Jamie Pringle

Sick SOC: A Practical Checklist of Symptoms! That SOC that looks operational (alerts, dashboards, tools) but lacks strategy, visibility, and repeatable response, so it quietly fails. Yeah… that’s called a sick SOC. I love the term “Sick SOC” — framed by Reza A. in his article, highlighting key metrics and warning signs that indicate your SOC isn’t operating at its best quality. • Strategic misalignment • Process & governance breakdown • Visibility & detection gaps • Knowledge & capability gaps vs threats • Architecture & technical implementation flaws • People & culture You can’t cure a sick SOC with more alerts; you cure it with clarity, coverage, and capability: https://lnkd.in/g9k63pfF If you want to make that checklist more “complete” and more usable in real SOC assessments, I’d add these categories: • Service management + customer alignment (SOC as a product) • Detection engineering lifecycle  • Data quality management (not just “data sources”) • Identity-centric operations (where modern incidents live) • Resilience + readiness • Third-party / supply-chain visibility I don't know what you heard about me! I practice, test, learn in public, and share what actually works ... daily and free! Threat hunting 101 series on YouTube: https://lnkd.in/g7D4pTVk Daily Cyber Drops on Medium: https://lnkd.in/gsekf7kB Nothing Cyber. Keep hunting. #cybersecurity #threathunting #threatdetection #opensource #tips #career #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #dataanalysis #incidentresponse #ai

31

2 Comments

Zero Trust was never just a network model. It is a narrative model. Because the real breach point is not your firewall. It is the story your people believe they are in. We keep building technical controls around human beings while refusing to admit the obvious. People don’t take risky actions because they are careless. They take risky actions because the narrative architecture around them rewards speed, emotional shortcuts, social pressure, and cognitive exhaustion. So here is the new human risk model you were never taught: 1. Humans act according to the story they think they are inside Not the policy manual, the training video, or the compliance checkbox. 2. Every attack is a narrative overwrite Phishing is not a link. It is a temporary hijacking of identity, emotion, and expectation. 3. Attention is the new attack surface If the mind is overloaded, Zero Trust collapses no matter how elegant the technology. 4. Culture is the control plane If the cultural narrative says “just get it done,” people will bypass every safeguard ever invented. Which means: Zero Trust only works when the human storyline matches the security architecture. The future of cybersecurity is not just technical. It is psychological, narrative driven, and rooted in how humans interpret reality under pressure. If your organization is not yet mapping: • emotional load • narrative incentives • cognitive friction • and identity based persuasion vectors …then you’re not practicing Zero Trust. You’re practicing Zero Hope. Narrative Architecture is the next frontier of human risk. And the companies that master it will outperform, out-secure, and outlast the ones still treating people as endpoints. If you want help building this model, let’s talk.

6

5 Comments

High SOC turnover. Stalled security roadmaps. These aren't just operational problems—they're symptoms of teams stretched too thin. When security practitioners spend all their time chasing alerts instead of building defenses, something has to give. Worth a look if your team needs some of their time back. Expel breaks down how MDR can help: https://okt.to/G6eSpw

7

Honestly, consumer VPNs are straight up scams at this point. They just make nonsense claims to scare people into buying products they don’t actually need. Not only does a VPN not do anything, because Internet traffic is already encrypted by default, it’s just luring users into a false sense of security by making handwavy claims that it’ll somehow protect your photos from being leaked.

346

71 Comments

NIS2 is here. Is your abuse desk ready? 🇪🇺📋 The directive doesn't just want security — it wants PROOF you can respond to incidents. That means: 📝 Documented abuse handling 🔍 Evidence trails ⏱️ Response time metrics Compliance isn't checkbox theater. It's building processes that actually work.

