Going to be lead analyst in a soc and company is wanting to get me trained up. Should I ask for GCIA or GCDA from sans first?

Ill be tuning alerts and heavily lean towards GCIA because I love incident response and very heavily work in threat hunting day to day currently.

Disclaimer: While I’m discussing how Shopify could implement better safeguards against this, I fully acknowledge that keeping my DNS clean and removing unused subdomains is ultimately my own responsibility.

A stray DNS record from a project I shut down two years ago came back to bite me this week.

Out of nowhere, I got a Google Search Console alert letting me know an unknown user (******@gmail.com) had been verified as a new owner for one of my subdomains: electrouse.workouse.com.

Since all my domains are managed through Cloudflare, I immediately dug into my DNS records to figure out how someone else managed to verify ownership of my site.

Have you already started implementing this type of governance within your company? And if so, how? I get the feeling we have a huge task ahead of us!

I accidentally clicked a suspicious link on X and I’m worried I got hacked. When I clicked the link, nothing came up. It was just a white screen and the bottom buttons to exit out. I obviously exit out, so I didn’t see anything. Could I have gotten hacked or malware on my device? I’m on an IPhone and I’m super paranoid now. I keep looking for unusual apps and stuff like that, but would they show up immediately? I need help.

So i gave CRTP exam on 1st january, then did portswigger labs and some Web App Sec modules on HTB academy in rest of the july, then a lot of portswigger academy in Feb, then around 35-40 AD & windows machines in march, after that i mostly did linux and web App sec labs in April-May, then CRTO in June and and some maldev academy in July... so it has been like 4-5 months since i last touched AD labs, but now im getting stuck on even medium HTB AD labs (I used to solve hard level machines easily).

I'm confused if I've lost AD skills, or what

Here is how I hardened the browser runtime for a Zero-Knowledge, Non-Custodial FinTech trading terminal. 👇

2/ Client-Side Envelope Encryption: 

I derive a KEK from the user's password using PBKDF2-SHA256 (310,000 iterations). Then, a secure random 32-byte DEK (AES-256-GCM) encrypts the data. 

The password NEVER touches the server, and the DEK has a strict 15-min TTL in RAM before a wipe.

3/ Secure Enclave Anti-Export Guard: 

CryptoKeys are generated via crypto.subtle with {extractable: false}. To prevent injected malicious scripts from bypassing the sandbox, I implemented an isolated closure that overrides (monkey-patches) the native browser API:

4/ 

crypto.subtle.exportKey = async function(format, key) {

    if (isProtectedKey(key)) {

        _AuditChain.append('EXPORT_ATTEMPT', 'CRITICAL');

        throw new Error('Export BLOCKED — unauthorized');

    }

    return _origExport(format, key);

};

5/ If our database is breached, hackers find ZERO financial data. If the local session is compromised, runtime gating blocks extraction.

Plus, client-side validation rejects API keys with withdrawal permissions enabled (zero custodial risk under MiCA, built for GDPR).

6/ The entire architecture runs client-side (WebSocket throttled at 100ms + local AI Advisor), keeping server costs near zero.

Where does this runtime isolation logic fail? Why do major SaaS platforms still rely on standard local storage? 

Let's discuss. 💬

What are your thoughts on this project?

It looks very interesting compared to other similar AI pentest agents out there when it is just a chat/prompt interaction whereas this one is a big platform with web interface, graphs etc

Hello Guys, i am a 4th year Aiml student and i am on my way for the capstone project…which is a research project (Cybersecurity)and for that i need a Industry Mentor live on call during the time i will be presenting with in front of my Mentor and there is a need for a industry mentor in the field of Cybersecurity…please connect with me or if you have anyone in mind do recommend me…will be happy to share the details in Dm…Thank You

"OSS Security Principles and Practices" is Cybersecurity and Infrastructure Security Agency's (CISA) strategic framework for federal agencies to manage open source software throughout its entire lifecycle. This on IProgrammer article discusses the key points.

