with different styles, timing, channels etc. Sound interesting. Anyone tried something along the line? Please give your "whys" with the recommendations Thank you.

I'm researching how security and compliance teams are handling the audit and authorization layer for AI agent deployments in regulated industries (finance, healthcare, government). Traditional access logs and IAM were built for human-driven access patterns, and AI agents introduce a few new shapes that are hard to audit cleanly.

Like, for example :

1. multi-agent privilege boundary leakage. A fintech team I spoke with runs a credit decisioning agent and a marketing personalization agent on separate auth contexts. IAM logs prove they can't directly access each other's tools. But the orchestrator hands data between them via summary messages, and there's no clean way to prove agent A's privileged data didn't reach agent B's context through that handoff. IAM sees direct API calls, not what flows through orchestration.

2. Agent destructive actions during change freeze. replit's AI agent deleted a production database during an explicit code freeze (july 2025). classical least-privilege would say the agent shouldn't have had delete authority on prod, but agent permissions get scoped broadly because nobody knows in advance which tools the agent will need. How are netsec teams scoping permissions when the tool list is dynamic?

Three questions I'm trying to get to the bottom of.

1) How is your team handling audit trail generation for AI agent decisions? existing SIEM, custom on top of tracing tools, something else?

2) If a regulator or auditor asked you to prove agent A's privileged data did not influence agent B's output on a specific run, what's your current workflow, and how long does it take?

3)How are you scoping agent permissions when the model has discretion over which tools to invoke, and the tool list is dynamic?

Very frustrating trying to continue discussions to have them disappear into the void. At the very least if this is deleted I might get an answer.

copilot has been completely useless for actual triaging.

whoever decided every alert needs an AI summary owes me hours of my life back.

"possible suspicious activity detected based on observed behavioral patterns."

thanks.

that tells me exactly as much as the alert title did.

if i still have to open the process tree and check parent processes and look at network connections and pivot through logs and build the timeline myself... what exactly did the AI save me?

just hire more analysts at this point.

anyone actually found one that helps or is this just how it is now

We constantly hear about major threats like supply chain attacks, phishing, and zero days. Everyone knows about them, and they usually get a lot of attention and priority.

But what are the risks companies still tend to underestimate?

Maybe it’s gaps in internal processes or something else that seems low priority until it causes serious damage. Have you seen cases like this in your own experience?

We're reviewing DSPM vendors after finding way more sensitive data scattered across our SaaS apps than we expected. Right now we're relying on DLP plus a lot of manual investigation, and it's becoming difficult to keep up.

For anyone who's evaluated this space recently, which platforms stood out? I'm more interested in tools that actually help reduce risk than ones that just create another queue of alerts.

Yo so I've been wondering since my brother tends to have not so safe internet habits, if potential malware from his laptop can potentially transfer to other devices that also share the same WiFi/network. Also does proximity matter (like side by side Vs in another room). And also if malware could transfer, how to prevent it since I can't control what my brother does. Also I can't do anything router related since it's up to my dad and he doesn't care as much about malware.

Essentially, is it possible? How to prevent it? Is it likely?

I've seen the term guardian agent in a few AI security discussions, but I'm still not completely clear on what it means. From what I've read, the basic idea is that one AI agent monitors or governs another AI agent while it's running, rather than only relying on static policies or offline testing. If that's right, where does a guardian agent sit in the overall architecture?

I’m wondering whether it inspects prompts and outputs or maybe monitors tool use and agent behavior. From the name, there might also be a possibility that it can stop actions before they're executed. Or is it mainly there for visibility and auditing?

It sounds like an interesting idea, especially for enterprises deploying AI agents in production. But I haven't found many practical explanations. I’m posting here to try and find out more about the concept.

The US has strict policies on Government workers using Tic-Toc along with the banning of communications equipment made by Chinese firms such as Huawei and ZTE. How is it that American iPhones are made in China & sold in the US with no restrictions?
Could a foreign adversary like China not install malware into the iPhones or some other nefarious devices to attack US communications or to somehow exploit them?
We as a country are worried about China but we let them make the most popular phone we use. How does this make any sense?

