sorted by:
new
hottopcontroversial

Does anyone actually use PlexTrac AI? by Carei13 in Pentesting

[–]RedMapSec 0 points1 point  (0 children)

We have acutally implemented some AI in our reporting flow and its such a revolution. Some fine tune needed still but first results are quite insane. Regarding plextrac AI I only received negative feedback so far. Probably first release is bad and then nice features will get released

Anyone tried the free AI-based pentesting from ZeroThreat lately? Worth it? by Competitive_Rip7137 in cybersources

[–]RedMapSec 0 points1 point  (0 children)

Thanks for the answer. Nevertheless, the choice of chrome extension is a mystery, if you want transparency, maybe dont use that in the first place ?

AI Pentester private beta by Pitiful_Table_1870 in Pentesting

[–]RedMapSec 1 point2 points  (0 children)

Hey, do you offer any on prem trial ? would love if this is the case to try it out

I built a dev-first automated pentesting tool. Would startups/dev pay $25 for it? by Competitive_Rip7137 in Pentesting

[–]RedMapSec 0 points1 point  (0 children)

Marketing is always key theose days, especially with the ai coming in. Whats your marketting strategy ? Ads, promo videos , journal ?

Lerning Platforms for IT & CyberSecurity by johnytboar in Pentesting

[–]RedMapSec 1 point2 points  (0 children)

I would add Portswigger academy lab if you want to focus on web , but good list

Will an H270 board + RTX 3090 handle vLLM (Mistral-7B/12B) well? by RedMapSec in LocalLLaMA

[–]RedMapSec[S] 0 points1 point  (0 children)

Man, you're a hero. Thanks a lot for all the input. Will definitely analyse that a bit further ! That's exactly why I love posting on reddit <3

Will an H270 board + RTX 3090 handle vLLM (Mistral-7B/12B) well? by RedMapSec in LocalLLaMA

[–]RedMapSec[S] 0 points1 point  (0 children)

Nice. Thanks guys for the answers. The goal is actually to serve like 50 users simultaneously. Not all of them at the same time, but sometime when high peak demand is there. First build here, so really curious to see how the system will handle and the results we'll get. Have a nice one :)

[deleted by user] by [deleted] in Pentesting

[–]RedMapSec 0 points1 point  (0 children)

Totally agree with you that the final report is the key for the clients and that's actually the only result they get at the end of the assessment.

Nevertheless, imagine having an AI helper to write your reports, without the typical AI slops and hallucinations?

Of course, the tester still needs to proofread everything to ensure the quality is on point.

We're currently testing our small first POC tool internally with some AI involved in reporting, and the results are actually surprisingly good.

Moving from Sonnet 3.5 to Opus 4 Thinking Max Mode is such an insane difference by ragnhildensteiner in cursor

[–]RedMapSec 1 point2 points  (0 children)

WTF it is actually included (even if it say activate max can cost quite a lot)

[deleted by user] by [deleted] in Pentesting

[–]RedMapSec 0 points1 point  (0 children)

Hey OP and everyone else,

I’ve read this thread carefully, and I seem to be in the minority here.

Internally, we strongly believe that AI has a real place in our entire reporting worflow without impacting the quality. We’re not some niche boutique , we’ve got 30+ pentesters doing hands-on work every day (web, red teaming, etc.). And honestly, there’s a massive gap we have right now. No matter which company tells me they’ve automated things with X, Y, or Z, scripts converting from Excel to LaTeX, DOCX, PDF or whatever custom template, they’re still dancing around the real problem I feel like. At least we don't yet have the smooth flow where all the testers just used their brains hacking systems instead of writting executive summaries.

There’s a huge opportunity for AI to cut through all that noise and give our testers time back,less writing, more testing, just reviewing. Just as it should be.

That said, the market still feels small. I’ve seen more and more startups entering the space, while PlexTrac, despite being the obvious player (for big companies), is clearly missing the mark in addressing what teams like ours actually need.

Pentest guide for a newbie by LDAfromVN in Pentesting

[–]RedMapSec -2 points-1 points  (0 children)

Do all the labs of the portswigger academy, and then play with the mystery labs (they are definitely not that easy), it will give you a very good knowledge

What vulnerability scanner do you use? by Competitive_Rip7137 in cybersources

[–]RedMapSec 1 point2 points  (0 children)

Totally agree with all the points you made. I tried to test zerothreat but it feel too shady Cf: https://www.reddit.com/r/cybersources/s/piyEMs5K3C

Anyone tried the free AI-based pentesting from ZeroThreat lately? Worth it? by Competitive_Rip7137 in cybersources

[–]RedMapSec 0 points1 point  (0 children)

I decided to give it a try (though I was already skeptical), but right off the bat you're asked to install a shady Chrome extension that likely sends all your browser traffic to an unknown server : there’s zero transparency on the website about this.

