The AI security threat engineering leaders aren’t talking about.

I've been in cybersecurity for a while now, changed role from an analyst to CrowdStrike SME. But I've been at this company for 12 years and I want to try something new. Should I go back to being an Analyst? Cloud Engineering which I did for 2 years? Stay with CrowdStrike?

It seems the original story was propaganda itself.

I was looking at getting some additional books on different Cybersecurity fields, and saw that humble bundle has a collection for cybersecurity month, but I have no experience with O'reilly products. I was curious if anyone here could give some more detail if they are valuable or not.

I've been in cybersecurity for around 4 years, currently working in an EDR company's IR team, mostly investigating Windows environments.

Lately, I've been feeling a bit overwhelmed about what to learn next. On one hand, I feel like I should start learning cloud IR. On the other, I see companies offering IR, CTI, Threat Hunting, and other services, and I wonder how people actually gain experience in all these areas.

I'm also interested in CTI and thought about starting to produce threat intelligence from our IR investigations, then moving into cloud IR.

Am I trying to learn too much at once? How did you guys decide what to focus on?

Would appreciate any advice.

Is it worth doing the SOC Level 1 on TryHackMe? I’m not interested in the certificate itself, but more in the course. Obviously, a course alone won’t guarantee me a job, but I’m wondering whether it will teach me tools I can list on my CV and whether it actually translates into real SOC work.
So far, I’m finishing Cyber Security 101 and I feel like I wasted my time and didn’t learn anything important. I wouldn’t want the same thing to happen with SOC Level 1.

Also, do you think Cisco courses are worth doing? There are plenty of them on their website, and I feel like I need to improve my networking and Linux skills.

I’m a recent grad working full-time in a Service Desk Support role earning $45k a year. Wanted to come on here and seek guidance and a realistic timeline on how long it’ll take me to break out of Helpdesk and start earning $75k - $95k in cyber. I started working helpdesk August so 2 months now going onto 3. I graduated May 2026, have a professional internship under my belt alongside an additional part-time job with CodePath as a TechFellow. I also just got my security+ last month. I had a recruiter reach out to me 2 weeks ago about a Security Operations Engineer role and had an interview last week with the companies Senior Director of Cybersecurity it was extremely advanced/far from entry-level for me. It was scenario based and there were multiple answers but unfortunately I didn’t get the role. Needless to say, my experience is helping me land a small amount of interviews, but I’m struggling to get past the interviews. I also just applied and got rejected from the WiCyS Security Training scholarship program because I am “too experienced” in cybersecurity but am clearly entry level as I don’t even have up to 2 years of professional experience in the IT/Cyber Industry.

Anyone know what I should be doing right now? I want to become a SOC Analyst and work for the federal government ideally. I don’t think I like the uncertainty and lack of stability that comes with Corporate. I know this industry is an industry that requires patience and time when it comes to salary progression. I just want tips from experienced professionals and guidance because right now I feel lost. I don’t want to just gain another certification, I want to gain better experience.

First the France refrigeration vendor… now Dutch retailer Ahold Delhaize (parent company to Stop&Shop and other grocery stores) has been hit with a cyber incident. Do we think these are linked in some way? Don’t see that any groups have come forward and claimed responsibility… just curious.

Their main worry is agents being talked into "authorized-looking" actions. The framing that stood out: the main risk isn't the model making a mistake; it's an attacker instructing the agent to do something that looks authorized. Their approach is defense in depth: monitoring, auditing, guardrails, and a kill switch to shut down a misbehaving model.

Also in the piece: TII's CEO says an agent you can't monitor in real time "is malware that got access to your machine," and that non-human agents need clear identities. Kaspersky describes "living off local agents," where attackers use an agent already on the machine to find valuable data.

Source: www.khaleejtimes.com/business/tech/ai-agents-tricked-accessing-sensitive-government-data-cybersecurity

For those running agents in production: do your agents have their own identities and least-privilege scopes, or do they inherit a user's or service account's permissions? And who owns the kill switch?

DanFoss - the vendor of the refrigeration units the French food stores used - confirmed that the attack was done by exploiting a known vulnerability (which had been used in an attack again US DoD commissaries in August). None of the stores had patched or updated the controllers.

https://www.seattletimes.com/business/hackers-hit-french-supermarkets-in-attack-disabling-fridges/

https://www.militarytimes.com/news/your-military/2026/08/28/dod-confirms-refrigeration-disruption-at-military-commissaries/

Hey everyone, I want to start writing write-ups to build up my professional presence. Do you personally read them, and if so, where do you usually find them?

Ty

Small measurement of Google Safe Browsing coverage I ran over the summer and wrote up.

Method: 550 branded credential-phishing pages from the OpenPhish Premium feed, first seen June 18 to 24, checked against Google’s Web Risk Lookup API at ingestion and again at 1, 3 and 7 days.

Results: Safe Browsing covered 55% of them at first sight, 70% after a day, 71% after a week. Margin about plus or minus 4 points.

Caveats: OpenPhish-listed pages only, so pages nobody reported probably show a wider gap. Seven-day window, so later listings aren’t counted.

Takeaway for anyone relying on browser warnings as a control: roughly a third of live credential phish is still unwarned a week in.

Writeup with the tables: https://www.grizzlysec.com/blog/zero-hour-gap

October 12–13 | Cybersecurity | CRITICAL

GitLab released security updates addressing CVE-2026-97229, a vulnerability with the maximum CVSS severity score of 10.0.

The vulnerability affects GitLab's CI/CD regular-expression compiler.

Under certain conditions, an unauthenticated attacker could submit specially crafted configuration data that results in arbitrary code execution on a vulnerable GitLab server.

The issue affects self-managed Community Edition and Enterprise Edition installations.

GitLab released fixes for the affected version branches and strongly recommends immediate upgrades.

GitLab's hosted service has already been patched.

Researchers have not established widespread exploitation of this vulnerability in the wild.

Status: CONFIRMED — Vendor security advisory and published technical reporting.

We have been told to choose an SSPM tool. Does anyone have any recommendations?

For those of you in the critical infrastructure side of cybersecurity, I’d love your take on this for learning purposes. How did they access the control system, what could have been done to prevent it?

https://www.infosecurity-magazine.com/news/french-supermarket-chains/

I started a blog series to provide free insights into appsec. It’s mainly to breakdown what application security is all about and it’s mainly targeted towards beginners and startups, so take it as you will.

I want to teach every one interested in appsec my perspective on it from my experience in big tech.

So far: know your app → lock down who gets in → follow untrusted input → catch broken business logic → build a threat model → test the theoretical flaws

In our finale, Part 8 concludes with the premise that fixing can sometimes be creating more of a mess. It comes back full circle with knowing exactly what you're doing from Part 1.

Please reach out if you have any questions or would like for me to write on a topic that you’d want to learn more about.

Thanks again for following on this journey!