News · r/AskNetsec
-
r/AskNetsec
Pentesters: how do you handle retests after delivering the report?
Genuinely curious how other firms run this, because it's the part of the job I see go wrong most often. - Does the client tell you when something is fixed, or do you chase them? - Is one retest included in the price, billed hourly, or unlimited within a window? - Do you re-issue the report as v2 or send a separate retest letter? - How long do findings usually stay open in practice? For context, I…
-
r/AskNetsec
How are companies handling fake LinkedIn profiles impersonating their executives?
Most of the conversations I see about executive impersonation focus on phishing emails but what about everything happening outside the inbox? Fake LinkedIn profiles using a CEOs name and photo, accounts pretending to be recruiters or someone impersonating an executive to contact employees and customers directly. Email security doesn't really help with any of that and reporting these accounts indi…
-
r/AskNetsec
How would you do a deep security audit of a vibe-coded SaaS?
I've been building SaaS apps with AI and now I want to properly test how secure they are before real users start using them. I'm not looking for basic advice like use HTTPS, validate inputs, or hide API keys. I want to find actual vulnerabilities, even the ones that are hard to notice. For example, how do you check if a user can access someone else's data, bypass authentication, abuse APIs, explo…
-
r/AskNetsec
Any recommendation about great group or website for network/cyber security report ?
Hello to All, I'm working in a network/cyber security department at ISP company. And, I would like to publish internal report for quarterly report about network/cyber security issues. So, I'm looking for great company, organization and private group about security to refer to writing internal report. Could anyone recommend website, organization and company for that ?
-
r/AskNetsec
How do you approach finding vulnerabilities in large open-source frameworks nowadays?
Hey everyone! I’m relatively new to vulnerability research, and I’m interested in finding new vulnerabilities in open-source frameworks and libraries, rather than just scanning for known CVEs. I’m curious how experienced researchers actually approach large codebases. Where do you usually start? Do you study past CVEs and patches, identify security-critical components, or just start reading the so…
-
r/AskNetsec
How much time are you wasting validating scanner findings?
Our DAST results have gotten to the point where the security team spends a ridiculous amount of time figuring out which findings are actually worth handing to engineering. I’m not expecting zero false positives, but there has to be a better way to handle this than manually reproducing everything the scanner spits out. How are people dealing with this at scale?
-
r/AskNetsec
how can i open an email in Gmail without triggering the sender’s tracking software?
i'm not particularly familiar with email tracking software, browser extensions, or the technical side of Gmail in short, i need to read an email without the sender knowing i've opened it. i know they use email tracking software, although i'm not sure which platform.. i'm pretty sure it's hubspot, and their company uses Gmail if that's any help i've read that disabling external images in Gmail can…
-
r/AskNetsec
Proposal: Ending Cybercrime via "Decoy-First" Infrastructure, Dynamic Tokens, and Hardware Identity Verification [Makibishi system]
Post Body (本文): Hi everyone, I’m a primary school student from Japan. [Makibishi system] > The current cyber security paradigm is fundamentally broken. Trying to patch tens of thousands of software vulnerabilities (from legacy Windows 98 software to millions of apps on App Store/Play Store/Steam) is an impossible "whack-a-mole" game. With AI accelerating zero-day exploit generation, traditional p…
-
r/AskNetsec
Have you ever had a deepfake detector actually catch something during a live call, or does it mainly help you figure things out afterward?
Looking into this for work and hitting a wall tbh. Most of what I'm finding is file upload tools or post-call analysis, which is kinda useless when the whole point is catching something while the call is actually happening. Vendors are all claiming real-time deepfake video detection but I can't find anyone talking about what that actually looks like in production. Has anyone got something running…
-
r/AskNetsec
What forensic evidence can establish the past activity of removed Chrome extensions?
Hi everyone, I’m looking for technical guidance on retrospective browser forensics, particularly regarding removed Chrome extensions, historical network activity, and the limitations of available evidence. I’m currently using a MacBook, but some of the historical Chrome records I’m reviewing may originate from a different operating system. Background During previous reviews, I identified: Histori…
-
r/AskNetsec
How do you rotate service account passwords when nobody knows what depends on them?
Say you run a hybrid environment, AD plus a few cloud subscriptions, and an inventory pass turns up a few hundred service accounts with passwords set to never expire. Most have no clear owner, and some have been around longer than the people who set them up. Forced rotation is the obvious fix, but nobody can say what breaks when the password changes. Windows services, scheduled tasks, hardcoded c…
-
r/AskNetsec
Group membership changes are three event IDs, not one. What else am I missing???
Filing this one under things I should have known before.. I recently went digging through our setup last week and found more holes than I expected. I’d always thought group membership changes were a single event. They are apparently three events (4728, 4732, 4756) depending on the group’s scope. I was watching 4732 and nothing else. So for who knows how long, someone could’ve been added to Domain…
-
r/AskNetsec
How do security teams handle threats across emails, endpoints, user account?
