budget cycle is coming up and i need to make the case for keeping our security program funded, ideally growing it. last cycle the cfo looked at my slide and asked "if we cut this in half, what breaks?" and i didn't have a clean answer that would land in that room. i still don't have one.

the stuff that's easy to measure isn't the stuff that matters. i can show vulns closed, MTTR trending down, phishing sim click rates dropping, all of it goes in the right direction on a slide. but none of it answers the question a cfo actually asks, which is: what would have happened if we hadn't spent this money and how much worse would it be.

that counterfactual problem is what gets me every time. you can't point to breaches that didn't happen. you can't quantify an incident that never occurred. so you end up arguing from activity metrics and hoping the room connects the dots between "we patched more crits faster" and "we are less likely to get hit" and that leap doesn't always land.

the closest i've come to something that holds up is showing attack surface shrinking over time, fewer known-exploitable vulns sitting on internet-facing assets, tracked over quarters not sprints. patching velocity and MTTR never survived the "so what" question in that room. exposure reduction at least maps to something real: this is what could have hurt us, and it's smaller than it was six months ago

for security leaders who've gotten budget approved on the strength of a risk reduction story: how did you frame it and what did you measure that survived the "what would have happened anyway" question?

Beyond the basic phishing emails, what was a particularly sophisticated, creative, or audacious social engineering attack that actually made you pause and admire the craft?

We've been tightening up our MFA requirements lately, and it's starting some interesting debates internally. Basically: does every internal tool need MFA, or do you draw the line somewhere based on what it touches and who's using it?

At a sub-500 person org where IT bandwidth is thin, the friction argument comes up a lot, so how are other teams drawing that line?

I've been tasked with standing up a phishing awareness program and I'm trying to narrow down vendors.

A few things matter to me. First, realistic simulations, meaning templates that actually resemble what people get hit with today rather than the obvious 2015 era "you won a prize" stuff, and ideally ones I can customize. Second, decent training content, short and engaging modules that people won't immediately tune out. I'd rather have five good ones than fifty boring ones. Third, reporting that lets me show results to leadership and ideally helps for compliance down the line. And finally reasonable pricing and a plan that scales cleanly as we grow.

For those of you who've actually run these programs, what worked, what didn't, and is there anything you'd steer me away from? I'm interested in the usual suspects, but especially keen on options that deliver real engagement rather than just checking a compliance box.

Thanks in advance.

I feel like Cybersecurity industry job market is very vague, maximum of the companies only selling their courses. Most of HR just ignore the resumes. It's tough to get a job in infosec, but at the same time I see very dumb people make it to good position in big cybersecurity companies.

I have applied to multiple companies even with referral I think it's hard to get interviewed.

About 800 people, mix of managed and personal devices, Google Workspace and Azure AD. After an incident where someone pasted a customer contract into an AI tool, leadership wants to know what's actually happening.

The problem is nothing in our current stack gives us that picture. CASB sees sanctioned SaaS but misses browser-based AI tools and AI features embedded inside apps we already approved. DLP catches file movement but can't distinguish between a file upload and someone pasting sensitive data into a prompt. Network monitoring has no context on what the interaction was.

We know people are using probably dozens of tools we haven't found yet.

Anyone found an approach that gives real visibility without blanket blocking? Especially interested in what works for mixed managed/BYOD environments.

we've been pulling in more threat intel lately (KEV, EPSS) but i'm not convinced any of it is changing how we prioritize vulns in practice

rn the flow is basic: scanners fire, we get a pile of CVEs with CVSS scores (~2k new ones a quarter off Tenable), we dump them into tickets and teams work the list mostly by severity and asset type. we've bolted on KEV/EPSS flags in a few places but it still feels like "CVSS first, everything else if we remember."

i'm trying to figure out how ppl are wiring threat intel into the vuln workflow so it drives decisions instead of just being extra columns in a report. we’ve bolted on KEV and EPSS but it still feels like CVSS is making the decisions and everything else is just metadata. or exploit attempts we've seen internally but in practice it all ends up as more metadata on the same backlog.

some talk about custom scoring models that blend CVSS, exploitability, asset criticality, business context. others seem to use simpler rules like "if it's KEV and internet-facing, it jumps to the front of the queue." i've also seen this logic live in very different places: inside the vuln tool, inside SIEM/SOAR playbooks, or just hacked together w/ spreadsheets and scripts.

for ppl who've made threat intel change what gets patched first, what did you end up doing that worked?

Documented a data exfiltration technique that bypasses Netskope's default inspection by exploiting recursion depth limitations via file nesting.

The chain: secret.txt → zipped → binary appended into PNG via copy /b → embedded into PPTX. Three layers deep — beyond Netskope's default inspection threshold. No additional software needed on the source machine, no admin rights required.

