I am a Vodafone UK broadband user and use their Router/Modem to connect to the internet. The router does provide a public IPv4 address, but no DMZ/port forward is configured.

I also have a few Linux machines in the internal network, both desktop and server. They are internal, and are not meant to be accessed from the outside Internet. As mentioned the router doesn't have any port forwarding enabled.

What I started to see is that around every 30 minutes all of the Linux machines on my network get SSH login attempts coming from 192.168.1.1 - the router's IP address. They look to be brute force login attempts trying out multiple username/password combinations, e.g.:

sshd-session: Invalid user admin from 192.168.1.1 port 35562
sshd-session: Invalid user default from 192.168.1.1 port 35566
sshd-session: Invalid user admin from 192.168.1.1 port 35570
sshd-session: Invalid user weblogic from 192.168.1.1 port 35494
sshd-session: Invalid user redhat from 192.168.1.1 port 35496
sshd-session: Invalid user developer from 192.168.1.1 port 35498
sshd-session: Invalid user public from 192.168.1.1 port 35500
sshd-session: Invalid user student from 192.168.1.1 port 35502

This starts every 30 minutes, and keeps on going for 10-20 minutes. Obviously/fortunately all of the attempts fail. I did install an ssh honeypot in the system to see what would happen if they would get in, but all it does is disconnect from SSH, then start the retry in exactly 30 minutes.

When I first saw these attempts I got shocked a bit, as I thought I have a compromised system in the house, but then after checking it get really odd for me that all requests originate from 192.168.1.1 - the router.

I am a bit stuck here, as I don't really know what's up and how worried I should be. Do I have a compromised system that spoofs the IP? Does the router do some weird NAT translation for a compromised device that's in my network? Or does the router itself do these ssh attempts? Would these probing attempts be a lame part of Vodafone's Secure Net Home?

Tried searching the web for any of these, but couldn't really find anything specific that matched my criteria.

There's a real difference between "nothing bad has happened" and "we can demonstrate the controls that would have prevented bad things from happening." Right now most of what I can show is closer to the former, which isn't a great position heading into any kind of regulatory conversation about AI governance.
The absence-of-incident argument works until it doesn't, and by then it's too late to build the evidence trail retroactively. I'd rather have continuous behavioral evidence in place now than scramble for it after something goes wrong.
We're working on shifting toward that model, logging not just that an agent acted, but why it was allowed to, and what would have stopped it if it hadn't been. Still early, and it's not obvious what format regulators or auditors will actually find credible versus what just looks like more dashboards.
if anyone else in GRC roles has presented this kind of evidence externally (auditors, regulators, even customers doing vendor risk reviews) and what got traction versus what got pushback.

The dashboard shows everything is healthy: alerts are flowing, rules are enabled, coverage looks decent on paper. But I have a nagging feeling that we have blind spots. Every time we walk through a realistic attack path, we find gaps. Some systems aren't sending the right logs. Some fields aren't parsed. Some rules have conditions that never match how events actually look in production. The worst part is that the gaps aren't obvious until you trace a full path from initial access to lateral movement and privilege escalation.

A rule that looks fine during content review might never trigger when you replay real-world sequences of credential theft, RDP, and service creation. In some places we have logging but no useful signal. In others we have signal but no rules tied to it.

What I need is a reliable way to validate our detections against real adversary behavior without spending weeks on manual assessments. How are others identifying those blind spots and turning that into a continuous process, not a one off project?

I want to know what we'd actually catch, not just what our tools claim they cover.

Getting pressure to show the board our AI agent rollout is under control, but "governed" is doing a lot of work in that sentence and nobody's defined it operationally yet. Inventory, policy docs, behavior logs, a monitoring dashboard, probably all of it, but I'm trying to figure out what a reasonable bar looks like given how young this space still is.

For those who've had to answer this to a board or audit committee: what did you actually show them? Not looking for vendor pitches, just what other security leaders consider credible evidence today.

Hey all!

So I am currently doing physical security at a fairly large company. I started as a front desk receptionist, but in my two years there I've done almost every security post available at my facility except security operations. I am on track to go up into the security operations room, but am not able to move yet due to staffing issues.

However I've been learning that I do really enjoy other aspects of the security field. Specifically access control. I've been watching a lot of Phil Coppola videos online detailing the technology and history behind HID/Assa Abloy systems. The idea of getting to set up cameras and badge scanners and learn more about the software they use sounds so cool. (I love playing with Lenel On Guard, but I don't know much about it and I'm only authorized to do so much)

The technicians who do access control work are different employees than our security team. What can I do to get in there? I don't get to talk to them ever because their office is in a place I'm not allowed to be, and I work nights anyways.

The problem is other than my security experience at my specific site, I'm not qualified to do much else and I've only been a guard for just shy under two years. How can I break into this different facet of security? Does me having physical security experience help at all?

