The hottest Cybersecurity Substack posts right now

And their main takeaways
Category
Top Technology Topics

AI SOC Automation isn't the right problem to solve

Frankly Speaking • 152 implied HN points • 14 Jan 25
🕹 Technology Cybersecurity
  1. Focusing on better detection engineering is key in security operations. It helps identify threats more effectively rather than just automating processes.
  2. Many traditional security operations centers (SOCs) may not be necessary for most companies. Smaller, more efficient models or managed detection services can be better alternatives.
  3. The future of SOCs is likely to involve fewer human analysts and more automation, emphasizing custom detections that fit the specific needs of a business.

AI Hallucinations: Proven Unsolvable - What Do We Do?

Mind Prison • 73 implied HN points • 17 Jun 25
🕹 Technology Cybersecurity
  1. AI hallucinations happen because AI relies on patterns from limited data, which can't cover everything. This means AI will always make mistakes when trying to understand things outside its knowledge.
  2. We need to treat all AI outputs with caution since they can all be hallucinations. It's important to check and verify what the AI says, especially in critical situations.
  3. The issue of hallucinations is built into how AI works, so trying to completely fix them isn't possible. Instead, we should focus on verifying AI results to ensure reliability.

Good News, Bad News

The Security Industry • 15 implied HN points • 25 Nov 25
🕹 Technology Cybersecurity
  1. The annual cybersecurity directory will stop after 2025 because publishing a complete, up-to-date vendor list risks enabling competitors to copy the database. This protects the business value of the dataset.
  2. AI Security is exploding — about 290 companies founded 2022–2025 use AI to secure systems or apply AI to security tasks. That rapid growth means many startups will be acquired and the category will need frequent updates.
  3. A forthcoming book will comprehensively profile all AI security companies using the full dataset, providing the first market-wide view of the space. It will be published in mid-January with signed copies available at the RSA conference.

Threats Without Borders - Issue 167

Threats Without Borders • 58 implied HN points • 30 Jan 24
🕹 Technology Cybersecurity
  1. Different device identifiers include MAC Address, Serial Number, and IMEI for unique device recognition.
  2. EID and ICCID are specific identifiers for eSIM functionality and SIM cards on mobile networks.
  3. MEID, SEID, and others are additional unique identifiers used for specific device functionalities like eSIMs and NFC technology.
Get a weekly roundup of the best Substack posts, by hacker news affinity:

Authcon Recap

ciamweekly • 62 implied HN points • 23 Jun 25
🕹 Technology Cybersecurity
  1. Passwords are becoming less common as new methods like passkeys and magic links are easier and safer. However, passwords will still be around because they give users full control.
  2. The customer identity and access management (CIAM) industry is still growing. As the internet expands, we'll need accounts for all kinds of everyday tasks.
  3. Learning from other people's experiences is valuable. The conference showcased practical lessons on handling user authentication and security from real-world situations.

Public Sector Compliance Conundrums

Resilient Cyber • 19 implied HN points • 23 May 24
🕹 Technology Cybersecurity
  1. Public sector organizations struggle with balancing cybersecurity, innovation, and compliance. They need faster software delivery while keeping systems secure, which is a tricky balance.
  2. Programs like FedRAMP and the Authority to Operate (ATO) process are seen as too complicated and slow, making it hard for the government to adopt new cloud services quickly. This can lead to workarounds that compromise security.
  3. The push for secure software supply and self-attestation aims to improve security but can add more complexity for software suppliers. Striking the right balance between security and accessibility is essential.

What's in a name?

Resilient Cyber • 79 implied HN points • 04 Dec 23
🕹 Technology Cybersecurity
  1. Software identification is important for managing everything from consumer products to national security, but the current naming systems are confusing and inconsistent.
  2. There are several ways to identify software, like Common Platform Enumeration (CPE), Package URL (PURL), and Software Identification Tags (SWID), each with its own uses and challenges.
  3. A unified approach to software identification is needed, but there are various paths forward, including using a single identifier or multiple formats, which could complicate things further.

Thoughts on the Cylance and Arctic Wolf Acquisition

Frankly Speaking • 152 implied HN points • 19 Dec 24
💼 Business Cybersecurity
  1. Cylance was acquired by Arctic Wolf for a low price because it wasn't performing well under Blackberry. They lost money and weren't competitive in the endpoint security market.
  2. Arctic Wolf aims to enhance its services by integrating Cylance's AI and technology, making it more appealing to businesses looking for effective security solutions.
  3. The acquisition could help Arctic Wolf diversify and strengthen its offerings ahead of a possible IPO, potentially attracting mid-sized companies searching for value in security services.

