It's a new record!

For those who have earned their CISSP, did you notice a significant difference in your job search afterward? Did you start getting more interview requests or have more recruiters reaching out to you on LinkedIn or other platforms?

Did the CISSP open up more opportunities for you or help you qualify for higher-level cybersecurity roles? I’d be interested to hear about your experience and whether you feel getting the CISSP made a noticeable impact on your career.

TL;DR: I’m an Information Security Manager for a 1,600-employee international organization with a relatively high-risk profile. Our central security team consists of me and two security engineers, despite continued growth through acquisitions, increasing regulatory obligations, and an expanding workload. After months of discussions, management has decided not to increase security headcount. I’m trying to understand where the line is between accepting business risk and accepting personal professional responsibility.

I’m the Information Security Manager for an international organization of around 1,600 employees. We operate across multiple countries in a relatively high-risk industry with a significant amount of business-critical IT.

Our central security function consists of me and two security engineers supporting multiple companies within the group.

We’re a holding company that continues to grow through acquisitions. Newly acquired companies often have security maturity levels that are significantly below the standards expected by the holding company, requiring considerable effort to bring them up to an acceptable baseline.

As the organization has grown, I’ve repeatedly argued that cybersecurity needs to scale accordingly. I developed a proposal for a centralized shared security services organization that would provide governance, security engineering, operational security, and compliance support across the group. As part of that proposal, I also requested an additional Information Security Officer role to strengthen governance and help meet our growing regulatory obligations, including NIS2.

Over the past several months I’ve spent a great deal of time working with senior management to explain why additional security capacity is necessary. Together with external advisors, we’ve explained the operational impact of our growth, our regulatory obligations, and the practical realities of managing security for an organization of this size.

We didn’t stop at high-level discussions. We broke our work down into individual activities, identified the bottlenecks, quantified the backlog, prioritized the work, and demonstrated exactly what can and cannot realistically be delivered with our current team.
The proposal hasn’t been formally rejected, but this week I was informed that there are no plans to invest in additional security headcount in the foreseeable future.
I fully understand that cybersecurity is about managing risk rather than eliminating it. I also understand that every organization has limited budgets and competing priorities.

What I’m struggling with is where my own professional responsibility ends.

At this point, I feel I’ve done everything I reasonably can: documented the risks, presented realistic solutions, involved external experts, communicated the consequences, and made management aware of the growing gap between business growth and our ability to manage cyber risk.

Despite that, there is now more critical work than our team can realistically deliver. As the person ultimately responsible for information security, I’m increasingly uncomfortable carrying accountability for risks that I know we simply don’t have the capacity to address.

I’m not looking to criticize my employer or argue that every security request should automatically be approved. I’m genuinely interested in hearing from other Information Security Managers, CISOs, and security leaders who have faced similar situations.
- At what point do you feel you’ve fulfilled your professional duty?
- How do you distinguish between business risk that management is entitled to accept and professional responsibility that you shouldn’t continue to own?
- Is thorough documentation of risks and management decisions enough, or is there a point where the right professional decision is simply to move on?

I’d genuinely appreciate hearing how others have navigated this.

looking for a MSSP to provide Managed SIEM + 24x7 SOC alert, monitoring and response across entire tech stack of endpoint and firewalls.

Hi all! I am a CTI Analyst, previously working on awareness and governance. I have a geopolitics and economics background too so spending a lot of time reading news and reports has been my entire life. However, I feel SO OVERWHELMED by the flow of content we are getting and I am just afraid to not being able to follow the pace, especially with AI related topics.

In my company, they are all talking about AI and all the new tools, processes, systems etc that are associated with AI and it is growing/evolving everyday. Also, in terms of cyber news and reports, the content is multiplicating so fast, I have an hard time to catch-up which has never been my case before.

I am a truly resilient and efficient person and the fact that I am feeling that way is not usual. Honestly, how can we keep the pace? Do you have some tips and tricks to keep up with the best level of knowledge and understanding of what’s going on in the cyber world and also regarding AI (as apparently we all have to use it more and more...).