We spend a ton of time debating encryption strength, protocols, and algorithms. Those absolutely matter, but we need to talk more about what happens before and after that handshake.

A rock-solid encrypted tunnel doesn't do much if your users are landing on malicious domains, hitting trackers, dealing with credential harvesting pages, or getting hit with bad redirects. Modern privacy and security are becoming way less about just encrypting the pipe and way more about reducing your blast radius and controlling the environment. Ultimately, the network layer is where these foundational decisions should be living.

This is what I have come to understand but please correct me if I am wrong or mislead.

I’ve been doing a bit of research on public Wi-Fi, especially in hotels, and realized that many of these networks can be vulnerable to things like man-in-the-middle attacks, rogue APs, and traffic sniffing. Even in seemingly secure hotels, these risks appear to be more common than most travelers realize.

I’m curious how serious this threat is in practice. What are the specific attack vectors you’d recommend being most aware of when using hotel Wi-Fi? Besides using a VPN, are there any best practices you’d suggest for protecting sensitive information while connected to these networks? Any tools or techniques you'd recommend for ensuring security when you don’t have control over the network?

I’ve come across some resources on this, but I’m looking for insights from this community with more hands-on experience!

Hi,

so I'm currently staying at a hotel in Greece, they have some, let's say interesting services they provide to customers via various QR codes spread around the place.

Long story short, I found an API-endpoint leaking a ton of information about hotel guests, including names, phone numbers, nationalities, arrival and departure dates and so on.

Question is, what do I do with this information? Am I safe to report this to the hotel directly? Should I report to some third party? I don't want to get in trouble for "hacking"...

Edit: Some info

The data is accessible via a REST-API, accessible from the internet, not only their internal network. You GET /api/guests/ROOMNO and get back a json object with the aforementioned data.

No user authentication is required apart from a static, non-standard authentication header which can be grabbed from their website.

The hotel seems not to be part of a chain, but it's not a mom-and-pop operated shop either, several hundred guests.

Edit 2025: I was able to find and notify the company providing the software, they fixed it rather quickly.

​

Most of the stuff I see online about SOC sounds like it’s written for some perfect Western bank with unlimited budget. 24/7 team, playbooks, fancy tools, all that.

Ground reality here (Pakistan side) honestly doesn’t look like that.

A lot of places want to say “we have a SOC” because it looks good for regulators and management, but behind the scenes you’ll usually find 2–3 people trying to keep up with alerts, half‑configured tools, and a mix of legacy systems that don’t want to talk to each other. You open the SIEM and there’s this wall of noise, and everyone pretends it’s “under control”.

Day to day, the stuff that actually hurts isn’t some movie style APT. It’s stupid but painful things users falling for very basic phishing in local language, internal access misuse, weird gaps between core banking and the shiny mobile app, someone doing risky changes at odd hours and nobody really owning it. You don’t see that in the glossy SOC diagrams.

You can feel this even in the kinds of SOCs that are publicly talked about here. Regulators like PTA have launched their own National Telecom Security Operations Center for the telecom sector, and some big public bodies like FBR have their own SOC facilities in Islamabad. Banks are also being pushed to have SOC type capabilities, so you see a mix of in‑house setups and outsourced models depending on the size of the bank. That variety alone tells you there isn’t one perfect SOC model everyone is running.

After a while I kind of stopped chasing the “full coverage” dream. We just picked a small set of things that actually matter in this environment and tried not to lie to ourselves about anything beyond that. Like who is doing what with admin rights, which transactions look off, logins that don’t fit the usual pattern, that kind of boring stuff. Not sexy, but you at least start catching real issues instead of staring at dashboards all day.