Wanted to find out how you guys do it across different scales, from one-person teams to enterprise teams
-
r/AskNetsec
Cato Networks, worth a look?
We're weighing up SASE options and Cato Networks has landed on the list. Most people I ask just name the same two or three giants, and the pricing on those made my eyes water. Would really like to hear from someone who's actually had it deployed for a while, good or bad. Thanks in advance!
-
r/AskNetsec
How are you finding forgotten PHP hosts after PHP2Shell?
The servers we already manage should be the easier part. Query EDR for running PHP processes, compare that with package inventory and check which web services are actually public. Where it gets messy is everything that never made it there. Old campaign sites, domains inherited through acquisitions, vendor-managed portals and cloud instances that were retired in theory but remain public in practic…
-
r/AskNetsec
How are you finding all the random infrastructure left over after an acquisition?
My company acquired a startup a few months ago and I’m starting to realize their asset inventory was nowhere near complete. We keep finding old domains, cloud stuff, random services, etc. that apparently nobody is tracking anymore. For anyone who’s dealt with this after an acquisition, how did you figure out what was actually out there? I’m increasingly skeptical that comparing CMDBs and asking t…
-
r/AskNetsec
WOFF2SHELL: Is Brotli 0-day (CVE-2026-111497) a bidirectional nuke hiding in web fonts?
https://github.com/Kludex/mangum/issues/160 I believe I may have found proof that WOFF2 is vulnerable to the Brotli zero-day, and the entire industry is looking the wrong way. Can someone please tell me I'm crazy? We are busy patching Node.js and Python HTTP servers, but a site tracking bundled decoders called Broccoli2Shell published a table on October 24th. It lists projects that hardcoded thei…
CVE-2026-111497 -
r/AskNetsec
Data security changes as a result of AI
Before my company allowed enterprise use of AI, I knew where my company's sensitive data lived, but now every department has adopted a different AI tool and no information is centralized any more. Leadership keeps asking whether we're protected, and I don't know if we even have complete visibility at this point. Is everyone else dealing with this, or have you found a process that's actually worki…
-
r/AskNetsec
Looking for a innovative AI powered Cybersecurity project idea?
I'm a software engineering student preparing for a software development competition. The main theme is "Implementation of AI Solutions" (e.g., AI tutors for students, AI agents for autonomous drone navigation, etc.), and I'd like to build something focused on cybersecurity. The projects will be evaluated based on three criteria: 30% Innovation – How creatively or originally the problem is solved.…
-
r/AskNetsec
Vulncheck
Hello everyone I've submitted a few vulnerability reports to VulnCheck recently. They're all different issues that I've tested and reproduced in my local lab, and I got a Submission ID for each one I'm new to their disclosure process and was wondering if anyone here has dealt with them before Do they usually send updates while reviewing reports, or do you only hear back once they've made a decisi…
-
r/AskNetsec
Anyone here good with cybersecurity?
Anyone here good with tech stuff or cybersecurity? I need someone to look into an app for me because something feels kinda shady 😭 I have no idea how to check it myself, so if anyone’s free and willing to help, lmk!
-
r/AskNetsec
How do you guarantee a retired agent's credentials are actually revoked — and how do you audit it?
So: what controls do you use to make sure a decommissioned agent's access is really gone, and how do you prove it after the fact?
-
r/AskNetsec
Has anyone been through a cyber insurance claim investigation? what did forensics actually check?
Trying to understand what happens after a ransomware claim. in one public case i know of, forensic investigators found MFA wasn’t in place where the application said it was nd the policy ended up rescinded did your investigators compare the application to deployed controls line by line? how far back did they look? would love real experiences with details stripped
-
r/AskNetsec
Is php2shell only practical against extremely low-traffic targets?
If so, was the panic really necessary? I looked at a bunch of PoCs, and it seems you need to do multiple consecutive requests to the same php worker process. In production systems that get a reasonable amount of traffic, you have multiple VMs/containers running multiple php processes behind a loadbalancer, and there will be constant background noise from legitimate traffic as well as scrapers and…
-
r/AskNetsec
Parrot os internet connection problems ?
Using windows as main system running parrot in virtualbox i find when using my vpn on main system it messing with parrot os internet connection Any fixes or bypasses would be appreciated
-
r/AskNetsec
Title: Repeated abusive SMS messages containing "sk2#...#@X@hello" — any known cause or solution?