($) DeepSeek Diffusion

Interconnected • 123 implied HN points • 07 Feb 25
🕹 Technology Cybersecurity
  1. The ongoing discussion about DeepSeek focuses too much on the rivalry between the U.S. and China. It's more about whether technology is open source or closed source.
  2. Open source technology, like DeepSeek, can spread quickly and widely, getting adopted by various companies across the globe.
  3. Major cloud providers, including U.S. companies, are offering DeepSeek models to their customers, showing its significant impact in the tech world.

Risky Business: Ian Bremmer on Political Risk, Russia, North Korea, and Trump

The Octavian Report • 8 implied HN points • 23 Dec 25
🌍 World Politics Cybersecurity
  1. Political risk is now the primary global uncertainty, with higher chances of direct military clashes between major powers and a broader geopolitical slowdown.
  2. The current U.S. presidency increases unpredictability and erodes traditional guardrails, raising the risk of accidental conflicts while also making unusual diplomatic outcomes, like a deal with North Korea, more conceivable.
  3. Cyber attacks and other non-nuclear threats are growing and hard to deter or attribute, and the old rules-based global order is fragmenting into more regional, thematic, or multi-stakeholder systems.

How to be safe from infinite loops[Technique Tuesdays]

Technology Made Simple • 99 implied HN points • 28 Jun 23
🕹 Technology Cybersecurity
  1. The Jolt Approach provides a simple yet powerful method to detect and escape infinite loops by monitoring program progress and identifying loop iterations that produce the same state, which is an indication of being stuck in a loop.
  2. It's crucial to address the limitations of the Jolt Approach, especially in scenarios where programs cycle between different states, by implementing strategies like storing each state, breaking if a seen state recurs, and having code that accounts for these situations.
  3. To safeguard against infinite loops, ensure your code progresses in every step, have clearly defined exit strategies, use kill-switches like iteration limits, and implement thorough logging for observability.

Must Learn AI Security Part 17: Social Engineering Attacks Against AI

Rod’s Blog • 99 implied HN points • 28 Sep 23
🕹 Technology Cybersecurity
  1. Social engineering attacks against AI involve manipulating AI systems using deception and psychological tactics to gain unauthorized access to data.
  2. Strategies to mitigate social engineering attacks include developing AI systems with security in mind, monitoring system performance, and educating users about potential risks.
  3. Monitoring aspects like AI system performance, input data, user behavior, and communication channels can help detect and respond to social engineering attacks against AI.

Microsoft Sentinel SOC 101: How to Detect and Mitigate Phishing Attacks with Microsoft Sentinel

Rod’s Blog • 99 implied HN points • 19 Sep 23
🕹 Technology Cybersecurity
  1. Phishing attacks are a significant threat that targets human vulnerabilities and can lead to identity theft or financial fraud.
  2. Organizations can mitigate phishing attacks by adopting a 'defense in depth' strategy that includes user education, email filtering, and incident response planning.
  3. Utilizing Microsoft Sentinel, Kusto Query Language (KQL), and integrating with Microsoft 365 Threat Protection can enhance proactive threat hunting and response capabilities against phishing attacks.

When This “Red Boy” Grows Up, AI-Based Tool 360GPT Could Give China an Edge in Cyber Conflict

Natto Thoughts • 99 implied HN points • 12 May 23
🕹 Technology Cybersecurity
  1. Qihoo 360 is developing an AI tool called 360GPT that could potentially enhance China's cyber defense capabilities.
  2. Zhou Hongyi, the founder of Qihoo 360, is actively embracing AI technology to strengthen cybersecurity in China and prepare for cyber warfare.
  3. There are tensions between the US and China in the cyber realm, with Qihoo 360 openly calling out US hacking activities and emphasizing the need for national preparedness in cyber warfare.

AI in the Wrong Hands

Rod’s Blog • 39 implied HN points • 05 Mar 24
🕹 Technology Cybersecurity
  1. The misuse of AI technology for malicious purposes is a concerning issue due to its potential to cause harm through deepfake videos, social media manipulation, cyberattacks, and surveillance.
  2. AI, though beneficial in various industries, can pose significant risks when in the wrong hands, leading to the creation of deceptive content, spread of hate speech, incitement of violence, and cyber breaches.
  3. Subscribing to Rod's Blog provides access to more insights on the dangers of AI falling into the wrong hands and empowers readers to stay informed on this critical topic.

