News · r/AskNetsec
-
r/AskNetsec
How are LLMs actually being used in static analysis?
Hey guys, I’ve recently been reading papers that use LLMs to understand code logic and infer security-related semantics from source code and comments. I’m curious how people with hands-on experience in static analysis or white-box security testing view these approaches. Can LLMs actually help overcome limitations of traditional static analysis, such as complex inter-procedural data flows? How rel…
-
r/AskNetsec
Two scanners rated the same CVE on the same host 9.8 and 5.3 so i spent a week tracing it, turns out one cant log in on that subnet and both are measuring different things
Every Monday i build the fix-these-first list and the two scanners barely agree on what belongs at the top of it, which for a long time i put down to one of them being bad. Then i took a single host with a single CVE and diffed the two findings field by field, one said 9.8 and the other said 5.3, and the gap turned out to be three separate things stacked on top of each other. The scanner calling…
-
r/AskNetsec
What methods work best for discovering unmanaged TLS certificates across an enterprise network?
For teams managing PKI across a mix of on-premises servers, cloud workloads, and internal applications, how do you identify certificates that aren't already tracked by your central certificate inventory? I'm particularly interested in certificates issued by internal CAs, self-signed certificates, and certificates deployed manually by individual teams. These can be easy to miss if discovery relies…
-
r/AskNetsec
Ho do you let staff use AI without company data leaking out?
Everyone worries about people pasting into chatgpt. For us the problem was access. Someone wired an agent into the drive to save time and it could read every client's folder, the one it needed and all the others. Blocking the consumer tools did nothing there as the agent was approved. We scoped what each AI thing can reach and a co worker only sees the records for the job its doing and the rest s…
-
r/AskNetsec
Best Varonis alternatives for on-prem data?
Our team is evaluating data security posture management platforms, but our strict zero-egress requirement is making it tough. A lot of modern tools seem to force you into multi-tenant SaaS. We have sensitive internal files and database records that cannot leave our network perimeter under any circumstances. Sending raw payload data out to a vendor cloud is an absolute non-starter for our security…
-
r/AskNetsec
How do you evaluate ASM tools when the CMDB blind spots are half the problem?
Been asked to lead attack surface discovery and the first thing I see is CMDB, cloud inventory, DNS all disagree on what we own externally. we are lining up a poc for a few ASM tools, same limited seed list for each, and we keep quiet about some subsidiaries and vendor managed infra we already know about. Idea is to see who can link unknown asset discovery back to us with decent attribution inste…
-
r/AskNetsec
Compliance Assessment vs Pentest
Im just curious to get people's thoughts. In regulated environments... why do people think so highly of pentests and so little of compliance assessments, when they both do the same thing: determine if an organization is meeting its controls? In all of the pentest engagements I have sat in, most of the findings are the same (unpatched server, app not upgraded, admin account creds cached on a box,…
-
r/AskNetsec
Anyone actually trust their ai endpoint security to catch what traditional EDR misses?
For ppl running ai endpoint security tools alongside a normal endpoint detection and response EDR stack, how do you handle the overlap in practice? I am especially interested in what gets flagged that EDR alone missed, and how much manual tuning it took to get the false positive rate down to something a SOC can actually act on. The harder question is what happens once agents start running with re…
-
r/AskNetsec
Container image hardening keeps stalling because nobody will own what breaks
Weve had a hardening project open for three quarters now. The scanning half was easy and the cutting half keeps getting handed back, because no service owner wants to sign off that removing a package is safe. Im looking at tooling that produces runtime evidence for what an image touches so the decision stops being a judgement call. Six teams and no central platform group makes this political more…
-
r/AskNetsec
How should a historical vulnerability warning be evaluated when there is no confirmation it was received?
About a year before a major public-sector cyber incident, my colleagues and I accidentally discovered a security issue that could potentially expose personal information on a very large scale. We worked with one affected party to fix the issue, but realized the underlying problem could exist elsewhere. We subsequently sent an anonymous warning through an official government reporting channel, exp…
-
r/AskNetsec
CISOs: how are you securing AI agents?
