spencer

The best way to learn how secure something is the first use it then have to administer it 

Part of what makes you a good pentester is you know what rocks to turn over

Would you rather…

Have to secure Wordpress or OpenClaw?

(for the rest of your life if you had one singular job and this was it)

So who has interesting cybersecurity or IT-related use cases for openclaw they are playing around with? I wanna see some fun stuff…

Sure but I’d argue in this example, not accidentally configuring a template for ESC1 should be within their purview

Learn Active Directory and you’ll never work another day in your life….

You’ll work every day 🤪😂

If you’re an IT admin and you want upward career progression and you have any length of time left in your career, beginning to poke at these AI platforms and becoming comfortable with them is crucial.

Not to be an expert but so you know what’s coming.

I personally think IT admin cybersecurity skills should go beyond the basics. If you manage ADCS you should be familiar with certificate abuse for example

Badum chhhh hah

Pentesting findings don’t get fixed for a number of reasons. Some of which are out of the IT teams control.

But also, many IT teams are burnt out putting out fires and working on other “more important” projects handed down to them by management that they don’t have time to fix security issues.

The infosec/cybersecurity space is funny because on social media, AI is taking over the world.

Then I go to conferences and meet people who are primarily defenders and they haven’t heard of OpenClaw, which is probably the biggest phenomenon since OpenAI launched ChatGPT.

Social media is a bubble.

The unhealthy desire to “go viral” hurts social media more than AI ever will.

I’m at zero trust world today and tomorrow. If you see me say what’s up!

How long until Active Directory is “dead?”

I don’t think it will ever be, look at this slide that Cliff Fisher shared on the hybrid identity podcast.

I’m currently a pentester, but I’m also a former sysadmin. Something that’s not lost on me is that it doesn’t matter how good you think your security is, if your backups and recovery processes haven’t been tested, you’re rolling the dice.

Famous last words by IT admins: I’m just testing…

True or false, cybersecurity skills are necessary for IT admins?

If you’re an IT admin or CIO/CISO, you probably want to know what cybersecurity threats you’re up against. This is that episode…

Ps - don’t focus on the numbers, focus on the trends and the techniques

Listen/watch here 👇

🎧 offsec.blog/episode-170-...

Sure Pentest one a year, but also, don’t wait until your next pentest to:

Run Locksmith
Run ADeleginator
Run PingCastle/PurpleKnight
Check shares, sharepoint, wikis for creds

Are phishing/social engineering exercises actually useful? Or do they do more harm than good?

As much as things change in cybersecurity, there’s an overwhelming portion that stays the same.

Your browser is up to date You can use YouTube's latest features!

3 common Windows misconfigs I see during internal pentest.

1) weak local admin control

2) Insecurely installed/configured software

3) Weak endpoint security

I explain how these can be dangerous in my latest video 👇

youtu.be/gcKejfmPea4

It’s a great time to be a web pentester

If you're on an internal pentest and you bust out tcpdump or wireshark, is it going well or going badly? 😆

Making frontier cybersecurity capabilities available to defenders Claude Code Security is one step towards our goal of more secure codebases and a higher security baseline across the industry.

This is great but how do we get orgs to not revert to RC4 on their service accounts….

Or login with domain admin everywhere

Or use the same password for all their admin accounts

Relatable IT admin scenario: you leave a job and shortly after the job you just left gets hacked/ransomwared.

Brutal honestly. Gut wrenching 🤕

The barrier to entry for threat actors continues to get lower, but for defenders, it almost seems like its getting higher...

📰Source: awesomeagents.ai/news/ai-powe...

Supply chain attack that drops openclaw instead of malware or a more typical payload.

Buckle up folks! 🦞🔥

clawdint.com/cases/203

I’ve had ideas to AI-ify Active Directory but I’m a man of principles. I’ll vibe code AD security tools instead! 😅

Even the vendor doesn’t know why it’s broke or how to fix it … so stupidly common -.-