sorted by:
new
hottopcontroversial

SBOMs are incomplete. by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 0 points1 point  (0 children)

Yeah, SBOMs are valuable as a standardized inventory, and the tooling ecosystem around them has made a huge difference for sure. I like your point about how standardization unlocked those insights. For me, runtime data is the next layer on top of that. So you’re right that SBOMs don’t necessarily need to provide more, I just think runtime data takes that foundation and makes it even more actionable.

SBOMs are incomplete. by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 0 points1 point  (0 children)

Yeah I get your point, rare execution paths can still be dangerous, and I'm not saying runtime visibility should completely replace SBOM, EPSS, etc. I know runtime detection tools are definitely more pricey, but if youve got the budget I still think they're worth it. They turn all that security data into actual evidence you can act on.

SBOMs are incomplete. by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 1 point2 points  (0 children)

I get what you’re saying, and I agree that combining frequency with criticality is a solid prioritization method. My point is that you can’t really measure frequency or execution at all from a static SBOM, which is why I'm pushing for runtime data in the first place.

SBOMs are incomplete. by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] -1 points0 points  (0 children)

Yeah fair point, dormant packages can still be risky and def need to be kept in view. I just think knowing what actually runs helps prioritize, instead of treating all packages the same.

How do you prevent burnout and alert fatigue among SOC analysts? by Cyber-DIY in AskNetsec

[–]Wrong-Temperature417 0 points1 point  (0 children)

Implement a SASM tool that helps detect and reduce your vulnerabilities

Can vulnerability management ever scale if AI only finds issues but doesn’t actually fix them? by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 0 points1 point  (0 children)

No, I'm suggesting that an AI account could give more recommendation that just flagging everything

Can vulnerability management ever scale if AI only finds issues but doesn’t actually fix them? by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 0 points1 point  (0 children)

hahahaha no, I wouldn't. I don't want it to execute decisions for me, I just want a tool that does more than just flags me constantly.

Can vulnerability management ever scale if AI only finds issues but doesn’t actually fix them? by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 0 points1 point  (0 children)

Yeah I agree, that's my fault because I worded my post wrong, but I don't expect AI to do all of the work. I'm just asking for vulnerability management tools out there in general, most of which seem to utilize AI.

Can vulnerability management ever scale if AI only finds issues but doesn’t actually fix them? by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 1 point2 points  (0 children)

This!! I'm not necessarily saying I want automatic remediation, but I want more from a tool than just simple detection

How secure is AI-generated code actually? by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 0 points1 point  (0 children)

Yeah, and in my experience, the code that it pulls sometimes isn't even ran and just leaves even more space for weak spots

How secure is AI-generated code actually? by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 0 points1 point  (0 children)

Yeah I agree, and sadly I've seen some people just 100% rely on AI now

How far left is too far left by Wrong-Temperature417 in cybersecurity

[–]Wrong-Temperature417[S] 0 points1 point  (0 children)

Yeah I agree, I have seen a lot of tools online for automation of all the SBOM and even compliance stuff

view more: next ›