For agents that can call tools, access internal data, send messages or change things in other systems, how are you putting guardrails around them? I’m trying to understand where policy gets enforced, how teams handle prompt injection and sensitive data and where all of that shows up for security afterward. Are you handling this inside each app, through the existing security stack or with a separa…
-
r/AskNetsec
How are you handling the appliance nobody has a parser for?
Every environment I've worked in has a load balancer or door controller or UPS that sends its own idea of syslog and nobody ships a parser for it. Right now it's our door controllers, whose messages change shape every firmware update, so failed badge events stop alerting until I patch regex nobody else on the team can read. Is there a saner way to keep parsing for those boxes from breaking or is…
-
r/AskNetsec
Will sandboxed AI attackers become part of normal security testing?
Security testing today usually means scanners in CI, periodic human pentests, or carefully limited tests against staging or production. I’m curious whether another model will become normal: a disposable “attack twin” of the current production environment. The idea would be to generate an isolated environment from the same deployment artifacts, infrastructure-as-code, IAM model, network policies,…
-
r/AskNetsec
How are you guys reducing security risks with AI agents?
I saw a few posts discussing how more people are giving AI agents access to real tools and business systems, and it got me thinking about how people are actually handling the security side of it. Personally I have been trying to understand the best way to give agents access to things like emails, APIs, DBs etc without giving them too much access. There are things like readOnly access, approval ga…
-
r/AskNetsec
How should my team prioritize DSPM findings when there are thousands of them?
Feeling overwhelmed and looking for some help with how my team should prioritize DSPM findings when it seems like our company's data security is being held together by a duct tape and chewing gum. Is there a general best practice for how we should be working through this never ending list?
-
r/AskNetsec
Why do so many recent breaches start with a leaked API token or service account?
Going through breach reports from the last year and it's the same story over and over. Leaked API tokens and OAuth apps nobody remembered approving. Nobody phished a person, just found a key under the mat... Are non human identities the easiest way in now and what are you doing about the ones nobody owns?
-
r/AskNetsec
Keeping security questionnaires short for vendors isn't really about deleting questions
Used to think shortening vendor questionnaires meant taking the 180-question monster and cutting it down until people stopped hating us. starting to think that's the wrong way to look at it. the easy part is deciding that a tiny SaaS with no prod access probably doesn't need the same review as a critical vendor touching customer data. fuzzy bit is what happens after that. say an analytics vendor…
-
r/AskNetsec
Sentry spiked after a deploy and I couldn't tell who changed the config
Had a really annoying afternoon last week. Sentry started lighting up after a deploy and it traced back to a changed value in one of our config files. Easy enough, I just needed to know who changed it and when. GitHub's audit log showed the push, but it came through a token that a few different things use. No way to tell if it was a person, a pipeline, or some script somebody wrote months ago and…
-
r/AskNetsec
How do you verify whether an AI-described security flaw is a real, documented thing versus a confident fabrication?
I do a lot of reading where an AI assistant explains a security concept, and the explanations sound authoritative — but I've learned not to trust that on its face. Sometimes the described thing turns out to be well-documented and real; other times it seems to be invented, just dressed in real-sounding terminology. The pattern I keep noticing: the individual pieces are all legitimate (real terms,…
-
r/AskNetsec
What do you log when retrieved text steers a tool call?
A red team test run caught 3 of 500 cases where retrieved context included HTML with a diagnostic instruction that pushed the model toward a fetch_url call to an external host. Our tool allowlist and egress control blocked it, so nothing left the environment. At first the call looked like an ordinary diagnostic fetch, but once someone expanded the retrieval span (not done by default) it became ob…
-
r/AskNetsec
How do you handle Suricata/Zeek tuning without a dedicated detection engineer?
Follow-up to something that came up in a Suricata/Zeek FP/FN tuning thread a few weeks back, got some genuinely great answers, including people doing solid context enrichment (process/user/hostname/known-destination) instead of relying on raw thresholds, and running pcap-based regression tests on every rule change. Curious about the other end of that spectrum: for teams that don't have someone de…
-
r/AskNetsec
How do you prioritise security findings beyond severity scores?
