When new ELT takes over and starts questioning the SOC value

Exec: "What does the SOC actually do all day?"

Me: "Let us go and find out"

After 15 years in security leadership, not sure I can take much more

I’m in a regulated sector and there’s little guidance on AI use. Because of that, we’ve really restricted use and advise no uploading of NPI/PII until we know what the expectations are on risk assessments, policies, etc. Basically, it’s great for research, some guidance, and drafting, but shouldn’t be run on sensitive data in any form. Any decisions that are made should be your decisions and not the decision of AI. Users are trained on this. They’ve accepted the terms in our Acceptable Use Policy. We have 1 approved AI platform.

Here’s the thing - We’ve got the tech enthusiasts that reach out to the IT department regularly - “look at this new setup from Anthropic! We can automate this. This would increase productivity! We’re going to get left behind!”

“We’re going to get left behind!”
Ugh.

There’s a user that told me he’s given AI full access to his personal laptop. He has told me he personally runs bots and uses multiple platforms to write and run scripts and automations. Full access makes me cringe. Although there’s no proof that there’s “shadow AI” going on (users using unapproved tools/circumventing protection) we suspect some is going on. Knowing that these users just throw all their personal documents at these platforms worries us that we’re opening a can of worms if we un restrict AI use internally - especially since AI tools continue to evolve and we still don’t have a set expectation from a regulatory body.

It’s like any way we approach it to provide a tool that meets their expectations, it just doesn’t work. The platform we use is constantly adjusting settings as well, so it’s like every time I turn around, a new setting is on by default that shouldn’t be. It feels impossible to control.

Also - these enthusiasts are like .04% of our organization, so is the work worth it is a question that has been brought up. Even upper management feels it’s more efficient to do the work yourself. By the time your verify AI’s output or fix its mistakes, you’d be just as good doing it yourself. Management doesn’t appreciate that the work is not understood when done with AI (e.g. can you explain this line on this document? And the person can’t).

Anyone else feeling bound in a situation like this?

Hey everyone I have been basically tasked with the impossible of trying to create an agentic soc for our environment that basically will triage alerts.

I work for a small business and was dabbling into some vendors that support this ask and from what I’ve seen it all looks the same type of slop that I just don’t see myself trusting yet. It looks like you have this product that the company promises can triage alerts for you yet you still have to be looking at alerts to make sure the ai is doing its job correctly. I’m not in the market to babysit ai as I don’t think that is feasible long term because I am simply just making the work being done faster but it is all benign work anyway.

But I stumbled up a an idea to the madness and wondering if it is possible to develop an agent that acts as the detection for our environment so there would no longer be a queue with several detections put in place and once users hit that risk threshold then the team investigates whatever it finds as borderline suspicious.

So instead of us having detections put in place to catch things the ai itself is the detection and will monitor everything that’s coming in and out of our environment and also alert us on just the important things that need to be investigated.

I guess to accomplish something like this I would need to train the ai by feeding it siem logs ticket logs and have it spit out anything that is abnormal and compare that to the normal activity from our users and go from there?

With that being said I am wanting to ask what all you have done in the state of ai being incorporated with the soc? Did your analysts just triage alerts with it or are you guys able to do other things.

Were you able to accomplish something similar or find a product that meets that need?

Edit: Thank you guys for commenting on this so quickly I appreciate you all!

This week we have:

• AI ransomware from Colin Cowie at Sophos
• Etugen exposing Ivanti attackers
• More hacks by unnamed AI Agents
• Florian Roth tipping over tipping points
• Google doing Google things and taking down a botnet
• Exposing Phishing Kit shenanigans by KELA
• Kaspersky showing some real AI attacks
• Warnings about drinking the water from Sekoia
• Airlines declaring data breaches
• And some great DPRK attack details following a near miss at Sophos

SocVel Quiz

AI adoption is making it harder for security teams to maintain visibility into what employees are actually using.

I'm particularly interested in Shadow AI, AI agents, MCP servers, and AI enabled developers tools running on employee endpoints.

How are security teams getting visibility into these tools and assessing the security risks around them?