The PyPI lockdown of 2023

Deploy Securely • 98 implied HN points • 02 Jun 23
🕹 Technology Cybersecurity
  1. PyPI, a popular repository for Python developers, suspended new uploads and user registrations due to an influx of malicious code.
  2. Malicious packages on PyPI pose severe security threats, like running unintentional malware in your system.
  3. Security measures to take include verifying package provenance, checking package names for accuracy, and using trusted hosts with pip.

With Governor’s Signature, Minnesota Gives Residents A Right to Repair

Fight to Repair • 98 implied HN points • 24 May 23
🇺🇸 U.S. Politics Cybersecurity
  1. Minnesota Governor Tim Walz signed the Digital Fair Repair Act into law, giving residents the legal right to repair electronics, joining New York as one of the first U.S. states with comprehensive repair laws.
  2. The new law requires manufacturers to provide documentation, parts, and tools for repair within 60 days of a product's sale, though some products like cars are exempt from these regulations.
  3. Minnesota's right to repair legislation includes measures to prevent manufacturers from evading repair requirements under the guise of 'cybersecurity,' marking progress in consumer rights and product longevity.

Tianfu Cup 2023: Still a Thing

Natto Thoughts • 79 implied HN points • 16 Nov 23
🕹 Technology Cybersecurity
  1. China's Tianfu Cup hacking competition has evolved from focusing on foreign products to including more domestic products as targets, sparking concerns among Western companies and security experts.
  2. The competition rules of Tianfu Cup 2023 included new sections for exploit demonstration review process and responsible vulnerability disclosure, highlighting the importance of following responsible disclosure procedures in the competition.
  3. In Tianfu Cup 2023, two teams successfully hacked VMware products, winning the top awards, although the competition results did not provide much detail on other attempts on domestic targets.

ITDR vs XDR

Rod’s Blog • 39 implied HN points • 01 Mar 24
🕹 Technology Cybersecurity
  1. ITDR focuses on integrating security tools within the IT environment, while XDR extends to sources beyond IT like cloud and mobile.
  2. ITDR can help reduce complexity and cost by providing a unified platform, while XDR may require more resources and expertise to implement and maintain.
  3. ITDR can improve threat detection and response efficiency, while XDR enables more proactive security measures and a comprehensive view of the threat landscape.

AI's Impact on Cybersecurity

Rod’s Blog • 39 implied HN points • 29 Feb 24
🕹 Technology Cybersecurity
  1. Artificial Intelligence (AI) plays a crucial role in cybersecurity, both increasing threats and enhancing defenses against cyberattacks.
  2. AI-powered hacking tools automate attacks at a large scale, evolving to outsmart traditional security measures, requiring organizations to constantly improve their defenses.
  3. One common AI-powered cyber threat is the use of machine learning algorithms for spear-phishing attacks, creating personalized and convincing phishing emails that are challenging to distinguish from legitimate communications.

How Microsoft Security Copilot Can Help Defend Against Cyberthreats

Rod’s Blog • 79 implied HN points • 09 Nov 23
🕹 Technology Cybersecurity
  1. Security teams face challenges like complexity of data, lack of skilled professionals, and speed of evolving cyberthreats.
  2. Security teams need a solution to simplify data and tasks, empower them with AI technology, and protect against cyberthreats effectively.
  3. Microsoft Security Copilot is an AI-powered solution that can help security teams manage security posture, respond to incidents, and generate security reports efficiently.

Microsoft Security Copilot - the Introduction

Rod’s Blog • 79 implied HN points • 07 Nov 23
🕹 Technology Cybersecurity
  1. Microsoft Security Copilot is an AI-powered security solution by Microsoft to help security teams respond faster and more effectively to cyber threats.
  2. Security Copilot provides tailored insights and guidance for tasks like incident response, threat hunting, intelligence gathering, and posture management.
  3. The tool seamlessly integrates with Microsoft's security portfolio and third-party services, offering features like incident summarization, threat exposure information, and executive report generation.

A Digital Scouts Honor

Resilient Cyber • 19 implied HN points • 09 May 24
🕹 Technology Cybersecurity
  1. The Secure-by-Design Pledge encourages software companies to make their products more secure, focusing on goals like using multi-factor authentication and reducing default passwords. This means companies are promising to create safer software for everyone.
  2. The pledge is voluntary, which means companies are not legally required to follow these guidelines. While this relies on their honesty, it raises trust issues since there's no enforced accountability.
  3. Many big names in tech have signed this pledge, which is a positive step. But it's crucial for more non-security-focused companies to join in for real change to happen in improving software security.