If you have 50 findings and time to address five, how do you choose? I’m exploring a tool that uses business context to explain priorities, assign owners and track resolution. Would that help your team, or does your current setup already cover it? Interested in what works—and where the process breaks down.
-
r/AskNetsec
Ransomware defense: prevention, runtime containment, and recovery — is there a role for human approval?
Following the previous discussion, I have been thinking about ransomware defense as three distinct layers. Prevent intrusion Prevent the attacker from gaining access in the first place. There are already many established controls here: phishing-resistant MFA, least privilege, patch management, endpoint protection, email security, network controls, and so on. Prevent an intrusion from becoming a c…
-
r/AskNetsec
How do you run a tabletop that actually tests your SIEM/detection stack, not just the human response plan?
Most tabletop exercises never check whether our detection rules or SIEM correlation would have caught the scenario in the first place. I want an exercise that stress-tests whether our actual telemetry would surface the attack path we're simulating.
-
r/AskNetsec
How are teams tracking cross-service assumptions that never get documented as a security boundary until one gets broken?
Had a change to a discount calculation pass code review clean, ship, and break an invoice service two days later. Not a vulnerability in the changed code itself, the invoice service had always assumed the incoming value arrived already tax-adjusted, and that assumption lived only in its own code, undocumented anywhere the reviewing service or its owners could see. This isn't really about vulnerab…
-
r/AskNetsec
How do you handle revocation for offline-verifiable delegated tokens when policy state changes after issuance?
Edit: thanks for all the replies, summary of where I landed in the comments below. I'm working on pre-execution authorization for autonomous agents, and I've hit a revocation design question that I think applies to any delegated capability token. Setup: A principal gets a signed authorization after policy evaluation (budget limits, rate/velocity limits, kill switch). It can derive a narrower dele…
-
r/AskNetsec
Is anyone actually doing detection triage well, or is it always an ad hoc clean up?
Alert triage, deciding whether a given alert is a threat, gets a ton of attention. Detection triage, periodically deciding whether a detection rule itself is still pulling its weight, severity still right, still catching real things, gets way less structured attention. A badly performing detection is arguably a bigger root cause of noise than any individual bad alert, since one bad detection gene…
-
r/AskNetsec
Is agentic code/cloud security actually cutting noise or just shuffling it around?
There's so much marketing rn claiming agentic tools "find what matters" but from what i've seen irl its often just a different flavor of noise dressed up as prioritization. anyone used one of these long enough to say if signal to noise genuinely improved or if it just moved the busywork from triage to double checking the agent lol.
-
r/AskNetsec
How did you quantify insider risk to get budget approved?
Leadership wants hard numbers before approving any spend on insider risk or data access governance tools. I have plenty of anecdotes, like a former contractor who still had live access and tens of thousands of external shares of unknown sensitivity. That is not enough for a CFO. I need to translate the problem into dollars or risk language that actually gets funded. How have you quantified inside…
-
r/AskNetsec
Why does our EASM inventory change so much between scans?
We’re using an EASM tool that started with a set of domains/IP ranges we gave it, and I’m noticing the inventory changes quite a bit between scans. Some assets disappear, others show up, and occasionally we get things that don’t look like ours at all. Is this just unavoidable with external asset discovery, especially with cloud/CDNs/shared infrastructure? Or is this a sign that the tool isn’t doi…
-
r/AskNetsec
Stuck between FortiCNAPP (Lacework) and Upwind for our manufacturing cloud, tell me what I'm missing
Im the security lead at a manufacturing org, cloud footprint is growing but the team is small. Were down to two CNAPPs and somehow stuck. We started with a longer list with all the big players included, but these two were what the shortlist came down to. Hoping the room can tell me what Im missing. First one was Lacework, now FortiCNAPP after Fortinet bought them. I liked it on paper, but the acq…
-
r/AskNetsec
Anyone finished their Varonis on-prem migration? What did you replace Varonis on-prem with?