Are you using existing endpoint, DLP, proxy or identity controls or have you added something specifically for AI governance?

I'd be interested in what has actually worked in production, especially for detecting unsanctioned AI usage without simply blocking everything.

Hello everyone,

This is my first post here, and I’d really appreciate hearing your thoughts and insights on something I’ve been thinking about.

I work in backend development, and one of the biggest challenges in my region is the highly competitive job market. There are a significant number of web developers, making it increasingly difficult for people to stand out and secure new opportunities.

Finding a new job has become a time-consuming and challenging process. On top of that, the rapid advancement of artificial intelligence is bringing significant changes to the software development industry. Web development is among the areas experiencing some of the greatest impact from AI, which has added another layer of uncertainty to an already competitive job market.

This situation has made me reconsider the long-term direction of my career and explore other areas of technology that might offer better opportunities and long-term growth.

I'd love to hear your perspectives:

• Do you think backend and web development will become increasingly saturated due to AI?
• Which areas of technology do you believe will offer better career opportunities in the coming years?
• Would transitioning into fields such as cybersecurity, particularly Blue Team operations, be a worthwhile move for someone with a backend development background?

I'm looking forward to hearing your experiences, suggestions, and opinions.

Thanks in advance!

Since i left from my temporary job and back to study my any.run account got deactivated, so i might actually need a help guys.
Can you check, is this thing suspicious or not? In my opiniom it is since there wasnt any issue and the author's account in github is absolutely zero.
Release InputLab v1.4.0 — a driver check for your mouse's worst gaps, every driver between your mouse and Windows, the interrupt measurement as pictures, and a fairer mouse score for fast mice · moneks1106-code/InputLab

buen dia, en el trabajo actualmente esta solicitando realizar un simulacro de un ciber ataque de phishing , alguna herramienta o manera de realizarlo de manera libre que no sea por plataformas de paga?

I believe we’re going to see a lot more security vulnerabilities in the coming years because of AI, and I want to hear if others see it the same way.

Here’s my reasoning:

1. AI-generated code ships faster than it gets reviewed. More people are shipping code they didn’t fully write and don’t fully understand. Even when the code works, subtle issues like weak input validation, hardcoded secrets, and insecure defaults can slip through.

2. AI agents have real access. Models are being connected to email, file systems, databases, browsers, and internal tools. Prompt injection is still an unsolved problem, so a malicious instruction hidden in a webpage or document can potentially make an agent do something its owner never intended.

3. New attack surface. Model APIs, plugins, vector databases, and MCP-style integrations are all new components that many teams are adopting before their security practices have caught up.

4. Supply chain risk. Models sometimes suggest packages that don’t exist, and attackers can register those names with malicious code. Dependencies get pulled in with little scrutiny.

5. Attackers use AI too. Finding bugs, writing phishing messages, and automating reconnaissance all get cheaper and faster for both sides.

To be fair, AI will also help defenders find and fix vulnerabilities faster. But I think the volume of new software and new integrations will outpace that benefit, at least in the short term.

What do you think?

Greetings community.

I am relatively new to the IT scene. Have been working as a SysAdmin for around 2-3 years at my last company, where i was able to work with different MSP's on different fronts. One of them was responsible for Hardening where we would have 2 meetings every month to implement different Hardening policies.

*MSP was split in to Blue,Red team and hunting. Where i was working only with Blue Team.

I was fascinated on the knowledge of those people. They had their own dashboard of policies that they would assign to us based on CIS, Mitre ATT&CK and other best practices.

Hardening and strengthening environment is interesting to me... so here is my question.

How do you guys study, learn or even keep up with this type? Any courses, seminars or regular sites and blogs you guys read? I know that doing LAB/Test environments is big key to it. I got a new job where most of my part is Management and a little IT so i want to keep up the momentum i have build in my old company.

P.S i have searched Blue Team & Hardening in the subreddit but not found much and that is why i am creating this post.

Thanks in advance Nysex

The bug is like a joke.

On Alpine Linux, type 257 to 1024 characters of anything and you get root.