Three Steps I Take for Data Privacy

Technically Optimistic • 39 implied HN points • 23 Feb 24
🕹 Technology Cybersecurity
  1. Consider using privacy-focused browsers like Firefox or Brave to control your online experience more effectively.
  2. Utilize end-to-end encrypted messaging platforms like Signal to keep your messages private and secure from prying eyes.
  3. Protect your email privacy by using services like Hide My Email or SimpleLogin to prevent your email from being shared or aggregated.

5 Cybersecurity Predictions for 2023

Frankly Speaking • 355 implied HN points • 27 Dec 23
🕹 Technology Cybersecurity
  1. Security engineers will play a major role as companies seek efficiency through automation and restructuring.
  2. Cybersecurity services will increase in demand due to outsourcing certain functions and project work.
  3. Companies will invest in more cybersecurity tools and consolidate vendors to manage smaller budgets.

5 Cybersecurity Predictions for 2024

Frankly Speaking • 305 implied HN points • 29 Feb 24
🕹 Technology Cybersecurity
  1. Security companies are shifting focus to platforms, leading to acquisitions and consolidations to improve operational efficiency.
  2. Cybersecurity is moving towards more building and software engineering, away from solely relying on buying tools to solve problems.
  3. The adoption of reasonable metrics is becoming crucial for cybersecurity, allowing for better justification of funding and overall security enhancement.

Edition #2: Agent Security Standards + Identity/Authorization + Secure Agent Engineering + SecureVibes Update

Boring AppSec • 7 implied HN points • 17 Dec 25
🕹 Technology Cybersecurity
  1. AI agent systems need new standards to measure and manage risk because traditional vulnerability scoring and IAM are built for deterministic, human-scoped sessions. Risk models must account for agent autonomy and enforce task-scoped, intent-aware access.
  2. Building secure agents means defending against prompt injection and goal-manipulation, providing explicit contextual inputs, sandboxed error handling, and continuous evals and tracing to tame probabilistic behavior.
  3. Product security should favour practical, incremental fixes and context-aware prioritization, using AI to propose patches but validating downstream impacts and tribal knowledge. Strengthening agent-to-agent protocols and supply-chain controls is essential to prevent abuse and preserve trust.

Một chuyến đi Boston

Thái | Hacker | Kỹ sư tin tặc • 319 implied HN points • 20 May 22
🌍 World Politics Cybersecurity
  1. Attending a high-profile event like the Harvard Kennedy School gathering provides a platform to raise important issues, like cybersecurity in this case.
  2. The atmosphere at events involving high-ranking officials can be tense, especially when asking challenging questions.
  3. Directly engaging in discussions and asking thought-provoking questions can lead to impactful contributions and connections.

How Crowdstrike fails

Frankly Speaking • 305 implied HN points • 15 Feb 24
🕹 Technology Cybersecurity
  1. Crowdstrike initially succeeded by focusing on incident response, not just products, which differentiated them from competitors like Symantec.
  2. The company's expansion into adjacencies and acquisitions, like PAM and logging, is an effort to move from endpoint protection to a broader platform play for sustained growth.
  3. Crowdstrike may face challenges if they don't adapt successfully to selling to DevOps, security engineers, and managing acquisitions, risking plateauing growth and loss of market interest.

Correlating AWS S3 Breaches

Detection at Scale • 19 implied HN points • 29 Apr 24
🕹 Technology Cybersecurity
  1. AWS S3 buckets are a common target for attackers due to misconfigurations and high-value data. Security teams should focus on monitoring S3 activity to ensure authorized access and detect breaches early.
  2. S3 serves as a major storage solution for various data types in the cloud. Its widespread use makes it a prime target for attackers seeking to compromise sensitive information.
  3. Monitoring S3 bucket activity is crucial for detecting suspicious behavior that could signal a breach. Using tools like CloudTrail, GuardDuty, and CloudWatch can provide valuable insights and enhance security measures.

Microsoft Sentinel SOC 101: How to Detect and Mitigate Social Engineering Attacks with Microsoft Sentinel

Rod’s Blog • 39 implied HN points • 06 Feb 24
🕹 Technology Cybersecurity
  1. Social engineering attacks can have devastating consequences on organizations, leading to financial loss, reputational harm, and legal issues.
  2. Microsoft Sentinel employs machine learning, behavioral analysis, and threat intelligence to effectively detect and mitigate social engineering attacks.
  3. To defend against social engineering, organizations should implement a comprehensive defense strategy utilizing technical controls, user awareness training, and incident response procedures.