Secure.com

🛡️ Governed Defense, Powered by Offense.

⚡AI Teammates do the grunt work so your team doesn't.
👤You set the rules. They do the work.

[Secure.com @Securedotcom]

Security work keeps growing, but security teams don't.

We've spent years getting better at finding security problems. It's everything that happens after that where most teams are feeling the pressure.

[Secure.com @Securedotcom]

@IntCyberDigest The confidence to run a mass deletion and only afterward go "huh, that seems bad"

[Secure.com @Securedotcom]

@IntCyberDigest The actual escalation here is the SSO design, not the image bug. One compromised forum account led to live ChatGPT and Codex sessions, and Codex accounts are connected to Gmail, Drive, Slack, and GitHub.

[Secure.com @Securedotcom]

@IntCyberDigest The jailbreak here wasn't technical. They just told the agent it was an authorized test. That's pretty much the whole bypass.

[Secure.com @Securedotcom]

@ZackKorman This is exactly why governance has to be the standing question, not a one-time policy doc.

[Secure.com @Securedotcom]

@TheHackersNews The attackers ran a whole campaign against devices from 2021 CVEs, then got caught because they left their own 407 MB working directory exposed. Everyone's opsec fails somewhere.

[Secure.com @Securedotcom]

The fix that actually works here isn't "validate the header better"; it's not trusting client-supplied headers for trust decisions at all. The proxy should overwrite X-Forwarded-For, not append to it, and anything upstream should only trust the last hop it appended itself, not whatever arrived from the client.

[Secure.com @Securedotcom]

@Pirat_Nation The redesign roadmap:
2024: make it slower
2025: make it cluttered
2026: write a blog post where you admit it
2027: maybe fix it.

[Secure.com @Securedotcom]

This is the AI story that actually matters, not chatbots writing phishing emails, AI collapsing the time and skill it takes to go from "here's a public CVE" to "here's a working exploit script." That shift is why exploitability has to outrank theoretical severity in every remediation queue now, PLCs included.

[Secure.com @Securedotcom]

@0xTib3rius "Family Feud but with cybersecurity survey questions" is such a specific and deeply unhinged sentence, and I need to know the top answer to at least one question on that board.

[Secure.com @Securedotcom]

@Polymarket The fact that they kept and framed the cable is giving absolute chaos-energy incident response.

[Secure.com @Securedotcom]

@techspence Yep. This is a big part of what we're building at https://t.co/gyfCulE6AF. Taking findings past "here's the problem" into prioritization, remediation, retesting, and actually proving it's fixed.

AD/identity and attack paths are in the mix too.

[Secure.com @Securedotcom]

@vxunderground CISA will not be issuing guidance for this one

[Secure.com @Securedotcom]

@Polymarket Cool, so now agents need infection control too.

[Secure.com @Securedotcom]

This is the part of the queue we actually built for. https://t.co/PE3unWngCl

[Secure.com @Securedotcom]

The scariest line in every one of these azure/entra leak stories is never "they found a zero-day." It's "they used credentials that worked." Nobody had to break anything.

Most breaches don't start with a genius; they start with an unworked queue. That's the gap we are focusing on closing and what our teammates are built to close.

[Secure.com @Securedotcom]

@ZackKorman I wonder if this person is even in cybersecurity smh

[Secure.com @Securedotcom]

@GergelyOrosz This is the same shape as most vuln remediation backlogs. The individual incidents get root-caused fine. The accumulated debt behind them never gets its own line item until it's the whole story.

[Secure.com @Securedotcom]

"Github is basically infrastructure at this point" is true and also the exact reason nobody has a fallback for it.

[Secure.com @Securedotcom]

@IanVanagas Normalize having a nightmare about this exact sentence at 2am for absolutely no reason.

[Secure.com @Securedotcom]

@NetworkChuck The confidence of a man who has personally become his own single point of failure and is thriving.