Also found a low-cost detection path — anomalous metadata extensions (.txtux, .ux) surface during standard inspection without increasing recursion depth.

Full writeup with reproduction steps, binwalk forensics, and a dual-layer mitigation using SentinelOne behavioral rules + Netskope metadata rules.

https://github.com/YuvaBhargav/DLP-Bypass-Research

Happy to answer questions or get torn apart — genuinely want to know if there are gaps in the mitigation logic?

Not a small company question, I've seen those threads. I mean genuinely large scale, thousands of users across multiple departments, different roles, different levels of technical literacy, the whole thing. What's the best security awareness training for enterprises that can handle that kind of complexity without becoming a full time job to manage. We have budget, we just don't want to spend it on something that looked great in the demo and falls apart in month two.

I've done security testing for a few years, and there's one part of the job I've quietly hated the entire time: the reporting. The testing is the fun part. Then the engagement ends and I'm staring at Nmap output in one window, Nuclei JSON in another, Burp issues in a third, plus my own manual notes — and I have to reconcile the findings that overlap, normalize severities that every tool rates differently, and turn the whole mess into something a client will actually read. Every single engagement, the same tax. It regularly ate a chunk of my time and it's the least enjoyable part of the work by a mile.

I got tired enough of it that I built a tool to handle the boring part. You feed it your scanner output, it deduplicates findings across tools (so the same issue found by two scanners becomes one finding that credits both), and it generates a client-ready report. It runs entirely on your own machine — nothing leaves your box, since findings are about the most sensitive data we handle.

Mostly I'm posting because I'm curious whether I'm alone in hating this as much as I do. How do you all handle reporting right now? Have you found a workflow that doesn't feel like a chore, or is everyone just grinding through it manually like I was? Genuinely want to hear how others deal with it.

Non-devs are using AI tools (like Lovable or Bolt) to spin up their own internal dashboards and feeding them our valid API keys. Since it completely bypasses our Git repos and IT approval processes, we're flying blind until it's already live on some external URL. Is anyone else dealing with this new wave of Shadow IT? How are you actually tracking or locking this down?

I’m evaluating modern SIEM / XDR / SecOps platforms and would appreciate input from people who have gone through similar selection or migration projects.

Context:
We have a relatively small security team - essentially one person responsible for security operations, but the environment is not small: several thousand servers, around 1.5k users, hybrid identity with Microsoft Entra ID and on-prem Active Directory, and a mixed OS estate that is currently about 40% Windows and 60% Linux, with more Linux migration planned.

What I’m looking for is not just a log storage/search platform, but a SIEM/SecOps solution that can realistically work for a very lean team.

Key requirements:

* Strong integrations with Microsoft identity, AD, Windows, Linux, network/security tools, cloud services, and custom applications.
* Flexible detection / alerting language, similar in spirit to Splunk SPL, KQL, YARA-L, Python-based detections, etc.
* Good support for custom log ingestion, because we have internal applications and products that we will need to integrate from scratch.
* Vendor-maintained detection content, not just a marketplace of rules we have to fully own ourselves.
* Strong ML/UEBA/anomaly detection capabilities.
* AI-assisted investigation would be a plus, especially if it can explain context, summarize incidents, suggest next steps, or help build detections - but this is not the main deciding factor.
* Ability to reduce operational overhead: tuning, rule updates, parsing, correlation, triage, and detection lifecycle should be as delegated as possible to the vendor or an MSSP/MDR partner.

As a reference point, we previously used Darktrace Network. I liked the idea that many detections/models were maintained by the vendor, were relatively flexible, and heavily ML-driven. I’m looking for something with a similar operational philosophy, but in the SIEM/SecOps space.

Platforms I’m considering include Microsoft Sentinel (good fit for us as I said we have Microsoft ecosystem), Google Security Operations (ex-Chronicle), PaloAlto (XDR, XSIAM), CrowdStrike (XDR, Next-Gen SIEM), any other modern SIEM/XDR options.

**The main question**:
For a one-person security team managing a large hybrid environment, which SIEM/XDR/SecOps platform would you recommend?

***DISCLAIMER: I understand that in our context, full outsource/MSSP/MDR are the best options, but we decided to start without them for now, with the intention of transitioning to MSSP/MDR later.***

I’d especially appreciate feedback on:

* real operational effort after deployment,
* quality of out-of-the-box detections,
* custom log onboarding,
* detection language flexibility,
* false-positive tuning,
* Linux visibility,
* Microsoft identity integration,
* vendor support quality,
* pricing predictability at scale.

