DAY JOHNSON⚡️

Cybersecurity, homelabs, AI & all things tech | Cybersecurity Engineer @ AMZN | Opinions are my own | Believer ✞

[DAY JOHNSON⚡️ @daycyberwox]

Access to open-weight AI models not tied to a frontier lab matters more than ever.

I built a local AI rig (ZimaBoard 2 + RTX 5060 Ti) to dig into what these models are doing, how they run, and how far they go for coding and security.

https://t.co/TzWFImmlzy

[Florian Roth ⚡️ @cyb3rops]

I took this opportunity to revisit and update my 2022 presentation on post-exploitation detection.

The exploit may be new, or completely different from anything we’ve seen before, but the activity that follows often fits patterns we already understand. Generic detection rules can recognize those patterns without knowing which vulnerability was used. A rule written for one incident can therefore help detect another, years later.

That’s the idea I’ve been talking about for years, and what the presentation explains in practical terms. The slides walk through how to turn an observation into a useful rule, which data you need, and why a match still needs context.

There are examples using Sigma and YARA, a look at how we apply them in THOR and Aurora, and my “Sigma Hall of Fame” with some old favourites :)

https://t.co/tSUGMwpjxG

[DAY JOHNSON⚡️ @daycyberwox]

I let my curiosity get the best of me again.

New side quest: 3D printing and graphics. Naturally, I gave GPT-6 Astra the real incident reports for 3 infamous worms, had it design a monster for each one, then built, animated, and printed them 🪱

https://t.co/o2wed100eh

[DAY JOHNSON⚡️ @daycyberwox]

Need secure access to your homelab while you’re away?

Here’s how I use @Tailscale + @rustdesk for remote Proxmox, SSH, file sharing, and more.

Full setup 👇🏾
https://t.co/wleCuFg2ON

[DAY JOHNSON⚡️ @daycyberwox]

The Home SOC build is finally back after a 9-month pause for wedding planning, getting married, and our honeymoon. Now that I’m married, the attack surface has expanded 😅

In this next installment, I’m deploying @wazuh agents across every endpoint in our house.

Plus, a surprise guest: my wife deploys her own agent.

🎥 https://t.co/q7GLEFW51B

[DAY JOHNSON⚡️ @daycyberwox]

Watching cybersecurity content ≠ building cybersecurity skills.

At some point, you have to actually build. Here are 5 projects I'd recommend:

→ Network Traffic Analysis Lab
→ Securely Containerize an App
→ Self-Host a Password Manager
→ Kubernetes Security Lab
→ Cybersecurity Homelab / SOC
Build it. Break it. Secure it. Document it.

🎥 5 Cybersecurity Projects You Should Build to Level Up Your Skills: https://t.co/4nYAToO4Mq

[DAY JOHNSON⚡️ @daycyberwox]

I’ve been thinking a lot about what vibe coding looks like once it starts touching real systems.

It’s easy to generate an app. The harder part is making sure that app isn’t bypassing the security controls your company already depends on.

For this video, I partnered with @superblocks and worked through that problem in practice: identity, credentials, dev vs. prod, deployment, security checks, and visibility.

People will build with AI. The question is whether they do it inside your security model or outside of it.

Full video: https://t.co/zGZcnrM8cA

#Cybersecurity #VibeCoding #AISecurity #SuperblocksPartner

[CloudBreach @Cloud_Breach]

You can't detect what you've never executed 🎯

"It teaches you how attackers think and applies real-world TTPs in a way that mirrors enterprise environments."

⭐⭐⭐⭐⭐ review from @daycyberwox , Cloud Security Engineer,

#BreachingAWS: 18 labs, real AWS targets, 24h OAWSP exam 🎓

👉 https://t.co/MZDgrbIBzE

#CloudBreach #CloudSec #AWS #AWSSecurity #OAWSP #RedTeam #BlueTeam #Pentesting #InfoSec

[DAY JOHNSON⚡️ @daycyberwox]

GRC is way more technical than people give it credit for.

