GS-InfoSec

Threat Intel | InfoSec | GRC | DFIR
Org Behavior, Psych, and Poli-Sci for Business

[GS-InfoSec @GsInfosystems]

@UK_Daniel_Card As a consultant, and having worked for an MSP, I’ve seen a lot of different orgs in varying markets and I think it provides a broader view on the state of things for sure. When I hear someone at one of these companies complain, I usually think, “this is typical.”

[GS-InfoSec @GsInfosystems]

https://t.co/cZyXHBDOFN

[GS-InfoSec @GsInfosystems]

The data is tracking with the hypothesis that AI is costing companies a lot of money with mixed results.

This study focuses more on the hiring/AI adoption relationship, and claims the firing trends are due to companies using AI as an excuse rather than admit they over hired previously. I think that claim needs more investigation.

“According to Challenger, Gray & Christmas, over 1.2 million layoffs were tracked in 2025. Less than 5% were primarily attributable to AI-driven efficiency gains. And even that figure likely overstates the impact.”

This is a comprehensive data set, 33.5 million deals worked since February of 2024, and it shows companies deploying AI are actually hiring more, yet most are in the experimentation phase and haven’t materialized ROI.

“According to Deloitte's 2026 State of AI in the Enterprise report, only 25% of companies have moved 40% or more of their AI pilots into production. Most organizations are still in the experimentation phase. The gap between excitement about agents and actual deployment at scale remains significant.”

[GS-InfoSec @GsInfosystems]

How many companies today still don’t even know what logs they’re collecting? Master the basics!

[moto_sato @58_158_177_102]

According to the complaint, the investigation concluded that APT 10 potentially breached IBM’s network more than 56,000 times between 2013 and 2016. Crucially, the company said it could not investigate further because it had not kept logs of who accessed its network and when — a basic security practice.

[rootsecdev @rootsecdev]

It’s Friday so here we are.

[Tom🌶\(^-^)/🌶 infosec.exchange/@tomlawrence @TomLawrenceTech]

Thank you for submitting your report, we care about security issues...

[Dave Kennedy @HackingDave]

Introducing a new side project called Model Regression. It tests daily Claude, GPT, and Grok on various benchmark statistics to determine how well its performing and to identify model degrades over time.

@edskoudis had an idea for model testing before they conducted offensive testing to ensure the model was performing as expected, and @BlasikRandy pushed me down this road with actually going and doing it.

The main intent here is the frontier models will experience outages, issues, bugs, intentional/unintentional nerfing of the models without notice. You can't typically trust day to day activities in these models for stability, so leveraging this on your daily routine to see how well the model is performing for that day is something I'll be using everyday.

Runs every morning in my DGX sparks environment and automatically updates with how well its performing.

Enjoy!

https://t.co/1Pep6NyGoh

Also open-sourced the project, can run on your own server as well and look at the benchmarks and how they are calculated:

https://t.co/GFPigpRtUF

[GS-InfoSec @GsInfosystems]

@ZackKorman Great points. Check out @randymarchany deeper dive on this. We should be giving more attention to this systemic issue in hopes of saturating industry conversation for change. https://t.co/u8DQ8RXlnN

[GS-InfoSec @GsInfosystems]

@HackingLZ 🔥

[GS-InfoSec @GsInfosystems]

@IAMERICAbooted Audit and GRC will read it 😂

[GS-InfoSec @GsInfosystems]

Is the AI gold rush dead?

https://t.co/Vf6B4Y9BXz

[GS-InfoSec @GsInfosystems]

@IAMERICAbooted Politics are everywhere in every job. They can be challenging and take away the love of the game if you let it. I dislike this part of business the most but it’s an element we can’t get away from, no matter the industry or team. You’ll find it in any group.

[GS-InfoSec @GsInfosystems]

Has the exploit/zero day been elevated disproportionately compared to other aspects of an attack?

Initial access
21% confirmed exploit use
58% via non-exploit methods

[Volodymyr Styran 🇺🇦 @arunninghacker]

Exploits Were Never the Point.
What 46 CERT-UA incident reports and 25 red team operators told us about how cyber operations actually unfold — and why the zero-day mystique keeps getting in the way.
https://t.co/EL7xvPgQeZ

[GS-InfoSec @GsInfosystems]

@HackingDave That’s how I sleep. Catch up!

[GS-InfoSec @GsInfosystems]

Badass! One of the best qualities to have is the endless pursuit of information and remembering we all put our pants on one leg at a time.

[GS-InfoSec @GsInfosystems]

Intel is severely limited by perspective. It's misunderstood, even within CTI. I've had cyber directors and practitioners look at me sideways when I opened their eyes to collaboration with physical security, fraud, GRC, and risk. Intel is an input for decision support. Their idea of CTI is how it was shown to them. I recommend all CTI folks to read up on intelligence history and the broader use cases. Attacker ecosystems aren't stuck in cyber.

[The Vertex Project @vtxproject]

"Don't look at it as CTI. It's intelligence for your organization."
In this clip, @TomHegel explains why threat intel shouldn't live in a silo.
The best programs support business decisions, investments, sales, recruiting, and more (not just security operations).
#CTI #CyberSecurity #ThreatIntel
https://t.co/JUSQoAjqDN

[GS-InfoSec @GsInfosystems]

If you get enough signal you can see the trend and maybe the objective.

[Matt Johansen @mattjay]

MSRC couldn’t possibly do anything worse this week… oh. Oh ok.

[GS-InfoSec @GsInfosystems]

Yeah, it can be frustrating for sure. This is exactly why I advocate for a threat intel program that operates across business units and uses risk quantification. It doesn’t solve the red tape but it supports decision making in a measurable way… As we see tech speed up, the microscope will point to leadership’s ability to adapt their orgs capability to make quick decisions and take actions. Simplifying, measure the decisions and external factors are more frequently requiring speed.

[GS-InfoSec @GsInfosystems]

We all know most orgs haven't even secured their environments correctly with the existing capabilities. I seriously recommend a quality vendor if you are struggling because the pace is going to keep picking up.

[vx-underground @vxunderground]

Microsoft introduces Microsoft Scout, also known as Autopilot.

Scout is always on and has file system and application access "based on your corporate policy".

Best news for Threat Actors in a long time

https://t.co/M3pyfcbTBm

[GS-InfoSec @GsInfosystems]

Gartner Magic Quadrants are the most useless charts. They’re right up there with top CISO, voice in security, yada yada paid awards.