Given the recent talks online about how frequently users experience refusals despite using frontier models from Cyber-approved programs like Anthropic CVP or OpenAI Daybreak, to what extent are organizations utilizing open-weight models to perform internal red-team/pen-tests, and what does the setup look like?

1. Are you running the open-weights fully local on a self-hosted setup?
   1. If yes - What does that look like?
   2. While light-weight quantized SLM/MLMs can run on relatively cheaper setup but may compromise on quality and accuracy of data; whereas dense LLMs may require larger compute which isn't cheap. How do you balance this?
2. Are you using cloud-hosted models from third party inference providers like OpenRouter or CheaperInference which can help provide speed for a pay-to-use model? If yes, how do you ensure data privacy such that your data doesn't get processed or retained by the third party provider?
3. Are you geo-restricted to using American open-weight models only? if not, how do you justify leadership to use Chinese open-weight models like Deepseek or GLM?

Lynis Hardening Index scores from different Linux distributions, tested with their default configurations.

This is only a basic comparison of the results and is not intended as a definitive measure of overall security.

If you want to run your own test, read the installation instructions:
https://github.com/cisofy/lynis

Higher score: More security measures are in place.

Lower score: More security improvements are needed.

Lynis version used in the test:
3.1.7
Lynis command:
lynis audit system

 OPENSUSE  TUMBLEWEED (KDE)

Hardening index : 89 [#################   ]

  Tests performed : 250

  SECUREBLUE (KDE)

It was extremely slow during the test.

Hardening index : 79 [###############     ]

  Tests performed : 265

 FEDORA  (KDE)

Hardening index : 70 [##############      ]

  Tests performed : 253

  ANDUINOS 

Hardening index : 68 [#############       ]

  Tests performed : 262

  VOYAGER LIVE 

Hardening index : 68 [#############       ]

  Tests performed : 266

  ENDEAVOUROS  (KDE)

Hardening index : 67 [#############       ]

  Tests performed : 261

AURORA 

Hardening index : 66 [#############       ]

  Tests performed : 267

  BAZZITE  (KDE)

Hardening index : 66 [#############       ]

  Tests performed : 262

  GENTOO  (KDE)

Hardening index : 65 [#############       ]

  Tests performed : 240

  TUXEDOOS 

Hardening index : 64 [############        ]

  Tests performed : 268

  CACHYOS  (KDE)

Hardening index : 64 [############        ]

  Tests performed : 262

NIXOS  (KDE)

  Hardening index : 63 [############        ]

  Tests performed : 235

VOID Xfce (musl)

  Hardening index : 63 [############        ]

  Tests performed : 228

GARUDA  (Dr460nized)

  Hardening index : 62 [############        ]

Tests performed : 261

SOPLOS  (Tyson)

  Hardening index : 61 [############        ]

  Tests performed : 265

 GLF OS  (KDE)

Hardening index : 60 [############        ]

  Tests performed : 228

  KUBUNTU

Hardening index : 59 [###########         ]

  Tests performed : 240

  PIKAOS  (KDE)

Hardening index : 59 [###########         ]

  Tests performed : 252

People who work in AppSec or ProdSec which tools do you use and if you were to look for feature improvement in that tool what would it be?

Hey everyone,

I've been working in cybersecurity for the last 5 years, and over the past year I've been building a project called Vader-Pro-VDR, an AI-assisted Vulnerability Detection & Remediation platform.
So far, I've built:
A Go-based endpoint agent that collects system and software inventory information.

A backend API that receives and processes agent data.

AWS-hosted infrastructure for communication between endpoints and the backend.

A working proof of concept that can identify installed applications and their versions across endpoints.

My long-term vision is to build a platform that can:
Continuously identify vulnerable software and configurations.

Correlate findings with CVE intelligence.

Use AI agents to provide remediation recommendations.

Eventually automate certain remediation workflows in a controlled manner.

The challenge I'm facing isn't necessarily technical anymore. I've realised that a project of this scope is difficult to build alone.
I work remotely and don't have much exposure to the open-source community, so I'm looking for advice from people who have built or maintained open-source projects before.
Some questions I have:
How did you find your first contributors?

