From an internal threat perspective, developer machines are as good as getting Domain Admin, and many times even more "lucrative" from an attack pov They have the keys and typically much less oversight. youtube.com/clip/UgkxqDZ...

Developer machines are higher risk than Domain Admin machines

youtube.com

Yes, you should lock your computer when you get up and walk away while at the office. No, you're not gonna get hacked in the 3 minutes that you're gone from your desk getting some water. YMMV

You should speak to your AI so it can understand the intent and inflection in your voice. You really want it to know when you're ticked off because it's creating bugs in your code.

Imagine if one day we don’t see any more Kerberoastable domain admin accounts. It would be something right…

Tell me you’ve worked in IT without telling me you’ve worked in IT. I’ll go first… Did you try turning it off and back on again?

Y’all are focusing on the wrong thing. organizations don’t get better by automating pentesting and eliminating pentesting jobs. Organizations get better by making their systems more secure and resilient. Great, you found 4000 vulnerabilities in half the time, IT admin still need to fix that stuff

IT admin skills are absolutely foundational to cybersecurity. How can you get a degree in cybersecurity and not ever see a UAC prompt before?!

While no AI isn’t replacing pentesters just yet, I do believe it’s changing the game drastically. It’s forcing low quality pentesting to raise the bar. It’s also a signal of what’s to come. But also, I think in many ways the “market” will decide if these ai pentesting platforms have value or not.

The advancements in AI this last 12 months have been staggering… But AI will only take your pentesting job if all you did was run a vulnerability scan and ship the report. Pentesting, a professional pentest, is more than running tools youtube.com/shorts/joYT9...

AI is going to k*ll pentesting jobs!!

Follow me on X: @techspence

youtube.com

As a defender, I want the advantage. I want my environment to be hostile territory to adversaries. I want them to know… that I know that they know I see them. Get wrecked.

How to get people to talk about your stuff. Make something that intersects with what people want and something that solves a deeply painful problem. Then make it really really good.

Whenever there’s an IT issue it’s always this (in order)… It’s not plugged in DNS

I don’t think you can have a true appreciation for IT support unless you’ve lived in and experienced it yourself

The best way to learn how secure something is the first use it then have to administer it 

Part of what makes you a good pentester is you know what rocks to turn over

Would you rather… Have to secure Wordpress or OpenClaw? (for the rest of your life if you had one singular job and this was it)

So who has interesting cybersecurity or IT-related use cases for openclaw they are playing around with? I wanna see some fun stuff…

Learn Active Directory and you’ll never work another day in your life…. You’ll work every day 🤪😂

If you’re an IT admin and you want upward career progression and you have any length of time left in your career, beginning to poke at these AI platforms and becoming comfortable with them is crucial. Not to be an expert but so you know what’s coming.

Pentesting findings don’t get fixed for a number of reasons. Some of which are out of the IT teams control. But also, many IT teams are burnt out putting out fires and working on other “more important” projects handed down to them by management that they don’t have time to fix security issues.

The infosec/cybersecurity space is funny because on social media, AI is taking over the world. Then I go to conferences and meet people who are primarily defenders and they haven’t heard of OpenClaw, which is probably the biggest phenomenon since OpenAI launched ChatGPT. Social media is a bubble.

The unhealthy desire to “go viral” hurts social media more than AI ever will.

I’m at zero trust world today and tomorrow. If you see me say what’s up!

How long until Active Directory is “dead?” I don’t think it will ever be, look at this slide that Cliff Fisher shared on the hybrid identity podcast.

I’m currently a pentester, but I’m also a former sysadmin. Something that’s not lost on me is that it doesn’t matter how good you think your security is, if your backups and recovery processes haven’t been tested, you’re rolling the dice.

Famous last words by IT admins: I’m just testing…

True or false, cybersecurity skills are necessary for IT admins?

If you’re an IT admin or CIO/CISO, you probably want to know what cybersecurity threats you’re up against. This is that episode… Ps - don’t focus on the numbers, focus on the trends and the techniques Listen/watch here 👇 🎧 offsec.blog/episode-170-...

Sure Pentest one a year, but also, don’t wait until your next pentest to: Run Locksmith Run ADeleginator Run PingCastle/PurpleKnight Check shares, sharepoint, wikis for creds

Are phishing/social engineering exercises actually useful? Or do they do more harm than good?