10

The Exposure Debt You’re Not Paying Down Every security leader knows about technical debt. But there’s another debt quietly compounding in your organization: EXPOSURE DEBT. Exposure debt is the backlog of vulnerabilities, misconfigurations, and risky conditions that aren’t urgent enough to fix today — so they sit. Not for days. Sometimes for months. Sometimes for years. And just like interest on a loan, the longer you leave them, the more expensive they become: • New dependencies form around unsafe systems • Threat actors develop and share exploits • Your ability to patch without disruption decreases Here’s the uncomfortable truth: Even if you’re hitting patch SLAs and keeping your “critical” metrics green, you might still be drowning in exposure debt. The solution? Track it where it actually matters: • By Business Process – Identify which revenue-generating or mission-critical workflows (order fulfillment, patient care, manufacturing uptime) carry the heaviest exposure load. • By System or Application – Spot the “chronic offenders” that never reach a clean state, so you can address root causes instead of patching forever. • By Owner – Not to blame, but to ensure accountability and highlight where teams need more resources or support. When you measure exposure debt in these contexts, you turn it from a vague security number into a business risk conversation — and that’s when you get traction with leadership. Your next move: Create an exposure repayment plan. Schedule fixes the same way you’d pay down a credit card before the interest crushes you — and stop adding new exposures faster than you can close the old ones. Question for you: What’s one example of exposure debt in your environment right now that nobody is talking about? #CyberSecurity #VulnerabilityManagement #ExposureManagement #RiskManagement #SecurityLeadership #BusinessRisk #CyberResilience #CISO #ExposureDebt

7

If people hate your security, they’ll find a way around it. Most companies act like they have to choose between security or user experience. That’s a false choice. When security becomes painful, people route around it. Shadow IT, workarounds, sticky notes with passwords — all of these happen because security was designed without considering the user. On the flip side, “frictionless” experiences without guardrails are exactly what attackers exploit. The reality? Good security is good UX. MFA that’s seamless. Policies that make sense in the flow of work. Guardrails that protect people without slowing them down. If your employees feel like they’re fighting security, you’ve already lost.

5

🚨 Security Wake-Up Call for Anyone Running Local AI Agents & Automation Bots I’ve been experimenting with running an AI agent (Clawdbot / Moltbot) locally on my Kali machine — and noticed something that should concern anyone doing the same. Every API token, webhook, and secret tied to the agent is stored locally in ~/.clawdbot/ — in plaintext. Let that sink in. If an infostealer or commodity malware lands on the machine, it’s not just a device compromise anymore — it’s a full credential spill across every connected service. No public exposure required. No open ports required. Just one bad download and your automation stack gets a new owner. 💀 Risk multipliers: - Local agent frameworks storing secrets unencrypted. - Multiple .json backups and temp files containing credentials. - Bots connected to APIs, browsers, cloud tools, and messaging platforms. - Long-lived tokens with broad permissions ⚠️ The attack surface is shifting. As local AI agents become more common, expect infostealers to start targeting these directories and config patterns specifically. 🔐 Minimum safeguards you should consider: • Use short-lived tokens wherever possible • Scope API permissions aggressively • Encrypt secret stores at rest • Run agents inside isolated containers/VMs • Avoid running from your primary workstation • Monitor for unexpected file access in agent config dirs • Rotate keys regularly We’re entering the era where agent security = identity security. Curious - how are others securing local AI agents and automation bots today? #InfoSec #AIsecurity #RedTeam #Automation #SecretsManagement #CyberSecurity #Clawdbot #moltbook #moltbot #ai #autonomoussystem #aibot #securityflaw

35

There’s a ton of hype around Clawd.bot right now, and discussion around risk is getting left in the dust. An always-on agent sitting inside your messaging apps and local system is… a lot. If you mess up permissions or configs (and people will), you’re suddenly dealing with leaked API keys, exposed logs, private conversations getting pulled into context, or an agent doing things it really shouldn’t because someone sent it the wrong message. Prompt injection alone is a nightmare in setups like this. For an agent like this to be truly useful, it requires a lot of permissions and that is incredibly dangerous without proper sandboxing. And then there’s cost. These agents don’t really stop they just keep running. Memory plus automation loops plus LLMs means token usage can quietly spiral until you’re staring at a bill wondering what even happened. No alarms or klaxons will fire, you will just unwittingly bleed your bank account. This is likely the future of useful AI. I expect once next-gen Siri releases (powered by Gemini) it will tout similar features. And I'm all for controlling/owning these things locally, but that puts a ton of risk and safety on the user instead of the app. This is bleeding edge stuff that I routinely see companies adopt as stable. Is it an interesting project? Yeah, no question. Is it low-risk or production-ready? Absolutely not. Going viral doesn’t replace basic threat modeling, cost controls, or actually knowing what’s running on your machine. If you're concerned about safe AI adoption in your org, reach out.