At what stage did you make your project public?

What communities have been most helpful for cybersecurity-focused open-source projects?

Are there common mistakes first-time maintainers should avoid?

What would make you interested in contributing to a project like this?

The repository is here:
https://github.com/Tridents10/Vader-Pro-VDR

I'm looking for honest feedback, technical criticism, and advice on how to take this from a personal project to a community-driven one.

Thanks in advance.

PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response).

Unlike traditional edr bypass techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.

Hi Everyone,

I’m planning to take the CyberArk PAM Sentry certification exam at a test center and would appreciate your guidance.

If anyone has recently taken this exam, could you please share your experience, preparation strategy, important topics, and any reliable practice questions or study resources?

I would also appreciate guidance on the exam pattern, difficulty level, and the types of questions to expect.

Any tips, sample questions, or legitimate practice dumps based on publicly available or authorized study material would be really helpful for my preparation.

Thanks in advance for your support!

Researchers from Google Threat Intelligence Group and Mandiant uncovered a sophisticated attack against software-update infrastructure belonging to AOMEI

AOMEI develops Windows backup, disk-cloning, and remote-access software.

Between April and July 2026, attackers repeatedly modified configuration files on the company's update servers.

What makes this attack unusual is how briefly the malicious changes remained active.

Some modifications lasted only five to ten minutes.

During those windows, computers checking for software updates could receive instructions to download malicious files.

The attack delivered malware researchers named CROSSROAD and SHINYROAD.

The attackers then restored the legitimate server configurations.

This made the compromise particularly difficult to discover through ordinary periodic security checks.

This is an important lesson about trusting legitimate software. Users could download the authentic application from its official developer and still become infected through a compromised update mechanism.

It also demonstrates why simply verifying a software publisher isn't always enough.

AOMEI reported taking corrective action after researchers notified the company. Just fixing the update servers does not always automatically remove malware from previously infected computers.

As mentioned in the title, I'm actually curious on what the most useful was in terms of:

• Learning new concepts and apply them to your job
• Advance in your career by opening more doors to better paying positions

In the past 5 years, I've worked as a Software Engineer, SOC Analyst, Incident Responder and now as a Security Auditor.

In total, I've only done the GCFA (GIAC Certified Forensic Analyst) certificate hoping to use all of the tools in my every day job but unfortunately that was not the case despite the huge amount of study for that exam. Though not really beneficial for my learning, it helped me landing a better paid job.

Now I'm here and probably going to work on the CISSP as I probably would like to steer into the direction of CISO (while at the same time my heart is beating for something more technical.. like Security Architect).

Additional Quesiton:

• For the ones that did the CISSP, what was something that you were able to apply to your job and to what percentage did it open the doors to better carreer opportunities?
• For the ones that did both CISSP and GCFA - how would you compare the workload? What was harder and which needed more work?

Thanks for all your opinions in advance! :)

I work as an IT specialist at a company, but I can’t really say I do much in the way of IT—it’s mostly just simple troubleshooting... I have a good understanding of networks and Linux, and I want to steer my career toward web penetration testing because it seems enjoyable and fun to me... But I have some questions: Is there a risk that AI might take over roles like SOC Level 1 in this field, and is this a promising career choice, or will I end up regretting it? Could the experts shed some light on this?

A open-source tool called CVE Intel. In simple terms, it pulls a bunch of security information sources into one place, and it doubles as an MCP server, so you can plug it into any of your AI agents.It's MIT licensed and written in Rust.

Paste in a CVE and it pulls from NVD, CISA KEV, EPSS, OSV, public exploit sources and others in parallel. You get a 0–100 risk score and a short "act now or later" answer, with the evidence listed so you can check it yourself. It also handles IPs, file hashes and dependency files. You can use it as a desktop app, a CLI, a REST API, or an MCP server for Claude Code, Cursor and similar tools. The AI part is optional and runs locally by default, so nothing leaves your machine unless you switch it to a hosted model. information is only as current as the public data.