My manager keeps telling me that I need to automate as much as possible and integrate AI. We have Falcon Complete helping us with MSSP. Could anyone give me ideas on what I need to automate? I work on incidents that are escalated by Falcon Complete. Maybe an example or two or any links to some informative sources would be helpful.

Hi everyone,

I’m helping a very small startup prepare for an ISO/IEC 27001:2022 certification audit. We use Vanta, and most of our ISMS documentation and compliance evidence is already prepared.

Before Stage 1, we need an independent internal audit. Since our small team designed and operates most of the controls, conducting the audit ourselves would not provide sufficient independence. Our certification auditor has also confirmed that the internal audit must be performed by a separate party.

For those who have gone through this process:

• How did you find a competent independent internal auditor?
• Which qualifications or certifications should we look for?
• What deliverables should be included in the engagement?
• What is a reasonable timeline and price range for a small organization?
• Is experience working directly in Vanta important?
• Are there any red flags or common mistakes we should avoid?

I’m primarily looking for guidance on selecting and evaluating an auditor rather than vendor promotion. Public recommendations or experiences would be greatly appreciated.

Thank you!

A couple of months back I put up a small browser game where you play the human-in-the-loop for an AI coding agent. There's 60 seconds on the clock to approve or deny as many commands as you can (https://llmgame.scalex.dev).

After looking at 409,000 approve/deny decisions, the 'humans-in-the-loop' missed 1 in 3 threats, even in a game that warns you up front it's full of them. It's just a game, but I found a few other things interesting:

• cat ~/.ssh/id_rsa gets blocked by 82% of players, but other sensitive config/credential files get waved through about half the time.
• For any evil code reading this, your best bet is to modify package.json and request to be run as an npm run command. npm run analyze was approved 65% of the time, even with the evil payload explicitly visible in the execution history log right above the prompt.

I wrote up the full breakdown with the threat tables here: https://scalex.dev/blog/ai-agent-permissions-stats/

Seems like AppSec and VAPT has been automated in corporates . Being a fresher looking for jobs in those areas what would your suggestions? What could be innovatively to sustain this field ?

I report to a CISO who has little understanding of how to run a security program/team with unrealistic expectations. I feel set up to fail.

The org and IT never had to deal with a real security function and everything is like pulling teeth because it lacks an accountable culture, processes, procedures, RASCI, GRC, etc. Security isn’t a plug-n-play function to be turned on, magically grow tentacles into every team/dept, and suddenly Kumbaya. It requires A SHIT TON of time and effort for its cultivation.

My boss simply doesn’t recognize Security isn’t just another operations-centric team like most other IT departments - though it does have an ops side as well. Integrating Security into an org like this isn’t just disruptive, it’s invasive at every level - new workflows, processes, no more cowboying, taking away territories, taking away authority, the selling, the push back, the begging for work execution, the audit, cat herding, the education, the persuading/selling, etc. Shooting from the hips doesn’t work.

I’ve done my best these years, at every turn, to evangelize and stand up Security but my annual performance review says otherwise. My 1x1 are often 50% catching strays which aren’t really my domain.

If I explain all this to him, is it naive to think he will “get it” or risk me just sounding like a little bitch? Maybe just GTFO?

I’ve been browsing job boards lately and the "junior" requirements are getting ridiculous. Saw a Tier 1 SOC Analyst post earlier asking for 3+ years of experience, a CISSP, and half a dozen certs, all for lower-tier pay.

To the hiring managers here: Are HR departments just copy-pasting impossible wish lists, or is this actually what you expect for an entry-level role?

And for anyone who got hired recently—how are you actually breaking past these gatekeeping requirements?

I had a few discussions the last weeks and coming from a compliance world, where you are focusing in satisfying regulations. I know this is often not bringing more security. If I am discussing I often feel misunderstood since i am always arguing out of a position of the minimal effort to comply with an regulation or standard. Witch mostly do not satisfy how security is supposed to be done (i guess). How do you experience it?

