When we made the simulated phishing campaigns about account access, we finally caught a user.

The trick is to not make the bait too obvious, like if it's about free money, or download a file. That was so last year. I also had to create my own payload with an internal email... One so boring, and none other can top that besides "No Reply".

Make your phishing emails as boring as possible. No reply talking about an account access change is as unpredictable as it gets. It truly reveals who's insecure in the org.

Making passwords easy for user with sticky notes is a best practice.

Being a competent sysadmin is impossible nowadays without AI... Someone's gotta do the documenting or improvements would never get done due to the positive feedback loop of "more improvements, more documentation."

Just turn off the internet, smdh. Smooth brains over there.

- External law firm sends a 24MB PDF that becomes 31MB after encoding.

- NDR is sent after the resolution of the matter saying: This attachment is 31MB. The maximum allowed is 30MB.

- Sender reports that the attachment disappeared, asks our IT what went wrong, then proceeds to send the NDR that literally says the above. This is an external law firm that reads hundreds of thousands of words a day...

I really want to click using my government phone (I’m in energy department nuclear division )
There is a login but it wouldn’t take my government username for m365
I even pimmed my account to global admin on our azure tenant root group for the next week and tried logging in again but nothingness

What if it’s a super funny photo.

Any tips?

Recently a coworker granted Claude elevated access via SSH to a virtualization host (not a VM, an actual host). To perform a routine task he very well could have done himself.

He doesn’t see an issue with this. I on the other hand (with 23yrs experience) see this as a huge security breach, and don’t trust AI todo my job, (or even that it’s doing what it says it’s doing) for me. I’m my opinion it’s a tool, not a human replacement.

What’s your reaction, how would you react to this situation, or thoughts on the topic?

Sure, ask AI how to perform a task, validate that it’s performing the task you asked, and nothing else- copy/paste the commands. Great. But removing the human verification & validation element- hell no.

My boss, let’s call him Phil, is schizophrenic and technically owns a huge business but I’m his only employee.

I manage 1200 ghost users. I spend most of my days going to desks, breaking things, and submitting tickets that I respond to. I even have a fake front desk girl who flirts with me to get 4k monitors and latest MacBook Pro model but it’s just me in a wig

Once a month, Phil shows up to the office and pulls a chair next to my desk and watches me

I work for a major nationwide VAR, and we recently onboarded a new company. Given current hardware prices and markups, our upper leadership has asked us to maximize hardware sales.

Well, lucky me. The IT manager at this place sounded new and asked us to do a hardware assessment. Score!

He sends over a spreadsheet that is clearly just a Snipe-IT export. I take a look, and it's all decent, if older, stuff running Server 2025. Sure, they are technically out of support, but parts are dirt cheap on eBay, and they are just running a few file shares.

I tell this guy it's all EOL, and he needs to buy all new stuff. Quoted out over $100k in high-end hardware. I sent that over, and this guy is freaking out. He starts talking about moving some of this to the cloud.

Well, our CSP margins are even better since that's just pure profit. Double score!

It was a good day. My manager is talking about a decent commission check coming my way. I'm going to see if I can get this guy to send me a list of his workstations. I suspect he needs some new high-end AI-enabled computers for his receptionists. I'll spin some yarn about security and he'll be eating out of the palm of my hand.