R E A V A

Information Security: tracking the stuff that makes it better. Or worse. \n Likes ~ bookmarks

[R E A V A @reava]

@brewers will yall play “add it up” by @violentfemmes every time you score?? LET’S GOOOOOOOO

[R E A V A @reava]

@ARozenshtein Sounds amazing. Could be midi sent to a DAW and then exported. Ai doesn’t have to generate the music to generate AI music …

[R E A V A @reava]

@shanevanderhart Fanny bear

[Bob Gourley - e/acc @bobgourley]

Some things we can all do to push back on the doomers: https://t.co/ZY3lySDRaY

[R E A V A @reava]

MICE…but for AI

[R E A V A @reava]

@HackingDave lol Had a fantastic leader at Pfizer who was famously 7 minutes late to every meeting I was in with him. Have changed jobs since then but still tell my teams the 7 minute rule: a 7 minute no-show means cancel the meeting

[R E A V A @reava]

@HostileSpectrum Only to the extent and in the proportion that these models are given access + tools to do so. Implementing these controls used to be a complexity problem but that barrier is much less significant today.

[Denny’s @DennysDiner]

@JensenHuang @nvidia

[Nicolas Krassas @Dinosn]

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity https://t.co/2Hph20rz0c

[R E A V A @reava]

@HostileSpectrum 6.8 and 7.62 still available

[Andrew Thompson @ImposeCost]

Sharing this job position for two reasons. The first is to help a new comer find employment. The second is to point to the fact that organizations with internal access to frontier model capabilities are and will continue to hire junior security personnel.
https://t.co/W05cyvJGu2

[Doug Burks @dougburks]

ICYMI SO-CRATES 1.1 is now available!

[R E A V A @reava]

@arekfurt Great analysis. It also explains the value of targeting trusted 3rd parties to shift down and left at the cost of additional time

[R E A V A @reava]

@Marie_Haynes Markdown has some limitations that seem better handled by a graph database

[MacCallister Higgins @macjshiggins]

nobody wants to hear this but the classical NASA systems engineering is the perfect model for developing code with LLMs. people try to approximate this with planning modes, but if you’re explicit in your docs it’s never been easier to build, test, and verify complex codebases.

[Florian Roth ⚡️ @cyb3rops]

I spent the last weeks building LLM benchmarks for a very specific reason:

We want to use AI in RuneAI to help with THOR finding triage, and I needed a better baseline for model selection than generic LLM leaderboards.

Security-event triage is its own thing.

A model can be great at coding, reasoning or vulnerability writeups and still be a bad fit for deciding whether a messy endpoint finding should be suppressed, reviewed or escalated.

In real deployments this will likely happen inside agentic workflows with tools, memory, context handling and feedback loops. But before testing the whole system, I wanted a clean baseline:

How does the model behave when it only gets the enriched finding itself?

Blog post with the reasoning and methodology:
https://t.co/KQPOPDWP1B

Interactive benchmark results:
https://t.co/pvVhTBJsz0

Repo:
https://t.co/Fw3uW9nu2a

Maybe useful for others building SOC / security-event triage benchmarks.

[Simone Margaritelli @evilsocket]

Earlier today Cloudflare's CSO shared how they tested Anthropic Mythos using an unreleased 8-stage vulnerability-discovery agent. So I asked Opus to implement the agent for me, it works via Claude SDK with a Pro or Max subscription, no API.

Enjoy https://t.co/McoZbTvTLL

[🅰🅳🅼 @securityfreax]

Modern C2 implants use sleep masking & metamorphic code to stay hidden. We’re revealing how to unmask them using low-level runtime telemetry (ETW & CPU profiling) live in production including a POC with a lightweight sensor.

My team will be presenting our research at x33fcon:

https://t.co/qhtckSyxx5

[TrustedSec @TrustedSec]

Today's webinar is packed with takeaways for #SOC teams. Learn:
🔍 How to build a MITRE ATT&CK® detection strategy
⚠️ Common MITRE ATT&CK® mapping pitfalls
🛡️ Active testing techniques to improve your defenses
And more—register now, see you at 1:00PM! https://t.co/4p7SdgYugH

[R E A V A @reava]

@itsolelehmann Agents performing test driven development with humans