29

5 Comments

With less than a month remaining to submit for the Seattle Bsides Security Conference, I'm hosting another AMA focused on CFPs. Feel free to ask any questions you've had about CFP submissions in the comments below. In the meantime, here are some quick tips to enhance your submission: 1. Read all the directions carefully. 2. Avoid generic submissions; a one-sentence description for your abstract won't suffice. Provide enough detail to give reviewers a detailed understanding of your topic. 3. Include outlines and learning objectives to clarify your message. While optional, they can significantly strengthen your submission. 4. If examples are provided, review them, but remember that simply mimicking them does not guarantee acceptance. 5. Seek feedback and be prepared to iterate on your submission. Looking forward to your questions! #bsidesseattle #cfp #ama

68

1 Comment

I'll say something that makes most vendors uncomfortable: Your firewall didn't fail you. Your assumptions did. Last year, 45% of enterprise CVEs went unpatched. Not because teams didn't know. Because they assumed they had time. The average exploit window is now 44 days. In 2020, it was 700. We're not losing to smarter attackers. We're losing to our own speed assumptions. Here's what I've learned building security architecture for regulated industries — rail, energy, finance — where a breach isn't just a PR crisis, it's a public safety event: ↳ Compliance is the floor, not the ceiling. ↳ Zero Trust is a posture, not a product you buy. ↳ The most dangerous gap isn't technical. It's the gap between your CISO's slides and your dev team's daily reality. ↳ If your AI system can act autonomously, it can fail autonomously. Govern it like it will. The organisations getting this right aren't spending more. They're assuming less. What assumption in your security stack is quietly overdue for a challenge? Drop it in the comments. I read every one. #CyberSecurity #ZeroTrust #SecurityArchitecture #AIRisk #DevSecOps #EnterpriseTech #CISO #RSKBSL

4

2 Comments

I’m still processing everything from #CiscoLive in Amsterdam, but one thing is certain: the "Cisco + Splunk" vision is finally getting real. We’ve been hearing about the integration for a while, but the new roadmap moves us past simple API hooks and into what they’re calling Agentic Operations. A few things that actually stood out to me: • No more "𝗗𝗮𝘁𝗮 𝗧𝗮𝘅": The Unified Data Fabric is a huge win. Being able to use Federated Search to query network telemetry in Splunk without moving massive logs around is going to save us a ton of overhead. • AI that actually does something: I was impressed by the Agentic AI demos. We’re moving from dashboards that just scream "Look at this!" to agents that can handle autonomous troubleshooting and attack verification on their own. • The Hardware Flex: It was cool to see the Silicon One G300. It’s easy to forget that all this "AI magic" needs massive physical throughput, and Cisco is clearly building the backbone to support it. The takeaway? The SOC is getting a massive upgrade from reactive to predictive. Great catching up with everyone there, it’s an exciting time to be in this space. 🛡️ #CiscoLiveEMEA #XDR #Splunk #AgenticOps #CyberSecurity #CiscoLive

127

3 Comments

Instagram Data Breach „17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number.“

