One thing I keep seeing in security discussions is don’t use personal apps for work but in reality people do it constantly. Someone sends a quick WhatsApp because Slack is down or a manager texts an employee, an executive forwards something to their personal email because it’s easier on their phone. Teams create unofficial group chats because the company tool is annoying.

Then security teams are expected to somehow protect information that is now scattered across five different places they don’t control. Part of me thinks the only realistic answer is a hard rule like if it’s work related, it stays inside company managed systems. No WhatsApp, Signal, personal email, SMS nothing. But I also know the stricter you make the policy, the more likely people are to work around it.

For people who actually deal with this, what works better in practice? Lock everything down as much as possible or accept that employees will use outside tools and focus on making that behavior safer?

Just wanted to hear from others working in cybersecurity, especially MSSP environments.

Lately, quite a few people from our team have been resigning, and I’ve also noticed people leaving from other departments. We’re not a huge company, so when several people start leaving around the same time, you definitely notice it.

What’s frustrating is that management already knows there are problems, but it feels like things are moving really slowly. There are meetings, discussions, and promises that things will get better, but so far, there hasn’t been much actual change.

It’s starting to feel like management only takes action after someone resigns, instead of trying to prevent people from leaving in the first place.

I’m not saying this to attack the company. I’m genuinely curious about how others have dealt with this.

At what point did you realize, “Okay, it’s probably time for me to move on”?

And for those who stayed through situations like this, did things eventually get better, or did more people just continue leaving? 🥴🤔

I know someone last week or so said the FBI grab on this guy was basically like a SWAT. But Krebs doesn't seem to think so.

"On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation....

A source close to the investigation told KrebsOnSecurity that Van der Stap’s Signal messages showed he had frequent conversations with Mr. Dubrovsky and with at least one executive at a large U.S.-based consulting firm, and that these executives often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach.

That source shared another potentially explosive finding by federal investigators: the Dutch hacker’s chats showed Mr. Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers, and that he never informed the bureau of the data breach prior to ShinyHunters threatening on Twitter/X to publish the agency’s deeply personal personnel files."

In addition to ConnectWise Cloud Backup, Updraft Cloud Backup was also compromised on the 17th/18th.

Much like with CW, the vendor's advice to customers would indicate that the platform itself wasn't the primary target, but rather the attacker is utilizing the dataset stored in the backup systems to get into customer environments instead.

No evidence that the two attacks are related, but it would be a hell of a coincidence.

https://teamupdraft.com/blog/security-incident-october-2026/

If you manage a WordPress site that uses Updraft, follow the remediation guidance ASAP. It appears that the attacker(s) are creating new admin accounts in WordPress sites.

As mentioned in the title, I'm actually curious on what the most useful was in terms of:

• Learning new concepts and apply them to your job
• Advance in your career by opening more doors to better paying positions

In the past 5 years, I've worked as a Software Engineer, SOC Analyst, Incident Responder and now as a Security Auditor.

In total, I've only done the GCFA (GIAC Certified Forensic Analyst) certificate hoping to use all of the tools in my every day job but unfortunately that was not the case despite the huge amount of study for that exam. Though not really beneficial for my learning, it helped me landing a better paid job.

Now I'm here and probably going to work on the CISSP as I probably would like to steer into the direction of CISO (while at the same time my heart is beating for something more technical.. like Security Architect).

Additional Quesiton:

• For the ones that did the CISSP, what was something that you were able to apply to your job and to what percentage did it open the doors to better carreer opportunities?
• For the ones that did both CISSP and GCFA - how would you compare the workload? What was harder and which needed more work?

Thanks for all your opinions in advance! :)

I don't know if this is the right place to start, so please redirect me if I am out of line here...

I have created a hardware device, basically a raspberry pi pico with a fingerprint sensor: when placing a finger on the sensor, it writes out a password as an HID device. The passwords are stored encrypted on the pico, the firmware is signed, it uses secureboot, so only my firmware can run due to a locked key in the OTP storage, which is fused to be read-only. The debug port is fused shut as well. For my needs (entering several passwords many times daily) it is sufficient and rather secure. But I like to have this confirmed.

The firmware is on github. Does anyone know of a service which can analyse the repo and tell me of vulnerabilites? I used claude.ai to create the firmware, but it went through many iterations until everything worked as I intended.

