Richard Ackroyd

Fintech Security Engineer | Cyber Threat Detection

[Richard Ackroyd @rfackroyd]

Ransomware we've recently analysed uses the following command to pop your machine into Safe Mode before performing encryption

C:\Windows\System32\bcdedit.exe /set safeboot network

Why? Because your EDR/AV might not be allowed to run in Windows Safe Mode

1/2

[Richard Ackroyd @rfackroyd]

Mythos was not threatening identity

Up ~66% since February

[Richard Ackroyd @rfackroyd]

Ah, yes, Okta. The vulnerability management company.

🤦‍♂️

[Richard Ackroyd @rfackroyd]

Something has shifted in the past few months

We must position ourselves.

My take on how we need to think about AI in the cyber security industry

[Richard Ackroyd @rfackroyd]

https://t.co/zGRKH8fCJ0

[Richard Ackroyd @rfackroyd]

https://t.co/zGRKH8fCJ0

[Richard Ackroyd @rfackroyd]

@chooserich Honesty is the best policy

[Richard Ackroyd @rfackroyd]

Ah, yes, Okta. The vulnerability management company.

🤦‍♂️

[Richard Ackroyd @rfackroyd]

@MattZeitlin @d0rkph0enix Is Silicon Valley going to become the Simpsons for the tech space?

[Richard Ackroyd @rfackroyd]

@evilsocket @mariuszbit I would advise holding off on OpenClaw until there are more guardrails in place. Unless you are running on a device where your credentials are tightly scoped and you accept their risk of compromise.

[Richard Ackroyd @rfackroyd]

@TheFinPitch @claudeai Funny how the market thinks enhanced vulnerability patching affects some of these companies 😂

[Richard Ackroyd @rfackroyd]

@Cyb3rMonk Security is generally in a good position, but we will need to adapt in some areas

[Richard Ackroyd @rfackroyd]

A solution may be to prove that you use technology that avoids attributing a user to a particular VPN subscription but instead authenticates them to engage with overarching service provider. Implement the check before account creation is allowed. This is very hard to prove, however.

[Richard Ackroyd @rfackroyd]

@theragetech There is a spiralling number of age and face verification checking and the sector is only going to proliferate with AI generated faces. The thing is, a build fast mentality will lead to inevitable holes in these products - as we have observed many times before.

[Richard Ackroyd @rfackroyd]

@vysecurity Definitely better to use the word pen-test here. Nonetheless, I wouldn't run that without considerable guardrails and scope limits. That may be built in however!

[Richard Ackroyd @rfackroyd]

I accidentally selected the breakpoint marker in my IDE.

It reminded me of how much time I used to spend stepping through my code to debug issues.

AI is truly reducing the amount of time I spend doing this.

Do I miss it?

....Maybe.

[Richard Ackroyd @rfackroyd]

@Richard_ISC @mattjay Yeah the issue here is that IdP logs often generate a lot of false positive ‘risk events’ which lead to actual risk events - like this - being ignored by responders or not even operationalised in the first place

[Richard Ackroyd @rfackroyd]

Check out the full article here on Detect FYI

https://t.co/KVQPZO6c9j

[Richard Ackroyd @rfackroyd]

My first article on Detect FYI!

Been thinking about confidence scores in security alerts lately. Everyone gets severity - "how bad is this if real?"

But confidence asks "how sure are we this is actually malicious?"

Many teams either ignore it completely or use it wrong

[Richard Ackroyd @rfackroyd]

Bottom line: confidence isn't good or bad, it's about thoughtful implementation.

Clear definitions, consistent application, team alignment.

Whether chasing precision in-house or managing chaos at scale, it can help if done right