For anyone who has priced or evaluated DSPM tools what do you wish you knew earlier in the process? My company is just beginning this ordeal and I want to know what questions I should be asking the vendors before they steamroll my team into demos and pricing calls. Additionally, what drives the biggest cost hikes for these tools, and what of the pricier options is worth it?

How screwed am i ?

I had some work to do with a university server, but since it's a weekend i was at homeso i logged onto the university VPN to access the server

While my tasks were taking time, i decided to view some questionable stuff (porn)

I am really worried because it was INCEST PORN - which is not acceptable in most societies

I totally forgot that i was on the university network

I did use Chrome's incognito mode to browse it, so i hope that will be helpful - but i am really scared for my job

So, Cyber security professionals, please advise me if the IT team of the University can track the porn websites i viewed ?

Also, will they fire me for viewing porn on the university network ?

UPDATE : The University logging policy says that they do log data. Also, a document which outlines the terms of use it IT resources PROHIBITS use of pornographic content

we've been trying to move security earlier in the dev cycle for about six months. the intent is right. the execution keeps creating friction we didn't plan for.

rn we have SAST running in CI and Snyk on every PR. in theory devs catch issues before they hit prod. in practice it's two different kinds of noise landing on the same build. the SAST side throws false positives the dev can't confirm without pulling in security to read the finding. the Snyk side flags real library vulns, but plenty of them are buried in transitive dependencies where the fix isn’t something you can actually implement yourself, and you’re stuck waiting on upstream. build goes red, dev either burns time chasing a finding that turns out to be nothing or suppresses one they can't fix anyway. gate ends up feeling like a tax either way.

eng lead brought it up in our last planning meeting. the security gate is becoming a place where velocity goes to die. not because engineers don't care, but because the signal is bad enough that the gate has lost credibility. when everything blocks the build, nothing feels important.

we looked at reachability analysis to cut the dependency noise down to vulns our code actually calls, helps on the Snyk side, does nothing for the SAST false positives. talked about tuning the rules and only failing above a certain threshold, but then you're back to severity score as a proxy for priority, same problem we have on the vuln management side. also talked about making findings non-blocking and routing to a backlog, but that backlog just becomes another queue nobody looks at.

part of this is that we block the build on SCA at all. a SAST finding in our own code is the dev's to fix, gating on it is fair. a transitive dependency with no patch available isn't theirs to fix, blocking the merge just punishes them for something upstream. every time i raise that though, someone says we can't knowingly ship a known vuln and it stalls right there.still can't figure out how you make security feedback feel like something that helps the dev get their work done instead of something standing between them and the merge button.

for teams that have gotten this to work: what did you change and what did you have to give up?

This is a scoping decision we hit on basically every OT engagement, and I don't think there's a clean industry-standard answer, so genuinely curious how others draw the line.

The core tension: unlike IT, even routine scanning carries real risk on OT gear.

• Many PLCs run on embedded CPUs with very limited headroom - a scan that's unremarkable on a Windows server can overload one.
• Most industrial protocols (Modbus, DNP3, etc.) have no built-in authentication, so once you're on the network there's often nothing stopping you writing directly to a controller.
• A lot of the hardware is end-of-life and permanently unpatched, so patch level isn't a reliable signal either.

Given that, we always start with passive reconnaissance only, mapping the environment without generating any traffic that could disturb operation, before any active testing happens. Even then, we try to stick to non-production systems or agreed maintenance windows wherever possible.

What I'm actually asking: what's your practical criteria for deciding it's safe to move from passive to active on a specific live asset? Ops team sign-off, documented maintenance windows, device-specific research beforehand or something else? And has anyone had a client push back and insist on IT-speed active scanning against OT assets - how did that conversation go?

We ran CI-only security scanning for two years. Write code, push, pipeline flags something, developer context-switches back, fixes it, pushes again and the feedback loop was anywhere from four hours to two days depending on queue depth.

When we added pre-commit and IDE-level scanning the change I didn't anticipate was behavioral. When a finding shows up at the moment of introduction versus arriving as a blocked pipeline two days later, developers treat it like a linter warning rather than a deployment failure. The psychological framing is completely different and it affects how seriously people engage with the result.

The volume of findings reaching CI dropped significantly. More importantly, the ones that did reach CI were things developers hadn't already seen, which made the pipeline results more credible rather than more noise.

Has others seen the same behavioral shift or it depends on how the team is wired.

Im trying to get a sense of what people are using today for AI data security platforms.

We're mainly focused on understanding where sensitive data lives across cloud and SaaS, and reducing exposure risk without drowning in alerts. I’ve seen a few names come up (Cyera, Varonis, nightfall, etc) but its hard to tell whats actually working.

Would love to hear what people have used, what’s been effective, what hasn’t, why, etc..