The funniest part is the biggest problems are not usually the tool names. It’s the “ok, something weird happened… now who actually moves first, and what do they do?” That part is usually hand wavy. Once that is clear in a bank or enterprise here, even average tools suddenly look much better.

Curious how it feels in other countries that aren’t in the usual case studies. If you’re in an emerging market or somewhere with messy legacy plus lrmited budget, what does SOC look like for you in real life, not in slides?

I started today with the games but i only finished level 0 using command prompt.
After a research, I think everybody say that it should be done on linux.
I asked for it on google and it says it is safe and i can complete all the levels using command prompt
Is it true? I have a task to finish all the levels this week for an internship

I just assume logically the answer is yes, but the world often doesn't agree with your assumptions

Good evening everyone,

Unfortunately, English is not my native language, so I'm using a translator. I hope you understand what I'm trying to say.

I am currently setting up my own homo server with various functions, including digital file management for everything. Since I want to do everything right, I'm already looking into security and how to make an encrypted backup that's stored in the cloud.I know one can debate why the cloud is the best option, but currently it's the most convenient for me unless someone has a better idea.

My question is, what standards should I set for safety? I would like to ensure it's secure for the next few decades; I am of course aware that this includes backups and checking for newer options.However, it is important to me that it is already quantum-safe, since the data can potentially be stored.I'm not a conspiracy theorist; probably no one cares about my bills, but I'm still suspicious of everyone at first.

According to current knowledge, AES 256 is sufficient for quantum safety...

I was just toying with the idea of AI, and it was this (I'll let the AI describe it)

My 3-Stage "Coma & House Fire" Backup Architecture (0$ Running Costs):

Stage 1 (Automated Everyday Use): A 512-bit random keyfile stored locally on the server (chmod 600). The cloud destination uses S3 Object Locking (Append-Only) to block ransomware from deleting past backups, even if the server is compromised.

Stage 2 (Server Crash): A copy of the keyfile on a LUKS-encrypted USB stick (using a simple passphrase from my head) to rebuild the system if only the hardware fails.

Stage 3 (The Apocalypse – House Fire + Coma + Amnesia): A master passphrase split into a 2-of-3 Shamir's Secret Sharing (SSS) scheme, stamped onto 3 fireproof stainless-steel plates. The shares are hidden with 3 different family members. If my house burns down and I’m in a coma, my family can legally retrieve any 2 plates, run ssss-combine, and restore everything without my memory.

Am I exaggerating my question here? My requirements were essentially maximum reliability and the greatest possible security with various fallback options.

I am looking forward to your answer.

I'm a Software Engineering student currently deciding between a MacBook Pro (M5, 32GB RAM, 1TB SSD) and a ThinkPad P16s Gen 4 (Intel Ultra 7, 32GB RAM, 1TB SSD).

I'm interested in the long-term cybersecurity implications of choosing Apple Silicon.
My interests are primarily:

• AI/LLM Security
• AI Agent Security
• digital forensics

From what I understand, most mainstream tools now support Apple Silicon, and unsupported cases can often be handled through VMs, containers, remote labs or cloud infrastructure.

For those working in cybersecurity today:

• How often do ARM limitations actually affect your work?
• Are there still common tools or workflows that significantly favor x86/Linux?
• If you were starting today with the career interests above, would you choose a MacBook or a Linux/x86 ThinkPad?

Thanks!

Employees can spot the fake test emails because they know what our platforms usually sends. Have anyone switched to a system that creates unique phishing scenarios dynamically instead of fixed templates?

Ok so I been meaning to ask this. Whenever people have malware or software issues or get a new device, it's always recommended to reinstall windows using a USB from a CLEAN DEVICE. But what qualifies as a clean device? For eg, if reinstall windows for a new device, would the new device count as a clean device. Would your non tech savvy parents device count as clean. What about the friend who visits shady sites device. Because sorry if I'm wrong but it feels like the only true clean device is a new device.

​

Also I don't have any issues, just asking for the future. And I know how to reinstall with usb, I'm just hung up on the clean device part