My cousin is currently serving in the military in Turkey and uses a basic Nokia feature phone without a camera or internet access. He keeps receiving unsolicited SMS messages containing strings such as: "sk2#286016644822305 #@X@hello" The messages also contain abusive and insulting text. Other people appear to be receiving similar messages, and we found older Reddit posts mentioning the same "s…
-
r/AskNetsec
Cloud attack path analysis
I'm looking at options for Cloud Attack Path Analysis solutions and am wondering what solutions are decent vs. total snake oil. Orca keeps coming up but I'd really wanna hear from people actually running it than from a sales deck. I'm going to speak to several but would like to know if anyone out there has had particularly good or bad experiences with any of them. Feel free to DM if you don't wan…
-
r/AskNetsec
DIB CS Program/DCISE3
Just wanted to know if anyone has bought into this voluntary program from the DoD Cyber Crime Center that provides an extra layer of security for DoD suppliers network. Any reviews from implementation and its effectiveness?
-
r/AskNetsec
How's your help desk verifying callers now that voice cloning is a thing?
Had a situation a few months back where a caller got through our help desk and something felt off but nobody could put their finger on why until after. Turned out to be a cloned voice. Not a disaster but it made us realise our whole verification process assumes the voice means something, which it kind of doesn't anymore. We've been trying to figure out what to replace that signal with. Voice clon…
-
r/AskNetsec
Is a MacBook (Apple Silicon) a good choice for cybersecurity studies? Worried about VMs and x86 images
Hey everyone, I’m a dual student (CS with a focus on IT security) and I’m currently deciding on a new laptop. I’m seriously considering a MacBook (Air/Pro with an M-series chip), mainly because of battery life, build quality and general performance. Before I commit, I’d like to hear from people who actually work or study in this field. My main concerns: VMs and x86 images: A lot of the material I…
-
r/AskNetsec
What are the biggest technical pain points you face with current AppSec tools ??
I've been working with a few AppSec tools lately, and the biggest pain point for me isn't finding vulnerabilities, it's the sheer volume of false positives and the manual triage that eats up hours of the week. We end up acting as gatekeepers just checking tickets instead of doing actual security engineering. How are you guys dealing with this in your pipelines? Are you relying on custom rules, Da…
-
r/AskNetsec
What identity check actually holds up before resetting someone’s MFA?
Without a real help desk, MFA resets on small teams mostly come down to an admin hopping on a call and deciding the person seems legit. The part that bugs me is where the request comes from. If you’re locked out of MFA you’re probably locked out of email and Slack too, so the ask shows up from a personal phone or Gmail. Same place an attacker would send it from. What’s the minimum you’d require b…
-
r/AskNetsec
Anyone actually used these AI SOC vendors?
Hi, I need honest opinions on any of these vendors from people who tried them (if you're from any of these companies, skip. I don't want marketing bs): Dropezone, Torq, mate, prophet security.
-
r/AskNetsec
Ransomware affiliates spent roughly $23,900 on commercial LLM APIs to run intrusions. No jailbroken “dark” model, just reworded prompts.
An exposed C2 server tied to INC and The Gentlemen ransomware affiliates leaked 133 AI session logs (8,257 messages). A few things stood out: → The models were standard commercial LLMs accessed through OpenRouter. “WormGPT” was only a persona prompt. → When a model refused, the operators didn’t switch tools. They reworded the request as an “Authorized Red Team Assessment Request.” → The AI didn’t…
-
r/AskNetsec
Anyone actually happy with their CDR (cloud detection and response)?
I'm on the security team at a mid-size company. Fairly small security team, mostly AWS, and we're using Wiz for cloud security/CDR alongside our SIEM and EDR. Curious how others are handling this because I'm not sure I'm getting the value I expected from CDR. We get the detections and cloud context, but at the end of the day someone still needs to investigate, jump between tools, figure out what…
-
r/AskNetsec
The industry is building autonomous AI worms while ignoring the 40% of MCP servers that are already vulnerable.
I’ve spent the last few weeks digging through the major 2026 threat reports (Check Point, WEF, ENISA, Dragos), and the cognitive dissonance in this industry is staggering. On one hand, the US Army is reportedly working on ECHOTRIBBLE—autonomous AI worms designed to self-replicate and "neutralize" targets without human oversight. The WEF just confirmed that agentic AI has already executed its firs…
-
r/AskNetsec
Tenho interesse em aprender com vcs!
Sou iniciante na área de cybersegurança, principalmente na parte ofensiva e queria saber se tem pessoas aqui dispostas a se ajudar para aprender, quem tiver interesse chama aqui nos comentarios!
-
r/AskNetsec
How do you detect and reconstruct a data incident fast enough to meet a 72-hour funder reporting clause?
