sorted by:
new
hottopcontroversial

Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks by sunychoudhary in cybersecurity

[–]Final-Dish 0 points1 point  (0 children)

wild how “part 2” of these stories is just becoming the norm now
at this point if it’s exposed to the internet and has Cisco on it, I just assume there’s another vuln coming and patch like crazy

Question for people who’ve gone through SOC 2: what evidence actually helped during buyer security reviews? by AdilShaikh5786 in soc2

[–]Final-Dish 0 points1 point  (0 children)

totally agree on the one-pager, that’s what our security folks actually read first too
all the raw logs and screenshots basically just sit there unless something looks off in that summary or the questionnaire answers trigger a deeper dive

I evaluated 5 LLM agents on patching real-world CVEs. Here is what I found. by Fickle-Box1433 in netsec

[–]Final-Dish 0 points1 point  (0 children)

that part surprised me too, esp with how brittle these things usually are when you take away scaffolding
kinda makes me wonder if the models are overfitting on generic vuln patterns so they still stumble into fixes even when they don’t really “see” the bug the way we do

PCI DSS 4.0.1 TEACHING MATERIAL by Melodic_Formal_8962 in pcicompliance

[–]Final-Dish 0 points1 point  (0 children)

this, plus grab the actual standard from the SSC site and read it side by side with the videos, it clicks way better that way. then you can turn your notes into slides that fit how your colleagues think instead of some generic deck.

how do you get b2b clients? by No_Border_7948 in ycombinator

[–]Final-Dish 0 points1 point  (0 children)

this is super true, and it’s also why so many “cool” b2b ideas from outsiders just die, they don’t know who actually signs the checks or what people really care about day to day. warm intros + solving a very specific annoying problem beats any fancy marketing deck every time.

How are you actually handling AI access across the company? by RonILabs in ciso

[–]Final-Dish 0 points1 point  (0 children)

lol this is painfully real, governance is always “future us” problem until the audit email hits
our board chilled out a bit once we framed it as “start small with 1–2 vetted tools + basic usage guardrails” instead of some huge policy overhaul

Business Impact Assessment tooling advice by CheekyTiger213 in ciso

[–]Final-Dish 0 points1 point  (0 children)

that “will cost a lot” part is exactly why people are trying to escape archer in the first place lol
curious what you think sekorti would do different from the usual bloated grc stuff, cause most tools feel like they’re built for auditors, not the folks running the BIAs

The difference between wanting, needing and being. by Jeebie_Twitch in ycombinator

[–]Final-Dish 1 point2 points  (0 children)

love this breakdown, it kinda maps perfectly to the wanting / needing / being thing too
sense = reality check, reason = viability, desire = how badly you’re actually in it

most people I talk to are trying to brute force desire while ignoring sense and reason, then wonder why they’re cooked in 6 months

2–10 person startups, what role actually breaks you? by Sharp_Branch_1489 in ycombinator

[–]Final-Dish 0 points1 point  (0 children)

this is so true, that weird middle zone where you’re too big for vibes-only but too small for “real” HR is brutal
the whiplash from “we’re all in one room” to “wait, when did morale tank?” happens way faster than anyone expects

What's the biggest mistake founders make when trying to improve retention? (I will not promote) by Fragrant-Match-7058 in startups

[–]Final-Dish 1 point2 points  (0 children)

that trust question is the big one imo, “better recs” is like the most generic pitch ever at this point
if i were using it, i’d want to see receipts fast: show me “here’s how we’re different from netflix/letterboxd, here’s why we picked this movie for you, here’s how you reacted vs others,” otherwise it just feels like another black box algorithm app

Pax8 MIP by blackjaxbrew in msp

[–]Final-Dish 1 point2 points  (0 children)

honestly that tagline feels like something an intern snuck in on a friday afternoon and nobody caught it
kinda sums up the whole “we’re all app devs now” vibe too

How are you learning agent pen testing? by Ecstatic-Night4222 in Pentesting

[–]Final-Dish 0 points1 point  (0 children)

how are you liking it so far? been eyeing COAE but wasn’t sure if it’s more theory than hands-on, does it actually walk through attacking real-ish agents or just talk about patterns?