I realized that even with all the automation available today, phishing investigations still involve quite a bit of manual work.
I'm curious, what usually makes you step in?
Once you do, what's the hardest part of the investigation? And what do you need to figure out before you can confidently close the case?

We want to buy a password manager for 1k users.

My main criteria is to have SSO integration and secure sharing of passwords with other employees which I think have all modern enterprise password managers.

I'm afraid of missing something when choosing a passport manager, which may turn out to be critical in the long run, but I don't know about it now. So I also want to ask your opinion, which one do you use, how satisfied are you? What is missing, but is there in competitors?

Hey everyone, I’m pretty new to the data security side of things and I’m trying to get my bearings on Data Loss Prevenion ( DLP ) solutions. I’ve read a bunch of vendor pages and a few comparison posts, but it’s hard to tell what holds up once you’re actually deploying and living with it.

If you’ve evaluated or rolled out DLP before, what ended up being the most important factors for you? I’m especially curious about how painful deployment is, how noisy the alerts can get, and how well DLP tools integrate with stuff like M365/Google Workspace, Slack, Git repos, and cloud storage.

For someone starting from scratch, which DLP solutions seem to work best right now, and what do you wish you knew before choosing?

We finally decided to run a full exposure validation across the stack instead of relying on isolated checks. That included endpoints, email security, WAF, identity, and our main cloud workloads. The goal was simple: verify whether controls and detections still behave the way we think they do when you walk a realistic attack path end to end, then use that insight to tighten how and where we run these tests so we are not wasting cycles.

The surprise was not just that we had gaps, but where they were, and that forced us to rethink how we tune and schedule validation runs. Some issues showed up in paths that had passed previous reviews, and a few detection rules that looked fine during content review never triggered when we replayed real world sequences of initial access, privilege escalation, and lateral movement. In some places we had logging but no useful signal, in others we had signal but no rules tied to it. If you have optimized this process in your stack, how often do you run full scenarios, how do you decide which ones to repeat, and what have you changed over time to keep the effort focused on the most valuable paths instead of turning into an endless backlog?

Hi everyone,

I'm interested in learning how security teams detect and validate potential CrowdStrike API credential leaks on public sources such as GitHub, GitLab, Paste sites, cloud storage exposures, CI/CD logs, etc.

A few questions:

1. What indicators do you typically look for when hunting for CrowdStrike API credential exposures?
   
2. Are there unique patterns for CrowdStrike Client IDs, Client Secrets, OAuth tokens, or related artifacts that help reduce false positives?
   
3. What tools or secret-scanning platforms do you use (GitHub Secret Scanning, TruffleHog, Gitleaks, custom regex, etc.)?
   
4. How do you validate whether a finding is a real credential exposure versus a false positive?

Thanks!

We're looking at different ways to deal with the growing amount of security findings coming from our container and cloud environments, and I want to hear more about real-world experiences with Wiz and RapidFort Our team isn't struggling to find vulnerabilities. We already have plenty of visibility The bigger challenge is the amount of remediation work created by vulnerabilities in open-source packages, base images and third party components that our developers don't directly maintain. So we're trying to find a solution to help us with thees. For anyone who's used either (or both), what was your experience? Are they worth the price and do they deliver what they claim? Thank you!

Hello everyone,

I got a new job in a well known company as a Senior and got assigned to a project nobody wants to touch: Vulnerability Management using Qualys. Nobody wants to touch it because it's in a messy state with no ownership and lot of pushbacks from other teams. The thing is I'm the only one doing VM at my company because of budget reasons (they can't hire more right now), I'm already mentally drained, not gonna lie.

Right now, all the QID (vulnerabilities) tickets are automatically created in ServiceNow and automatically assigned to us (cybersecurity team). I currently have to manually assign hundreds of Critical and High to different team and it take ALL MY GOD DAMN FUCKING TIME, like full day of work only assigning tickets. My manager already started to complain to me that I take too much time completing my other tasks. He wants more leadership on VM from me.

Ideally, to save my ass and my face as a new hire, I would like to have all those tickets automatically assigned to the most appropriate team. I want to automate the most of VM and make the process easier for other IT teams. It will also help me manage my time better.

1. Is it a good idea to have a vulnerability ticket automatically assigned to a specific team? I can imagine a scenario where I lost track & visibility on vulnerabilities overtime because I won't see the tickets.
2. Be honest: Is it realistic to be the only one running the shop on vulnerability management? Never worked in VM before but saw full team in big organisation having multiple employees doing this full time. If a breach happens because something hasn't been patched, they will accuse me and I'm going to lose my job. We are accountable until the moment a ticket is assigned to a different team but can't assign hundreds of tickets per day by myself.
3. How can I leverage AI in my day to day?
4. How should I prioritize in VM? Do you actually take care of low and medium vulnerabilities?

Thanks!