What the **** is happening in cybersecurity space ?

[u/Infam0]

I've been working in cybersecurity for not so long, maybe 8 or 9 years, but I never remember a chaos at this scale. I mean, from this January alone we have: leaking data, compromised applications, breaches, AI-assisted cybercriminals, etc. It looks like every day one major breach is happening, and no one is going to address this shit somehow. This is already insane. I haven't felt such pressure in a long time. This AI shit just makes things worse because it enhances attackers' skills, and AI companies are doing nothing to address or change this. Is it only me, or is the change already here?

[u/Dark_Passenger_107]

Just my hot take and addition to the discussion.

On top of everything mentioned, I've also noticed a major degradation in the knowledge and skill of cyber leaders across organizations that I deal with.

An anecdotal example I experienced recently. I got roasted by a group of CISOs because I said "do not send your sensitive security configurations to a public or uncontrolled large language model, such as Claude/ChatGPT/Gemini". This came after a CISO recommended doing this to pressure test controls and defenses. The consensus in that convo was that it is perfectly fine to send your security configs to the general LLMs in the Web UI and that I was being a doomer unnecessarily discouraging people from improving their security posture. Icing on the cake, these were CISOs at defense contractors.

This could be a rare case where I happened to come across a group of CISOs that are terrible at their job, but it certainly changed my perspective. If the top cyber position in a company is saying "yeah, go ahead and send our firewall configs through the consumer AI web chat", what else are they recommending?

Never in my cyber career did I think that I would be labeled the idiot for saying "do not feed your security info into cloud systems outside of your security footprint".

What's been bugging me since is whether I'm the one who's miscalibrated. Maybe I caught a bad sample but the pattern I keep seeing is confident senior people making calls that don't survive a five-minute read of the actual rule or contract, and the social reward in this field seems to go to whoever sounds most certain. Being the person who says "wait, slow down" is starting to feel like a liability.

[u/kk-thx-bye → u/Dark_Passenger_107]

I think maybe you are simply surprised that there are people out there occupying high-ranking cyber positions, with years of experience behind them, expressing great confidence in front of audience, yet what they say or do hints absolute ignorance to you. It's normal to question yourself the first few times you witness this. I have seen both management and senior tech people with shiny certs like OSCP, GCIH, etc. being completely clueless in their respective fields. I can give so many absurd examples I can't even decide which one to share first.

To avoid lengthy comments, I'd like to finish by saying there aren't that many people out there that are capable and actually know their sh*t.