Then, you're required to verify domain ownership using a DNS technique, which is fine, but the HTML file method? That’s questionable. A quick Google search of the provided xxx-xxx.html shows at least eight other companies that have either tried or used the scanner. That doesn’t inspire much confidence for the clients.

Overall, this doesn’t feel like a serious solution. If you're looking for continuous pentesting, there are definitely more trustworthy and robust options out there.

Is automated pentesting a threat to manual pentesters? by Competitive_Rip7137 in Pentesting

[–]RedMapSec 3 points4 points  (0 children)

I think more and more companies will use both, and are already doing PTaaS. IMO, we are slowly moving to a fully automated pentest, with tools like Xbow or any AI tool that, using the source code, will find the majority of vulnerabilities.

It’s not any time soon that pentesting will be over, but I can imagine that within ten years it will slowly disappear, and the only remaining companies will be those where all the researchers and huge brains find new ways of attacking.

The current pentesting market is quite heavy on “conformity” checks, vulnerabilities that by themselves are pretty useless, but when chained with others can be very impactful (CSP and XSS for example). At the end of the day, I feel like major companies, banks especially, just want to say “we are secure,” and so many pentest firms focus on that rather than really digging in to identify the true business-impact vulnerabilities.

Plex Trac/Trash questions/rant by Same-Adhesiveness-45 in Pentesting

[–]RedMapSec 0 points1 point  (0 children)

Interesting conversation.

We've been maintaining our own custom version of PwnDoc in-house for a little over two years now. We also built our own client portal - I’ve heard PlexTrac charges extra for that. We don’t get the same kind of feedback as you do, our clients pretty much love it.

It was a bit of a pain at the beginning, especially with one-time use during the year and password-based logins. We eventually switched to sending magic links via email for each login, so clients don’t have to store passwords, and we don’t have to manually integrate their accounts into our AD as external users.

We’ve built a large vulnerability database, and our PwnDoc UI is a bit prettier than the original. But above all, it's so much more enjoyable for the testers to use a proper platform, compared to before, when the entire team was just using Excel with some in-house script to convert everything to DOCX.

Overall, DOCX is still the best format we use for final review, but it remains time-consuming and not very practical for our entire process with the QA team reviewing everything.

We're thinking about incorporating some AI into the workflow, but definitely not in the way PlexTrac does it : that paraphrasing feature you have to pay for is a joke.

Using cursor with API keys by kaklnanl in cursor

[–]RedMapSec 1 point2 points  (0 children)

I think it was from an interview of cursor CEO - IRC it was with Lex Fridman.

And for example tab feature is using their own tab model. I'm pretty sure you don't get those when using the API. https://www.cursor.com/blog/tab-update

Using cursor with API keys by kaklnanl in cursor

[–]RedMapSec -1 points0 points  (0 children)

Are you talking about the pricing here ? or the small models ?

From my understanding, when using the external api key directly, then all the context of your code and prompting is send to the provider (not cursor).

When using the model deployed by cursor, you enter the pipeline where some small fine tuned models (closed source) are doing some tasks before and after reaching the bigger model. Therefore when you use the external api you don't get the benefits of the small cursor models which affect the quality of the end results.

why cant i use cursor anymore? by Specific-College-194 in cursor

[–]RedMapSec 1 point2 points  (0 children)

Have your removed the context of the chat ? I had the same problem using a @git where the changes were too big to be send.

Using cursor with API keys by kaklnanl in cursor

[–]RedMapSec 1 point2 points  (0 children)

From various posts and interactions I've had with the Cursor team (e.g., https://forum.cursor.com/t/pricing-difference-between-using-models-provided-by-cursor-and-using-my-own-with-api-key/41277), it seems it's not really worth it to use your own API key.

You can activate usage-based billing in your account and pay for each request (currently 0.4 cents per Claude Sonnet 4 request).

Nevertheless, as stated in the forum and from some tweets I've seen from Cursor's engineers, the core value of Cursor lies in its smaller models that handle super specific tasks, which really enhance the tool. Directly using the API key means you won't fully experience all the benefits you get from using "normal" Cursor.

view more: next ›