Many security engineers hear “compliance” and immediately think audits, screenshots, spreadsheets, and paperwork.

But modern GRC increasingly connects directly to the systems we already manage, including cloud infrastructure, identity, endpoints, source control, etc.

That’s what I break down in my latest video with @TrustVanta: what compliance automation actually automates, where the engineering side of GRC fits in, and what still requires human judgment.

If you’ve always thought GRC was just the “paperwork side” of cybersecurity, this one might change your perspective. https://t.co/N2z3Tvc2sG

[DAY JOHNSON⚡️ @daycyberwox]

If I had to start college over again for cybersecurity, I wouldn’t spend 4 years preparing to start my career after graduation.

I’d start the career on day one.

Internships. Homelab. Projects. Certs. Specialization.

The goal:

Graduate with 4 years of evidence that you can actually do the work.

New video on this ↓
https://t.co/W4hmyIO31F

[DAY JOHNSON⚡️ @daycyberwox]

@DataSecChron Yeppp

[DAY JOHNSON⚡️ @daycyberwox]

@_odaj_ Absolutely. You learn by doing, not by watching.

[DAY JOHNSON⚡️ @daycyberwox]

Watching cybersecurity content ≠ building cybersecurity skills.

At some point, you have to actually build. Here are 5 projects I'd recommend:

→ Network Traffic Analysis Lab
→ Securely Containerize an App
→ Self-Host a Password Manager
→ Kubernetes Security Lab
→ Cybersecurity Homelab / SOC
Build it. Break it. Secure it. Document it.

🎥 5 Cybersecurity Projects You Should Build to Level Up Your Skills: https://t.co/4nYAToO4Mq

[DAY JOHNSON⚡️ @daycyberwox]

@_odaj_ Absolutely. You learn by doing, not by watching.

[DAY JOHNSON⚡️ @daycyberwox]

@cwinfosec 100%

[DAY JOHNSON⚡️ @daycyberwox]

@madebygps 🚀 congrats!!

[DAY JOHNSON⚡️ @daycyberwox]

Did an @incogni_com review to see how exposed my personal data really was. Within minutes, it found 1,000+ exposures tied to my info and started sending removal requests on my behalf.

Your data is bought and sold as someone else's asset. This is what it looks like when you actually check.

Use code DAY60 at https://t.co/zF6dbO9UcT for 60% off an annual plan.

A 30-day money-back guarantee.

#IncogniReview #CyberSecurity #OnlinePrivacy #DataPrivacy #Incogni

[DAY JOHNSON⚡️ @daycyberwox]

Need secure access to your homelab while you’re away?

Here’s how I use @Tailscale + @rustdesk for remote Proxmox, SSH, file sharing, and more.

Full setup 👇🏾
https://t.co/wleCuFg2ON

[DAY JOHNSON⚡️ @daycyberwox]

@vlntndotexe @wazuh thank you!

[DAY JOHNSON⚡️ @daycyberwox]

The Home SOC build is finally back after a 9-month pause for wedding planning, getting married, and our honeymoon. Now that I’m married, the attack surface has expanded 😅

In this next installment, I’m deploying @wazuh agents across every endpoint in our house.

Plus, a surprise guest: my wife deploys her own agent.

🎥 https://t.co/q7GLEFW51B

[DAY JOHNSON⚡️ @daycyberwox]

@tracebit_com just released some fascinating cybersecurity research around Context Bombs. 💣

The idea is to plant short strings inside canary secrets, environment variables, or DNS records that trigger an attacking AI agent’s own safety guardrails.

So instead of only detecting the AI attacker, the environment may cause the agent to refuse to continue.

Across five frontier models and 152 attack runs, Tracebit found that Context Bombs reduced successful attack paths from 91% to 15%.

This feels like an early glimpse into security controls designed specifically for autonomous AI attackers.

I broke down how it works in my latest short video: https://t.co/n1spL7EJ5R

Read Tracebit’s research:
https://t.co/MYycBKavQD