I had this idea for a while and I'm still not sure exactly where I want to take it, so if you have any suggestions, I'd love to hear them. Feel free to contribute to the project. Thank you!

https://github.com/Fazmin/cve-intel

From Warehouse to Blue Team – My Journey Towards SOC L1 and Eventually DFIR

Hey everyone!

Back in 2010, I was doing some amateur web design, which I continued until around 2014. After that, my PC was pretty much just for gaming. I've always been a gamer, and I've always wanted a job that involved computers, but you know how life goes. I never had the experience, and probably not enough motivation to actually make it happen.

But over the past year, something changed. My motivation has been stronger than ever, and I finally decided to do something about it.

I spent about two months just watching videos, reading, researching, and trying to figure out what I actually wanted to do.

At first, I thought networking was the way to go, so I started with Cisco Packet Tracer and completed Network+ and Security+. But deep down, cybersecurity was always something I wanted to get into, even as a kid.

So I decided to fully commit to it. My long-term goal is DFIR (Digital Forensics and Incident Response).

I know this path takes a lot of hard work, patience, and curiosity. Luckily, I've got plenty of curiosity and motivation!

Over the last month and a half, I've been studying pretty much every day. I completed the TryHackMe SOC Level 1 pathway, along with a few additional rooms related to SOC and incident investigation.

At the same time, I've been doing LetsDefend and BTLO labs almost daily.

Here's a rough overview of what I've been learning and working with:

• Linux & CLI: Bash, sed, awk, grep, manually extracting data, filtering and investigating logs through the command line, including Linux and web server logs.
• Windows Event Logs: Spent quite a bit of time learning Sysmon, Security Event Logs, and System Events.
• Log analysis tools: Timeline Explorer for CSV files, Hayabusa for deeper Windows event log parsing, and occasionally DeepBlueCLI.
• Network analysis: Zeek logs, some basic RITA, Wireshark, and a bit of TShark through the CLI. Enough to start recognizing things like DNS exfiltration and suspicious network activity.
• Malware & email analysis: Basic malware investigation and analyzing suspicious email attachments using CLI tools.
• Memory forensics: Worked through a few labs involving raw memory dumps.
• SIEM: Hands-on experience with Splunk, ELK/Kibana, and Microsoft Sentinel. Splunk feels the most comfortable to me, although I have to admit that I find SIEM work a little boring compared to digging through logs manually in the CLI.
• Threat intelligence & enrichment: IP reputation checks, sandbox analysis, and other enrichment techniques during investigations.

I also have a ridiculous amount of printed cheat sheets lying around, and I'm constantly trying to learn several things at once.

And that's exactly where my problem starts.

After roughly a month and a half of seriously focusing on SOC L1 skills, I feel like I've hit a wall.

There's just so much to learn, and I'm starting to realize that trying to keep up with everything at the same time isn't sustainable. The more tools and techniques I discover, the harder it gets to decide what actually deserves my attention.

I enjoy digging into logs, investigating suspicious activity, and figuring out what happened. But I'm also aware that what I personally enjoy and what an entry-level SOC analyst actually needs to know might be two different things.

So here's my main question for you guys, especially anyone currently working as a SOC L1 analyst or who started their career in that role:

What should I REALLY focus on to become job-ready for a SOC Level 1 position?

Which skills should I know really well, and which ones am I probably going too deep into for an entry-level role?

I'm not looking for shortcuts, and I definitely don't expect to become an expert overnight. I'm more than willing to put in the hours. I just want to make sure I'm putting those hours into the right things instead of spreading myself too thin.

My motivation is huge, but I'm starting to understand that motivation alone isn't enough if there's no structure behind it.

Any advice, even a rough roadmap based on your real-world SOC experience, would mean a lot.

Thanks to anyone who takes the time to read this and share some advice!

31y Croatian [ live in Ireland ]

All the best guys

Are any organisations routing their azure access through PAM ? We are in a process of getting a PAM solution and would like to now the thoughts.

When I go to ic3.gov using chrome on two different networks I see an expired cert. Can anyone else confirm this independently? Thank you. I hope this is not off topic.