With the December 31 deadline getting closer, I’m curious what others have actually ended up choosing. For those who can't move to the SaaS platform: On-premises requirements, data residency needs, or internal datahandling policies and what did you end up with? I’ve seen people evaluating options like Quest Change Auditor, Netwrix, ADAudit Plus, and similar tools, but curious what actually worked…
-
r/AskNetsec
Should we all just accept we are compromised no matter what we do?
I've tried to set up Obsidian for myself and before downloading obsidian-git (a community plugin) to version control my notes, I read this warning: "Plugins can execute arbitrary code on your device. We recommend back up your data before enabling them." This scared me so I didn't approve. But then I got to thinking: What VSCode, Sublime Text and VIm with their 100's of plugins and extensions? Eac…
-
r/AskNetsec
How are you actually enumerating everything an AI agent can reach?
Most teams or even solo people seem to start by grepping access logs and building a list from whatever shows up. but that only tells u what the agent touched and u end up with a partial inventory and no real way to know how much is missing working outward from the credential is finite and you can actually finish it. every major platform has two separate tools for this which is probably a good sig…
-
r/AskNetsec
Do phishing simulations become less useful once employees learn what the test emails look like?
One thing Im constantly wondering about with phishing simulations is whether people just end up learning to pick out the company's test emails after a while. Too many campaigns and those same old wording tricks, senders, and patterns start to become all too familiar. Now at that point, your click rates might actually go up, but Im not convinced that means employees would suddenly be any better at…
-
r/AskNetsec
Discovered multiple critical security flaws and evidence of fraud in a corporate contest/giveaway. What would you do?
Hi everyone, I'm posting from a throwaway account for obvious reasons and will keep all details completely generic. Recently, while looking at a public online contest/competition run by a private company, I noticed several alarming issues: **Multiple severe security vulnerabilities:** The platform has flaws that expose participant data and allow arbitrary tampering/manipulation of submissions and…
-
r/AskNetsec
How should I analyze the “threat model” of a security paper compared with the broader threat-modeling process?
I’m trying to learn how to systematically analyze the threat model of security papers, but I’m confused because “threat model” seems to mean different things in academic papers and in broader threat-modeling practice. For example, MDN describes threat modeling using four questions: 1. What are we working on/building? 2. What can go wrong? 3. What are we going to do about it? 4. Did we do a good j…
-
r/AskNetsec
How did you sequence a phased SASE deployment?
Just about to start moving off our old hub and spoke VPN to SASE and im not doing it big bang, that feels like a great way to take the whole company down on a Monday. Phasing it instead. Rough plan is cloud SWG first and split the internal traffic back to the existing VPN, get remote users off the legacy client early since thats where the pain is and leave the site tunnels and full TLS inspection…
-
r/AskNetsec
Is there a common way to find an info-sec contact method for a US company?
Is there a common way to find an info sec contact method, such as an email address, for a US company? Is there a standard email format based on domain names? The organization has a website, but no security or general "contact-us" form or email address that I could find. The only contact method I saw was a job portal for applicants to upload a resume. My concern is not PII or health-related. There…
-
r/AskNetsec
Hypothetical: If you could redesign the Internet from scratch, how would you build the protocol stack to make censorship architecturally impossible?
Assume you can go back in time to the early days of networking (pre-TCP/IP, early ARPANET) with today's knowledge of cryptography, routing, and state-level censorship tools (DPI, IP/SNI blocking, middleboxes). How would you design the foundational network architecture so that any state or ISP choosing to route traffic must accept either 100% uncensored, unmonitored connectivity or a complete blac…
-
r/AskNetsec
Hardening M365
What are your best tips for hardening an M365 environment that go beyond the basics (e.g. enable 2FA)? I'm managing a small environment and have done the baseline security stuff (18/20) and our Defender score is at like 75% when other organizations our size are at like 45%... not bad, yet it feels like every few months I discover something dumb I should have turned off (or, rather, that shouldn't…