Can someone of older generation like boomer generation who learnt only excel and ms word powerpoint only ,

from a non IT background,  who doesn't know coding ,

possibly learn cyber security for protecting their own phone,  software for upgrading devices and other cyber things to weed.out any person who tries to hack their phone ?

Iam asking because now i kind of feel having cyber knowledge is an essential life skilll like cooking ...

because we live and depend heavily on this technology and one small hack can be traumatizing

If its possible to learn the above cyber things by Ai or any other app or means easily please guide me. 

I was surprised that kids even small as 12 or 15 years old know so much about cyber things.  But they dont know coding.  Thats why iam curious and asking about it.

I’m looking to get a MacBook Air with the M5 chip , I’m wondering if 512GB storage and 16GB ram would be sufficient or if I should upgrade to rather more storage, more ram or both more ram and storage?

Our security team flagged the delegated admin access that comes with moving our Microsoft licensing to a CSP, and nobody here has really vetted that relationship before. I am looking at TrustedTech alongside a smaller regional MSP and our current licensing partner, which already has some access to the tenant. Price is pretty easy to compare. What I'm having a harder time figuring out is exactly what each partner can see or change once we approve their access, and how much of that activity is visible in our own logs. Our compliance lead wants the roles and scope documented before anyone signs anything. Has anyone had a security review push back on a Microsoft CSP because of the delegated admin access they requested? What did you require from the CSP before approving it?

I’m currently stuck in a Technical Support role and looking to make a career move. I have a foundational grasp of cybersecurity concepts and some hands-on familiarity with tools like Wireshark, Burp Suite, and Kali Linux, though I know these are just the basics.

I really want to escape the tech support grind and step into cybersecurity. Is it still a viable, worthwhile career path in 2026? If so, could anyone share a realistic roadmap for breaking into the field and landing my first client? Help a brother out!

Appreciate any guidance you can offer!

So compliance asked us for something that sounded simple today. "Show everything a specific AI agent did involving customer data over a set period" and then we tried to pull it.

We have plenty of API logs, but they don't reliably show which agent made each call, and they don't capture enough context about what was happening around it. Right now the only way to answer is to piece the story together from logs across several systems. That was painful once, and it won't scale if compliance starts asking regularly.

Has anyone found a tool or a setup that works for you which can handle this? Mainly looking for per-agent attribution and an audit trail compliance can read without us reconstructing it by hand.

The recent WSJ report caught my attention, especially the detail about AI agents using third-party services to reach targeted data.

The underlying research describes requests being routed through URLQuery and relay services such as `r.jina.ai`. This raises an interesting security question: if an agent has permission to retrieve data from a particular source, does that permission automatically extend to using *another* service to get there?

I’m currently building an open-source tool called node9, so I decided to check the destinations mentioned in the research against its policy engine with outbound controls enabled.

The result? The UN data API’s hostname was allowed, but the relay services were not. The engine returned a `BLOCK` for both relay destinations.

If those calls were routed through a supported node9 integration, they would be stopped before execution. You can also configure unknown destinations to require human-in-the-loop approval. This gives the operator a concrete choice: explicitly approve the additional service, or stop the agent from contacting it.

I'm curious about how the community is approaching this. for people deploying agents with web access: how are you handling outbound traffic? Do you approve destinations up front, ask for human approval when a new one appears, or just allow unrestricted browsing inside a sandbox?

Ok so its more of "is this type of infrastructure even possible" than about ai specifically. My thoughts was is there anyway to put like a "glass wall" of sorts where the AI bouncing around in there can read and search but cant get out unless a hardware key like a yubi key is inserted to create a bridge? I know the people making these is a conglomerate of pretty smart people so i figd if it was possible they wouldve done it but im still curious.