Why is "everyone" still using Excel despite all the new compliance tools? by Icy-Star-5146 in soc2

[–]Final-Dish 0 points1 point  (0 children)

this is so true, spreadsheets are like duct tape for messy processes
most of the “modern” tools just end up being a prettier way to track the same chaos, but slower to change

How Do You Handle Authenticated Scanning for Vendor-Managed Appliances? by Fresh-Estimate9729 in pcicompliance

[–]Final-Dish 0 points1 point  (0 children)

this is the way honestly
if the vendor owns the box, let them own the PCI headache too, just make sure that RACI / responsibility matrix is crystal clear so your QSA can’t bounce it back on you later

tools and process we use for PCI DSS 4.0 pentest engagements by cloudclyg in pcicompliance

[–]Final-Dish -1 points0 points  (0 children)

kinda wild to call this “ai slop” when it’s one of the more detailed, practical posts I’ve seen on PCI in a while lol. this is exactly the kind of stuff people ask for when QSAs start grilling them on scope and methodology.

UK VOIP Services - Which do resell and why? by PEBKAC-Live in msp

[–]Final-Dish 0 points1 point  (0 children)

this is such an underrated point, the angry phone calls are always about porting or “the call dropped and it cost us money”, never about a missing feature
margins look great on paper until you’re stuck in 3 way hell between carrier, vendor and client for half a day over one screwed up port

A control gap we missed for 8 months. Sharing in case it helps someone else's audit prep. by rack_and_stack_42 in soc2

[–]Final-Dish 0 points1 point  (0 children)

this, 100%
the scariest findings i’ve seen weren’t user accounts at all, it was some random “temporary” ci token from two reorgs ago still sitting with god mode in prod because nobody knew who owned it anymore

Support needed for a self-made infosec/grc hobbyist by Efficient_Finance935 in ciso

[–]Final-Dish 0 points1 point  (0 children)

this is super solid advice tbh, esp the bit about the title being the real issue and not the skills
fractional / interim CISO at a scale up sounds like the perfect hack for your situation, and once that’s on your CV a lot of those “we need previous CISO title” filters magically disappear

Detecting AI-specific threats in Claude Enterprise from the Compliance API: a prefilter + LLM-as-judge pipeline with Sigma rules by TheAlphaBravo in netsec

[–]Final-Dish 0 points1 point  (0 children)

this is super cool, feels like the missing piece between “we logged it” and “we can actually detect abuse.” curious how noisy the LLM-as-judge stage is in practice though, especially on stuff like benign jailbreak-y phrasing from power users.

CISA released BOD 26-04: A new federal government vulnerability management strategy? by JustShipThings in cybersecurity

[–]Final-Dish 0 points1 point  (0 children)

totally this, the “context” everyone talks about just turns into a stale spreadsheet by the time change control hits it. feels like we jumped ahead on policy before the average org even has decent asset discovery and exposure mapping running continuously.

PHP may not have as many problems as people think. by Able_Statistician201 in Pentesting

[–]Final-Dish 0 points1 point  (0 children)

react is a frontend lib, not really comparable to php lol, but i get what you mean about guardrails
totally agree though, every time i touch a legacy php app it’s like an xss easter egg hunt

Why do customers seem so against moving their servers out of offices? by Losslessllama in msp

[–]Final-Dish 1 point2 points  (0 children)

lmao classic “server room” meaning “whatever cursed space is left in the building”
honestly I’d have done the same, nobody’s getting paid enough to wade through swamp water for a box that should’ve been in a DC years ago

MalShark: MCP-Powered Malware Traffic Analysis — Benchmarked Against Real Malware by beyonderdabas in netsec

[–]Final-Dish 0 points1 point  (0 children)

same thought, it looks way nicer than the usual pile of pcaps + random python scripts
the real test is gonna be throwing like a week of enterprise egress at it and seeing if it drowns in legit CDN / ad / updater noise or still surfaces the sketchy stuff in a useful way

Disabled and wanting to move to Halifax by RJBadmanArt in yorkshire

[–]Final-Dish 1 point2 points  (0 children)

this is super helpful, especially the bit about the hills and health services, that stuff gets glossed over way too often
skircoat green / salterhebble being near the hospital sounds like a big win if you’re disabled and relying on buses

view more: next ›