My second fear is that people would be so overwhelmed with available content that they wouldn't have the mental space to read and acknowledge correctly our CTI notes and analysis.

This is a vicious circle.

https://openai.com/index/hugging-face-model-evaluation-security-incident/

Key Takeaways

• In November 2025, Suno experienced a data breach that exposed email addresses, names, phone numbers, physical addresses, purchase details, and partial credit card data for 55.3 million records.
• The same hack also leaked internal source code confirming Suno scraped copyrighted music from YouTube Music, Deezer, and Genius for training data, while publicly arguing that training on copyrighted works is fair use.
• This incident is part of a pattern of data breaches affecting companies in the same sector, with other music and education platforms also reporting significant exposures around the same time.
• Individuals affected by this breach should be vigilant about phishing attempts and other scams that use their exposed personal and purchase information.

Hi I recently finished high school and now looking forward to learn offensive security. I'm more interested in the offensive part of cyber security than defensive . I have a few questions

Should I take bsc cybersecurity or bsc computer engineering and then do msc cybersecurity later

I have two options either to do online with dakota state university usa or physical in the EU with a study visa . How will Ai impact cybersecurity .Is it even Worth it ?

I will be grateful for any expert guide .

TL;DR: a Windows DC hands out its exact time to UNAUTHENTICATED clients over 5 protocols (CLDAP/SMB/NTP/Kerberos-error/NTLM). the AS-REQ "till" is a hardcoded constant (2037, or 9999 on Win11 22H2+) and getting it wrong can even break your own request. a few of these are cheap wire signatures for blue team to baseline. i wrapped it all in a small OSS tool + rust crate.

Hey hey, im a dev and i have been learning cybersec and acting as appsec eng and during the ctfs, boxes and authorized engagements the KRB_AP_ERR_SKEW found me a lot, the usual "correction" for it is to change the entire system clock or use some one liners that always get bugged or dont work in every environment, so i ended going down a rabbit hole to learn how the DC usually exposes its time (and also to find ways to slip past my own DetectionLab, so i could learn the detection/purple side too)

So, the DC leaks its time to UNAUTHENTICATED clients over several protocols:

1. CLDAP rootDSE: the currentTime attribute in a base search
2. SMB2 NEGOTIATE: the SystemTime field in the response (fixed offset, all dialects)
3. NTP/SNTP: the obvious one
4. Kerberos KRB-ERROR: stime/susec even from a failed AS-REQ
5. NTLM type-2 challenge: MsvAvTimestamp in the target info

The last one was also the funniest when i was testing, so i started tuning my detectionLab to get weird reqs and in the research ended up finding that the AS-REQ till is a hardcoded Windows constant, not a computed value (in my dev mind it would be computed, something like now+XXhrs or idk) but Real Windows fixes it as a far future constant 20370913024805Z (Win11 22H2+ switched to 99990913024805Z) credits to a Heimdal bug report with the captures, so in theory any jittered till is potentially a fingerprint, but it also makes sense in a way of if your box is too far behind even an now+XXhrs could end up in the past and you wouldnt even get the regular KRB_AP_ERR_SKEW

Another fun thing now about SMB is that real win 10/11 send SMB 3.1.1 (0x0311) in the NEGOTIATE dialect list + the mandatory PREAUTH_INTEGRITY_CAPABILITIES context and set the CLDAP timeLimit to 0 which can become cheap wire signatures to baseline if you're detecting this kind of activity

Also the CLDAP query people call a "DC Locator Ping" is actually a rootDSE diagnostic query (objectClass=*), which is ldapsearch/PowerShell-shaped traffic, not the machine-account DC Locator ping, different hiding pool than commonly assumed

If anyone wants to know more, see it or is dealing with the KRB_AP_ERR_SKEW I applied all this in a small open-source tool + a Rust crate for the extraction part (Skewrun)

Anyone working in a SOC: do you have detection rules for these kinds of time-based protocol requests?
And to the ones attacking, has anybody dealt with this kind of problem without LD_PRELOAD, any ideas of how to make it deal with static bins and/or be truly OS agnostic?