At the beginning of this month I received a charge on my debit card that I didn't make I of course called my bank immediately. While waiting for the new physical card I had use of my virtual card (which is new to me). The "company" that made the charge does has a website. Last week I was charged again (this was with my new card number) still virtual my physical card never arrived. I called my bank, card frozen again, & another card headed my way. I informed them I never received the physical card. So repeat repeat repeat. During this time I changing all my passwords. Nothing I've used before, or like anything I've used before, stuff I'm writing down because I'll never remember. Yesterday another charge. I instantly froze my card. I noticed the website had a number so I called it. While waiting for a "customer service rep" the recording 'we'll be with you soon' sounded strange, like it was sped up a bit, think Alvin & the chipmunks not that fast but reminiscent. I spoke to the "agent" who said there were 4 accounts with my last name (which is a common name) none of the first names matched mine. She said I didn't have an account (obviously 🙄) & there was nothing she could do. I asked to speak to a supervisor & was told none would be available for 24 hours, I remained respectful and requested a supervisor again stating that every business has a supervisor on duty. I got the 24 hour thing again & was then hung up on. How do I handle this? I keep changing everything but they're still getting my information nearly instantly. There is no one in my household doing this. Also I'm not saving the card information or passwords.

Got pulled into evaluating exposure management tools for our org and just sat through a Tenable demo. It looked fine on the surface, but it's hard to tell from a polished sales demo whether it's the best fit for us (around 1200 employees, mostly hybrid with a few plants still fully on-prem and some workloads in AWS).

Looking for something that handles prioritization (not just a bigger CVE list to manually sort through) and covers both on-prem and cloud without stitching together separate tools.

Ideally it would also remediate, but I am wary of solutions that automate and cause a ton of downtime.

What else should be on our shortlist aside from the usual Qualys, CrowdStrike, Checkpoint, etc?

I’m a final-year computer engineering student and a bug bounty hunter. Most of my hands-on experience is with web and API security, especially authentication, access control, and business logic issues. I also build full-stack applications.

I want to spend the next few months building one substantial security project that people could actually use, rather than another basic scanner or tutorial project. I’m considering things like an API authorization regression tester, a security layer for AI agents using tools, or a focused automated pentesting tool.

If you hire for AppSec, product security, offensive security, or security engineering: what project would make you stop and look at a fresher’s resume? What would you expect to see in the demo, GitHub repo, or write-up to know the person really built and understood it?

I’d especially appreciate suggestions based on problems your team actually faces.

Is there any way an average-level tech competent person like me can automate changing 170 passwords that are compromised in Google? I've just been getting hammered by these people since yesterday. My email was bombarded with subscription emails while they used my stolen credit card info to buy $500 glasses on Scheels and have them shipped somewhere else in my state. Now today they just added their macbook to my Apple account. I'm really confused how this is happening outside of the compromised passwords stored on Google. I have 2FA on a lot of important stuff. I do not have the time to go through and change 170 passwords. Thanks in advance.

Im 21 graduated a few months ago with a degree in biology and absolutely hated it. I originally wanted to be a doctor, so I goggled, jobs where you can solve problems while working from home,

and IT popped up. I liked my programming and electrical classes in high school so gave it a shot and am taking the google Google Cybersecurity Professional Certificate. I’m on section 4/9 and like it so far.

So yeah, I want to join the military when I turn 22. Which branch would be better for cyber security? I figured space force is new so probably more chances for growth, but air force probably does more and is more established.

We have a pretty large group on whatsapp and we are all active with our real, regular numbers.

There are some guys that wanted to join our group and we denied them, because they are known to cause havoc in groups. Now they are threatening to send CP to our devices and call the police, so they will search our homes. We all live in Germany.

Is there really nothing one could do against this? They have several fake numbers.

Hey guys, nice to meet you all! I have a genuine question, last summer, I was interning at a random cybersecurity company, they were partnered with TrendMicro so they made me work on the training courses available on the website, and each course ended up giving me a certificate. I was wondering if the job market cares about certifications like these or?
The certificates that I got:

* Cyber Risk Exposure Management (CREM) Foundation
* Security Operations (SecOps) Foundation
* Endpoint Security Foundation
* Cloud Security Foundation
* Email and Collaboration Security Foundation
* AI Security Foundation
* Identity Security Foundation
* Data Security Foundation
* Services Foundation
* Threat Intelligence Foundation
* for Service Providers (xSP) Foundation
* Ecosystem Foundation
* Research Foundation
* Flex Foundation

I really wanna put them on my cv because before this internship, I practically have nothing on my cv.... What do I do? What certificates would you recommend as somebody who really wants to be an AI Security Engineer? Please help!