1

A Head of IT at a 250+ person company told me something last month that stuck with me. "We're managing endpoint security, patch cycles, vulnerability alerts, compliance evidence, and vendor reviews. With three people." This is more common than anyone wants to admit. Small IT teams in mid-sized companies are expected to operate like enterprise security functions, without the headcount, without the budget, and without tools that actually talk to each other. So what happens in practice? Patches get delayed because nobody has a clear picture of what's actually critical versus what's just loud. Compliance evidence gets pulled together in a panic before the audit. Vendor reviews happen once at onboarding and then disappear into a spreadsheet nobody updates. And the attack surface, the subdomains, the cloud assets, the third-party connections, keeps expanding quietly in the background. The team isn't failing. The setup is. The fix most people reach for is another tool. Something to plug the gap. But that just adds one more dashboard to check, one more alert queue to manage, one more thing the team has to context-switch into. What actually helps is consolidation. Fewer tools that cover more ground. One place where vulnerability data, compliance status, and external exposure live together so the team isn't stitching context across five tabs to answer a basic question. Small teams don't need more tools. They need less fragmentation. There's a difference. And it matters a lot when you're three people trying to hold the line. #cybersecurity #infosec #security #securityLeadership #IT #ITmanagement #ciso #compliance #vulnerabilities #attacksurface

18

4 Comments

Lesson 3: When ArgoCD Fights Your Operators This one caught me off guard. Everything looked healthy. No outages. No broken workloads. Yet ArgoCD kept trying to “fix” things. CPU usage climbed. Syncs never settled. Drift notifications kept firing. Nothing was actually wrong. The problem was not failure. The problem was control. Some Kubernetes operators are designed to change resources dynamically. External Secrets, cert-manager, and similar tools rotate certificates and update webhook configs on their own. That is their job. ArgoCD saw those changes as drift from Git and tried to revert them. The operator immediately changed them back, the loop never ended. 1. ArgoCD applied state. 2. Operator corrected it. 3. ArgoCD detected drift. 4. Repeat, forever. The lesson: Not all drift is bad. Some resources are meant to change at runtime. If you do not account for that, you will spend your days fighting the very tools you installed to help you. Common offenders I now watch for: • Webhook certificates • CRD conversion webhooks • ConfigMaps • Operator-managed status fields GitOps is about intent, not control at all costs.

7

3 Comments

Heads up folks! A critical zero-day vulnerability in Microsoft SharePoint Server, identified as CVE-2025-53770 with a CVSS score of 9.8, is currently being actively exploited in a large-scale campaign dubbed “ToolShell.” Attackers exploit the vulnerability by sending crafted requests to SharePoint endpoints, leading to the execution of arbitrary code. The flaw arises from the deserialization of untrusted data, allowing unauthenticated remote code execution (RCE) on on-premises SharePoint Servers. All on-premises versions of SharePoint Server, including 2016, 2019, and Subscription Edition. SharePoint Online (Microsoft 365) remains unaffected. https://lnkd.in/g2s9SEQy

11

Those using #Intune or other endpoint management systems (including Action1) who don't want to become the next #Stryker ... Cybersecurity and Infrastructure Security Agency (CISA) just issued an endpoint management system hardening guidance: - Multi-Admin Approval - RBAC for least privilege - MFA (via EntraID SSO or similar) The multi-admin approval's basic idea is to require a second admin's approval for sensitive operations (such as remote wipe), changing permissions etc. The other two are fairly obvious. #StrykerAttack #Intune #cybersecurity #endpointmanagement

273

80 Comments

Everyone’s saying the same thing right now: “Level 1 begins November 10th.” “C3PAOs are booked out until 2026.” “Start your Level 2 prep now.” Most contractors tuned that message out months ago. They’re not ignoring the deadline, they’re paralyzed by it. The real story isn’t the timeline. It’s that hundreds of small DoD suppliers have no idea where to start, and the fear of doing it wrong keeps them frozen. At Quantum AI Security, we’ve seen what actually moves the needle: 1️⃣ A clear scope definition. 2️⃣ Evidence that tells your story, not just a checklist. 3️⃣ A trusted CCP guiding you through both. The timeline isn’t the problem. Clarity is. #CMMC #Cybersecurity #DefenseIndustrialBase #Leadership #QuantumAISecurity

11

1 Comment