Two people with a GPU rig can point it at an environment, and no one is writing signatures or detections for this. What used to be sophisticated is now commoditised, so your skill set matters that much more.
Damien Lewke, @nebulocksec on @CloudSecPod.
Damien Lewke, @nebulocksec on @CloudSecPod.
0
0
0
83
A production app in another account may still be using a subdomain under an orphaned hosted zone. When the person who created the records has left, they belong to no one.
Ramesh Ramani from Block on @CloudSecPod
Ramesh Ramani from Block on @CloudSecPod
0
0
0
89
A threat model for a complex application has gone from a multi-week or multi-month project to hours, in roughly six to nine months.
Ben Oster, @ThreatModeler on @CloudSecPod.
Ben Oster, @ThreatModeler on @CloudSecPod.
0
0
0
85
A pen test agent verified domain ownership against a private IP, then tested the public site once the DNS record was repointed.
Richard Fan on @CloudSecPod about the guardrails he got past in AWS Security Agent. #CloudSecurity
Richard Fan on @CloudSecPod about the guardrails he got past in AWS Security Agent. #CloudSecurity
0
0
0
101
Breaches happen because something gets missed. An Okta API token logs into a MacBook, which opens the AWS CLI. Step by step, none of it is necessarily bad. Read as one series of events, it’s direct evidence of an active intrusion.
Damien Lewke, @nebulocksec on @CloudSecPod.
Damien Lewke, @nebulocksec on @CloudSecPod.
1
0
0
118
With Cursor running different models on the back end, a threat model can be out of date by the time you’ve plugged it in. Historical data shows about 80% never get revisited.
Ben Oster, @ThreatModeler on @CloudSecPod.
Ben Oster, @ThreatModeler on @CloudSecPod.
0
0
0
91
Most of us are probably running AI coding agents in YOLO mode. More of that work is likely to move into VMs and sandboxes, partly because agents need different tools from developers.
Samuel Kelemen from @Lovable on @CloudSecPod.
Samuel Kelemen from @Lovable on @CloudSecPod.
1
0
1
137
An attempt to measure least privilege by having AI scroll through logs and configuration didn’t give the right signals. With logs at that volume, LLMs couldn’t be trusted to produce deterministic ones.
Ramesh Ramani from Block on @CloudSecPod.
Ramesh Ramani from Block on @CloudSecPod.
0
0
0
88
About 80% of threat models never get revisited. Each took weeks or months to build, and updating one meant another three weeks in a room. Now a model can be stale by the time it’s plugged into Cursor.
Ben Oster, @ThreatModeler on @CloudSecPod
#ThreatModeling
Ben Oster, @ThreatModeler on @CloudSecPod
#ThreatModeling
0
0
0
118
GTG-1002 went from reconnaissance to exfiltration in under 60 minutes. No human could have done that. Clustering, sequencing and time boxing should give high fidelity detections.
Nicole Beckwith, @cribl_io on @CloudSecPod.
Nicole Beckwith, @cribl_io on @CloudSecPod.
0
1
0
118
Securing AI agents by design means rebuilding IAM from the ground up.
One engineer might run 40 agents in parallel in an hour. Multiply that across engineering, IT and business users.
Ido Shlomo from @TheTokenSec on @CloudSecPod.
#IdentitySecurity #AgenticAI
One engineer might run 40 agents in parallel in an hour. Multiply that across engineering, IT and business users.
Ido Shlomo from @TheTokenSec on @CloudSecPod.
#IdentitySecurity #AgenticAI
0
1
1
200
Even fast remediation still leaves eight days of availability to attackers. Remediating within 24 hours or less is now the floor, and some exposures should be fixed within an hour. The current average is 28.2 days.
Richard Seiersen, @qualys
Richard Seiersen, @qualys
0
0
2
148
Hash values, IP addresses and domains, the bottom three layers of the pyramid of pain, are essentially gone with AI. The aim is to catch the adversary on behaviour.
Nicole Beckwith, @cribl_io on @CloudSecPod.
Nicole Beckwith, @cribl_io on @CloudSecPod.
0
0
0
117
Blocking AI tools outright leads to more shadow AI. People go around it.
Visibility tells you someone is doing something. Observability tells you what they’re doing.
Johnny Hands, @trendaisecurity on @CloudSecPod
Visibility tells you someone is doing something. Observability tells you what they’re doing.
Johnny Hands, @trendaisecurity on @CloudSecPod
0
0
0
109
Every employee on LinkedIn adds to your attack surface, and each profile can now be spoofed. Finding the fake sites and spoofed accounts that might trick your people is a cost-effective fix.
@adylon7 @outtake_ai
@adylon7 @outtake_ai
0
0
0
140
Security teams are hiring groups of AI agents. Humans stay involved, with more agentic AI applied to prevention and shifting left. Shrinking the attack surface is how defenders fight back.
Richard Seiersen, @qualys
Richard Seiersen, @qualys
0
0
0
127
An AI model in a sandbox is a master pentester already inside your organisation. Put the best pentester you know in there and they’d probably get out.
Models have already broken out and got internet access.
Steve Giguere, @CheckPointSW
Models have already broken out and got internet access.
Steve Giguere, @CheckPointSW
0
0
0
109
A single bug bounty report listed more than 80 DNS takeover vulnerabilities, about half on production domains. Fixing them meant finding who managed each domain, and many had no owner.
Ramesh Ramani, Block
Ramesh Ramani, Block
1
0
1
178
Staff using a Copilot at work are coming across data they shouldn't have seen. The unreported cases are the concern: some ask the AI to tell them more, which makes them unintentional insider threats. David Gibson from @varonis
0
0
2
222
One question got a chatbot to write out its own system prompt. It asked the chatbot to draft one for a clone of itself.
Models often reveal their system prompt even when told not to.
@CheckPointSW
Models often reveal their system prompt even when told not to.
@CheckPointSW
0
0
0
166