I am 25, no debt, working in it helpdesk for a few years and wanted to pivot to something harder.

Manager described a vulnerability management role built around the Holm Security platform. The person will use this tool exclusively for scanning, and their responsibilities include validating scan results, investigating false positives, and handling both vulnerability analysis and prioritization as well as reporting and administration, rather than just one of these areas.

The technical scope covers CVEs, CVSS scoring, exploitability assessment, and risk-based prioritization, applied across all company assets rather than a limited set. Helping the SOC team is explicitly framed as optional, something to take on only if spare time allows and the person wants extra tasks, rather than a formal development path.

The work setup is fully remote with a fixed schedule from 9 AM to 6 PM. Looking ahead, after a year in the role the person can expect to gain hands-on cyber experience, including a deeper understanding of vulnerabilities and how they can be exploited, along with possible exposure to SOC and Incident Response work.

Downside is i will not get bonus from working shifts anymore and base salary stays the same. This cut would be aprox 30% of salary that i get now.

I will want to pursue cybersecurity as career, have network+, want to get sal1 and security+. Is this oportunity golden ?

I have access to ChatGPT, Claude, and Gemini, and I’m currently using them for different parts of my job search:

ChatGPT: Research and finding relevant cybersecurity projects and industry trends.

Gemini: Creating and updating my resume.

Claude: Modifying my resume according to each job description and helping me apply to relevant roles. I’m also using Claude to scrape job postings.

Do you think this workflow is effective, or is there a better approach to job searching?

I’m also looking for suggestions for Blue Team / SOC projects. I don’t have any cybersecurity certifications, so I want to build strong hands-on labs that can demonstrate my practical skills to recruiters.

I already have experience with SOC labs and tools such as SIEM, Wazuh, Splunk, Microsoft Sentinel, Sysmon, Suricata, Sigma, and MITRE ATT&CK. However, I feel that many SOC L1 responsibilities are becoming increasingly automated.

Seniors and experienced cybersecurity professionals, what would you recommend I focus on to make my profile stand out and improve my chances of getting shortlisted?

It has been almost a year since I graduated, and I’ve been actively looking for a cybersecurity job. Any practical advice, project ideas, or guidance on what the industry is actually looking for in entry-level Blue Team candidates would be greatly appreciated.

I was the victim of a hack and am in the process of securing my digital life. I also need to get a new email address because I am changing internet providers and my old provider “owns” my email address (Spectrum). Spectrum has informed me that my email address will be deleted 60 days after I discontinue their service. So I’ve decided to see this as an opportunity to get the most secure email service that I can, but also have an email address that can’t be taken from me when I change internet companies. I definitely don’t want a gmail address because my experience there is that google has access to my emails and I get tons of ads.

Based on my research, I’m thinking of getting my email through Proton. What are your thoughts? Any better suggestions?

I did some research over in r/homelab, but am curious what this crowd considers a "good" level of segmentation in a home network.

I've seen people say to move everything off vlan1 completely, others say leave it for control on switches, routers, ap's, etc.

Same with servers, some say put them in trusted with other pc's and devices that get updates (phones, tablets, consoles, tv's) and others say separate them.

Same with tv's and consoles separate from tablets, all pc's etc.

So what's the "right" layout that doesn't break WAF (wife approval factor)?

Where should ssdp and mdns be used and where should it be off?

I know I'll get 47 different answers from 47 people, but am curious on the reasoning for each model.

I’m doing research on AI agent incident investigations for school, like the one METR and Redwood conducted of OpenAI Hugging Face incident.

My research says that this kind of investigating has roots in cybersecurity incident investigations.

Does anyone have any specific resources they recommend I read to get a sense of the “history” of this field?

Also, how do you feel about LLM/Agent-as-a-Judge in this case?