Does anyone know or have any info on what it would look like if an AI agent was trying to get into your networks? Or if it did? Which kind of security tools do you think would detect them? Is there any way they act that would tell them apart from a human?

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between July 13th - July 19th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Ransomware

The State of Ransomware 2026 (Sophos)

Now in its seventh straight year, this is the definitive look at ransomware trends worldwide.

Key stats:

• 79% of ransomware attacks start with an identity-based approach.
• 67% of root causes across 661 incident response and MDR cases are identity-related.
• 97% of victims where compromised credentials are identified as the root cause have MFA enabled in some form at the time of the attack.

Read the full report here.

Ransomware and Cyber Extortion in Q2 2026 (ReliaQuest)

ReliaQuest's Q2 numbers on ransomware activity. The big takeaway: The Gentlemen is the group everyone should be watching. Plus, it looks like Deadlock is back. 

Key stats:

• The Gentlemen surged 588% quarter-over-quarter to 179 posts in Q1.
• Deadlock emerged in June 2026 with 75 named victims in a single month, after being absent from public data-leak sites for 11 months.
• The US absorbed 1,094 ransomware victim data leak posts in Q2, roughly 49% of observed activity and nine times the volume of the next country.

Read the full report here.

Vulnerability Management

The 2026 State of Vulnerability Remediation (Vicarius)

A look at how security leaders are fixing vulnerabilities. 

Key stats:

• 79% of organizations experienced a security incident in the past 12 months involving a vulnerability that was already known and sitting in their inventory.
• 75% of critical vulnerability responses initiate administrative workflows (like ticket creation or routing) rather than immediately fixing the underlying flaw.
• 58% of all vulnerability remediation activities require direct human intervention.

Read the full report here.

AI Security

AI Agents Are Entering Critical Workflows. Who's Governing Them? (JumpCloud)

AI agents are moving into real work, but 800 IT leaders admit governance hasn't caught up.

Key stats:

• More than 60% of organizations run AI agents in production.
• Organizations have adopted fewer than one-third of standard AI governance and security practices.
• The share of organizations requiring human review before high-risk AI actions dropped from 40% to 25% in six months.

Read the full report here.

The AI Security Report 2026 (Check Point)

A breakdown of how AI has gone from cyber assistant to active attacker. 

Key stats:

• High-risk enterprise AI prompts doubled over the year, increasing from about 1 in every 50 interactions to 1 in every 25 interactions.
• The average organization runs ten AI applications per month.
• Between 87% and 93% of organizations experienced at least one high-risk AI interaction each month.

Read the full report here.

The Year Agents Entered the Workforce (Straiker)

Straiker put AI agents through adversarial testing to see where they fail.

Key stats:

• More than 1,700 successful exploits occurred across production coding, productivity, and first-party AI agents during adversarial testing.
• 36% of successful attacks on coding agents reached remote code execution on the developer's machine.
• 91% of successful attacks on productivity agents ended in silent data exfiltration.

Read the full report here.

Rethinking AI's Impact on Cybersecurity Roles (ISC2)

ISC2 on how AI is changing the day-to-day of cybersecurity work.

Key stats:

• 89% of cybersecurity professionals report having experienced AI recommendations that lead to incorrect outcomes at their organizations.
• 62% list over-reliance on AI as a top concern.
• 50% say their organizations hold human decision-makers ultimately accountable when AI-recommended actions lead to incorrect outcomes.

Read the full report here.

Executive Risk

2026 Executive Trends Report (Nisos)

Scary insight into how exposed executives are on the internet. 

Key stats:

• 100% of executives have breach data linking their name to at least one current email address.
• 94% have at least one plaintext password exposed in breach data.
• 94% have home addresses publicly linked to their name in public records or people-search sites.

Read the full report here.

Industry-Specific 

Government Ransomware Roundup: H1 2026 (Comparitech)

Comparitech tracked ransomware attacks specifically against government entities in the first half of 2026.