Edit: Github repo, for people curious: GreyDutchMan/identipi-key

Anyone use Bullhorn? They are currently trying to recover from an attack. Story still developing.

https://status.bullhorn.com/

Given my current ECE background, which path makes more sense right now: cybersecurity or hardware?

I've been thinking about a privacy question that comes up when building applications with local LLMs.

Running the model locally keeps inference on your own machine, but what happens to sensitive data across the rest of the pipeline?

For example, a RAG application might use embedding models, vector databases, external tools, logging, and conversation history. Depending on the architecture, customer information could pass through or persist in several of these components.

I'm curious how developers approach this in practice.

• Do you remove or redact PII before generating embeddings?
• Do you use synthetic data during development and testing?
• Do you use tokenization to preserve context while protecting sensitive values?
• Do you run the entire pipeline locally or self-host all supporting services?

The challenge seems to be protecting sensitive information without making retrieval less useful or debugging unnecessarily difficult.

For those who have built RAG systems or AI agent workflows, where do you enforce PII protection, and what trade-offs have you encountered?

I am currently unemployed unfortunately, but am looking into getting into cybersecurity field. As i am unable to afford the cybersecurity certs do you guys think its worth it to do the WGU cybersecurity bachelor degree as it comes with the certs, or just focus on doing homelabs to get the experience

Hi everyone, for some context I’ve graduated with an associates in cybersecurity and this is my first year at a new university trying to get my bachelors. I don’t have any work experience in the field unfortunately. All my cybersecurity experience has come from what I learned and did in my classes to get my associates.

One class that I’m currently taking is focused on database and web application security. It feels like all the things that the assignments are asking from me are things that I’ve never been taught beforehand. Reviewing the online lectures the teacher will briefly explain topics and then the assignment for that week will ask us to do things they never taught us how to do in any readings or lectures.

Here’s some more context and one example of a previous lab. This class has us using the OWASP juice shop in an Ubuntu VM with burp suite and foxyproxy as our testing environment. Those are the only things we were asked to download and use for this class.

The last assignment that I was working on, it asked us to create three database roles with strong authentication control, configure auditing mechanisms that log all failed authentication attempts, and generate a test sequence that triggers audit events and exports a sample log file capturing different user identifiers.

Everything I’ve written above is how it’s phrased in the lab. There were no prior lectures or reading that explained to us how to even perform these actions. Is it expected of me to just know this information? None of my previous classes went in depth to teach me about SQL databases, and now I’m feeling very stranded and lost. I didn’t even know where to start for that project. It feels like the only option I have this far into this major is to ask AI to teach me these topics in a simple way. I really want to setup my home lab when I finally have the time to, and I’m hoping to get an internship down the road but as of right now I feel so lost and like I don’t know anything. It feels like this class isn’t teaching me anything because I’m not at the level to even understand what is being talked about. It feels like every assignment asks us to do something that was never taught at all how to do in the class. So I’m left googling for hours and trying to piece together information I find just to get a half-assed solution. I worry that using AI could further ruin the potential amount of things I could learn.

I can’t tell if it’s just a bad teacher or it’s my own problem. The main reason for making this post is I want to ask for input on what things someone in my position (recently graduated with associates, no on the job experience) should already know by now in regards to cybersecurity/IT. If there are things mentioned here I’m not familiar with then I want to start researching them ASAP. As well as any non-AI resources I should make myself familiar with that can help my learning. I really want to succeed in this field and make sure all my time spent was not a waste. It’s a scary feeling taking classes and feeling like the teacher isn’t teaching me anything.

A open-source tool called CVE Intel. In simple terms, it pulls a bunch of security information sources into one place, and it doubles as an MCP server, so you can plug it into any of your AI agents.It's MIT licensed and written in Rust.

Paste in a CVE and it pulls from NVD, CISA KEV, EPSS, OSV, public exploit sources and others in parallel. You get a 0–100 risk score and a short "act now or later" answer, with the evidence listed so you can check it yourself. It also handles IPs, file hashes and dependency files. You can use it as a desktop app, a CLI, a REST API, or an MCP server for Claude Code, Cursor and similar tools. The AI part is optional and runs locally by default, so nothing leaves your machine unless you switch it to a hosted model. information is only as current as the public data.

I had this idea for a while and I'm still not sure exactly where I want to take it, so if you have any suggestions, I'd love to hear them. Feel free to contribute to the project. Thank you!

https://github.com/Fazmin/cve-intel

Are any organisations routing their azure access through PAM ? We are in a process of getting a PAM solution and would like to now the thoughts.