New funding agreement says we have to report a data incident to the funder within seventy two hours of becoming aware and for a small charity on Microsoft 365 with one file server and no SIEM, it's the becoming aware part that worries me. If something happened in our tenant or on the file server I think we'd find out when a user told us and even then I'd struggle to work out what happened inside…
-
r/AskNetsec
For CVE triage, which signals do you trust most? I built an open-source tool that combines 31 sources and want to sanity-check the approach
I'm the author of an open-source tool called CVE Intel, and I'd like feedback from people who do vulnerability triage for a living. I shared it on r/cybersecurity and got useful advice, so I'm asking a wider group. In simple terms, it pulls a bunch of security information sources into one place. It also works as an MCP server, so you can plug it into your AI agents. It's MIT licensed and written…
-
r/AskNetsec
How can we meaningfully assess the hidden costs of technological dependence when the systems themselves control much of the evidence?
I'm interested in more than whether phones secretly record conversations for advertising. There are documented cases of mass surveillance, opaque data collection and corporate misuse, yet the full extent of these practices is often difficult to establish independently. My broader question is: when powerful institutions have both incentives to exploit data and the technical or legal means to conce…
-
r/AskNetsec
Recommend Wiz io alternatives for cloud attack surface
We're shortlisting exposure management tools and Wiz-io is the front runner mostly because of a couple of engineers close contacts. Looking for something that covers the external attack surface too and adds threat intel context. Anything that remediates needs to be careful tho as we're payments so production downtime is not an option. What else should be on the list? Seen Palo Alto, Check Point a…
-
r/AskNetsec
MSc Research Survey: Burnout and Alert Fatigue in Security Operations
Mod Approved Hi everyone, I'm an MSc Cyber Security student at Islington College, London Metropolitan University. My dissertation investigates burnout, cognitive workload and alert fatigue among people working in Security Operations Centres (SOCs) and related cybersecurity operations roles. I'm looking for participants who currently work, or have worked within the last 12 months, as a SOC analyst…
-
r/AskNetsec
Anyone here tried Cymulate, Picus, or Pentera?
Hey folks! I’m looking into Cymulate, Picus, and Pentera for security validation and BAS, and wanted to see if anyone here has hands-on experience with these tools. How do they perform in real-world scenarios? Are they easy to set up, and are the results actually useful? How do they stack up against each other in terms of features, coverage, and overall value? Would love to hear your honest opini…
-
r/AskNetsec
photo-only enquiry uploads using private R2 quarantine, ClamAV and image re-encoding
Howdy folks, Considering implementing something risky. If I implement the below, is there still risk involved to make me second guess allowing this on a public facing website B2C. planning enquiry attachments using Cloudflare Workers, accepting only JPEG/PNG images under 10 MB. Originals go into private R2 quarantine as immutable uploads, are scanned by ClamAV in a separate container, then decode…
-
r/AskNetsec
How do you authenticate payment-provider webhooks when the provider doesn’t sign the payload (e.g. M-PESA Daraja callbacks)?
I build systems that receive payment confirmations from Safaricom’s M-PESA Daraja API (STK Push and C2B callbacks). As far as I can tell, Daraja doesn’t send an HMAC signature or similar with its callbacks, unlike Stripe or GitHub webhooks, so the receiving endpoint can’t cryptographically verify that a callback really came from Safaricom. Current mitigations I’m aware of or using: Allowlisting S…
-
r/AskNetsec
IT audit: what do you check first in an infra and network review
Hi all, I'm trying to learn how infrastructure and network audits work in practice and would love some input from people doing this daily. What are the control gaps you find most often? Where do auditees tend to be weakest (patching, access reviews, firewall rules, logging)? Any audit checklists you'd recommend
-
r/AskNetsec
Does runtime context prioritization fall apart with agentic workloads?
Last year we brought on a tool to get runtime context on our workloads and help prioritize vulns, mostly to cut noise based on what’s actually loaded in memory. At the time it seemed like a no brainer, since direct exploitation or even chained attacks mostly can’t work against components just sitting on the filesystem. We ran a threat modeling exercise the other day on some new systems running AI…
-
r/AskNetsec
How do DLP and DSPM work together and do we need both?
We're talking to vendors who keep pitching both, but I'm not sure if my company needs that because we're still a pretty small org. Can someone explain to me why we would budget for both, or if one would be preferable to the other?
-
r/AskNetsec
Web AppSec in the AI Era
Hi everyone, Our application security workflow is increasingly AI-assisted from threat modeling and SAST/SCA to code reviews and vulnerability analysis. We use Claude, OpenAI, and Copilot to perform SAST with custom prompts, and source-code context along with internal tools[traditonal sast, jars moderation]. Burp Suite for manual validation. But here's the challenge: when AI helps developers writ…
-
r/AskNetsec
How do you filter false positives out of SAST DAST and SCA findings?
My team stopped trusting the scanners and last month we hand-triaged every open finding on our three main services. I need to know if these numbers are normal. Tool Findings Real Why the rest were noise SAST 612 71 test code, input already validated upstream, dead endpoints SCA 1,840 38 vulnerable function never called, dev only dependencies DAST 203 19 needed an auth state the scanner never had,…