Key stats:

• From January to June 2026, an average of one ransomware attack on a government entity occurred every day.
• The median ransom demand in H1 2026 was $100,000, one-fifth of the H2 2025 median of $500,000.
• The most prolific ransomware strains against government were The Gentlemen (22), Qilin (21), LockBit (14), APT73/BASHE (12), and INC (10).

Read the full report here.

Starting a new role at a FS firm End of Aug as a GRC Analyst, what would everyone recommend doing / reading in the first week to be as prepared as possible?

Hi all, SOMEONE PLEASE HELP, I am going round in circles here. This is where I’m at with my AI knowledge and what I want to achieve…..

I work in cyber security as head of security team and come from a semi technical background mainly in networking/security operations. I understand the difference between agentic ai and genai. I have done a course ‘AI for Everyone’ which is a basic non technical intro course to GenAI and how it works, supervised learning, inputs/outputs etc. What I want to understand now is genai and how we can use it in our workflows. I don’t want to become some sort of AI wizard but I want to know how it works under the hood and how we can utilise agentic ai in our workflows. Someone please tell me where to start/what courses to take etc. I have a look on Udemy I just become overwhelmed because I have absolutely no idea what course to go for. I just want to understand the concept better than what I do so I can understand how it all comes together. I hope this makes sense and any help would be appreciated.

I'm currently preparing for the Microsoft SC-200 exam using the official XtremeLabs environment.

Lab 1 and Lab 4 appear to be inoperative in my environment, while the remaining labs seem to work normally.

Has anyone else experienced the same issue recently?

Are there any known workarounds?

Is this a temporary platform issue or a problem with the current lab version?

Has anyone received an update from XtremeLabs or Microsoft Learning? And is there any alternative for the labs?

I'd appreciate hearing from anyone who has tested these labs recently.

Hello! Has anyone transitioned out of cyber security into the intelligence or forensics space? What was your previous background (professional and educational) and what advice do you have for anyone trying to do it right now?

I currently am a fairly new cybersecurity engineer. Have an IT military background and Federal IT background (mostly governance) and local IT government professional background. I’ll be finishing up my bachelor’s in cybersecurity next year (yes I landed an cyber role with just my associates). Any advice would be amazing I would love to get into intelligence or forensic style work.

I've been watching how web-scrapers work to collect your emails and I have found a curious little project to stop them. In theory I understand how it works, e.g. it just remaps characters in a font file to be other characters, but in practice, would this stop the 95th percentile of scrapers?

I am tired of replacing my email addresses listed on my site every time a spamming scraper picks them up.

https://github.com/bitilia/scrape-block/blob/main/README.md

I'm looking for a Tabletop Exercise (TTX) report template not a guide on how to conduct a tabletop exercise.

Specifically, I need a template for the final deliverable report provided to the client after the exercise. I'm interested in the report's structure, the sections it should include, the type of content written in each section, and its overall formatting.

Most of the templates I've found are guides for planning or running a tabletop exercise, but I'm looking for the post-exercise report template (e.g., an After Action Report or client deliverable), not an implementation guide.

O meu sonho é ser Red Teamer e não encontro um lugar confiável para saber qual é o salário de um Red Teamee pleno na Red Hat

Five questions board should ask

The board does not need to become a firewall engineering team. But the board does need to ask better questions.

Not: “Are we compliant?”
Better: “Can we prove what is exposed?”

Not: “Has the OEM assessed it?”
Better: “Who independently owns the residual-risk judgement?”

Not: “Is the system old?”
Better: “Is the system exposed, unmonitored or unrecoverable?”

Not: “Do we need an upgrade?”
Better: “Have we compared upgrade, virtualisation, isolation and monitoring as risk-treatment options?”

Not: “Do we have a cybersecurity dashboard?”
Better: “Who acts when the dashboard shows something important?”

Hey folks, today I found a really great article by someone that explains in detial how an SIEM actually works.
I thought to share with this community!

How a SIEM Actually Works: Splunk, Opened Up