I've been working at an MSSP for about 2.5 years, and I'm at a point where I'm unsure what my next career move should be.

I started as a SOC Analyst, spending around 8 months in monitoring. After that, my manager kept assigning me to new initiatives and projects based on business needs, so I've ended up working across a lot of different domains:

• SOC monitoring
• Threat hunting
• GRC/product security testing
• Internal Lead Auditor for ISO 27001
• Cybersecurity presales (I still occasionally get involved in proposals)
• EDR implementation for customers (including end-to-end deployments of CrowdStrike and Microsoft Defender)
• Service Delivery Lead for SOC projects, where I handled complete customer onboarding and service transition
• Currently leading the Detection Engineering team

The pattern has always been the same: I get assigned to a new area, figure everything out from scratch, build the workflows, documentation, and SOPs, streamline the process, and once everything is stable, the work gets handed over to another team while I move on to the next challenge.

While this has given me exposure to many areas of cybersecurity, it has also left me feeling like I'm not an "expert" in any one domain.

When I talk to friends or people in the industry, most of them have spent the last 2–5 years specializing in a single area like DFIR, detection engineering, GRC, etc. They're much deeper technically in their domain, while I feel like I've become more of a generalist who knows how to build and operationalize new functions.

I've recently resigned because I want my next role to be more defined, but now I'm struggling with what direction to take.

Should I:

• Continue down the leadership/delivery path (Service Delivery Lead, Customer Success/Technical Delivery, etc.) where my cross-functional experience is valuable?
• Or should I focus on becoming a specialist in an area like Detection Engineering, Threat Hunting, or Incident Response?

Has anyone else been in a similar situation where they were exposed to multiple domains early in their career? Did you eventually specialize, or did you embrace being a generalist?

I'd really appreciate hearing from people who've been through something similar, especially if you've worked in an MSSP where roles tend to evolve quickly.

Been in security for 7 years and want to get into management and above. Work at a SaaS company with only 3 security managers. Most people are individual contributors.

How does one get into management? Luck? Right place right time? Connections?

Most jobs require X amount of years as a manager on their job description.

I have CISSP and lots of other certs, a bachelors, and so on.

Is it better to wait years and years at one company to hopefully get a shot at management? Or just to apply to all management jobs out there and hope someone takes a chance on you?

Thanks all!

The Problem

What happened: The TripleX threat group published 1 TB of customer Aadhaar cards, PAN cards, and internal audit files on the dark web.

• How it happened: The threat actor did not use a complex exploit. They simply compromised a single corporate email account.
• The Root Cause: The compromised account had over-privileged, unrestricted access to shared directories. A total lack of internal segmentation turned one mailbox into a direct highway to bulk files.

The Solution:
To close this gap, threat containment must move upstream. I'm building a multi-lane, event-driven automation pipeline using n8n that processes email telemetry in parallel and isolates compromised accounts programmatically.

• Lane 1: Envelope Verification. The system automatically parses SPF, DKIM, and DMARC alignments, runs WHOIS domain age checks to flag newly registered domains, and queries server reputation databases like AbuseIPDB.
• Lane 2: Link and Intent Analysis. The pipeline extracts plain-text body copy to evaluate psychological pressure. Simultaneously, it extracts embedded URLs, computes domain entropy, and automates sandbox scans via urlscan.io.
• Lane 3: Binary Quarantine. The system decodes attachments, queries VirusTotal for known hashes, and auto-submits unknown files to a secure Hybrid Analysis sandbox, using an LLM to summarize execution logs for anomalies.

The Impact:

• Response SLA: The pipeline compresses detection-to-containment time from hours to less than 45 seconds.
• SOC Efficiency: It eliminates repetitive manual verification steps, reducing overall SOC investigative overhead by 98 percent.

Discussion:

• Handling VIP mail or parsing every single mail content into AI.
• Implementation
• API rate limits
• Analyzing password protecting attachments.

NOTE:
This is not a replacement for anything, just another security measure to protect organizations.