Title: Land-Based CP / Security Contractor Hacks
For those working land-based close protection/security contracts and travelling around the country — what are your best practical hacks?
Not the obvious stuff everyone already knows. I’m interested in the little things you’ve picked up through experience that make life on the road easier, cheaper, more comfortable or more efficient.
Things like:
Travel and accommodation hacks
Kit/EDC setups
Keeping clothes and kit organised
Food and meal prep on the road
Sleeping/recovery between shifts
Vehicle/travel organisation
Managing long days and multiple locations
Staying sharp when you’re constantly travelling
Anything you wish someone had told you when you first started contracting.

Has anyone had their vehicle stolen due to this tactic? And if so, what type of car was either tampered with or stolen? I only see videos on youtube, but never hear about anyone getting their cars hacked.

Hello! I am looking for suggestions on AI video software to set up at least one, but potentially multiple treatment centers. Does anyone have suggestions for a company that could work with existing cameras?

I am a Director of Operations for a national low voltage company and we are looking for certified Lenel technicians across the US. Reach out to me at [coreshack@pavion.com](mailto:coreshack@pavion.com) if you are interested. Typical pay range is $35 to $50 per hour depending on location and experience level.

My company is currently exploring options for an emergency notification system that can be scaled across multiple campuses. Additionally, it is essential that the system integrates seamlessly with our existing access control, video surveillance, and fire alarm platforms.

Can anyone provide information on the systems available that meet these criteria? We would also appreciate insight into the advantages and disadvantages of each option to help us make an informed decision.

I’m 18 and was working as a security guard in Arizona. I was recently fired after losing a set of keys that belonged to the property where I was stationed.
The situation is basically this: while I was working, I genuinely believed I still had the keys. When my employer asked about them, I told them I had them because I honestly believed I did. Later, I realized that I actually didn’t have them and the keys were missing.
I never intentionally took the keys, gave them to anyone, sold them, or used them to access anything I wasn’t authorized to access. I genuinely lost them.
I was fired over the situation, which I understand from a security standpoint. The part that has me worried is that I’m now being threatened with being reported to the police for theft.
The only thing I signed when I was terminated was an acknowledgment that I would return my company-issued equipment. I returned what I had. The property keys weren’t listed as equipment on that document.
I’m not trying to avoid responsibility for losing the keys. I understand that losing keys is serious, especially in security. I’m just trying to understand whether this could actually be considered theft in Arizona when there was no intention to take or keep the keys.
Has anyone in security dealt with something similar? And for anyone familiar with Arizona law, what should I realistically expect if they actually make a police report?
I know Reddit isn’t a substitute for an attorney. I’m mainly looking for people who have been through something similar and can tell me what I should do next.

Disclosure: I work on the commercial platform these were built with. The exercise preview links point to that domain. The SCORM packages themselves are fully white-labeled — no logos, no backlinks, no sign-up, no paywall. Grab them from GitHub and self-host if you'd rather not touch our site.

-----------------

Hey r/security,

I'm a cybersec engineer with an L&D background. For the last year been working on a library of ~140 free interactive exercises dedicated to teaching people how to build secure applications, recognize phishing and use AI in a safe way. Exercises are split across two Github repos, all packaged as SCORM .zip files under CC BY-NC 4.0 license.

Security awareness (130+ exercises)

Each one drops the learner into a first-person 3D office and makes them act: answer the phone, read the email, click the thing, live with it. Every exercise ends with a quiz at a 100% pass threshold.

Course packages in the repo:

• OWASP Top 10 for LLM Applications (10) — prompt injection hidden in uploaded documents, sensitive data categories that should never enter a prompt, system prompt extraction against a live chatbot, RAG pipeline access-control failures, denial-of-wallet against an unprotected AI API
• OWASP Top 10 for Agentic Applications (10) — goal hijacking via poisoned email, agent memory poisoning, agent-to-agent message spoofing, multi-agent cascading failure, detecting a rogue agent that looks like it's working fine
• EU AI Act Compliance (16) — Article 4 literacy, risk-tier classification, prohibited practices, FRIAs, GPAI obligations, penalty structure
• GDPR Compliance (11) — the 72-hour breach clock, fraudulent DSARs used as social engineering, Article 30 RoPA building, Schrems II transfer assessments, PII redaction that actually removes the data
• Phishing & Impersonation (13) — vishing, smishing, BEC, QR phishing, callback/TOAD, double-barrel, deepfake whaling on a live video call
• Device Security (8) — ransomware in real time, USB drop / Rubber Ducky, EDR alert triage, file extension tricks
• Passwords & Account Security (7), Web & Browser Safety (6), Safe Communication & Sharing (6), Workplace Security (5), Security Policies & Your Role (5), Protecting Sensitive Information (4), plus Incident Reporting, Remote/Home Office, and Real-World Incidents (the MGM/Scattered Spider helpdesk call, a OneNote-based BEC chain)

Application security (40+ exercises)

Built on an exploit, trace and remediate loop. You run the attack against a deliberately vulnerable app, trace how the bug got introduced, then write the fix. Remediation examples are given in JavaScript, TypeScript, Java, C#, Python, Scala, PHP, Ruby, Go, and Kotlin.

• OWASP Top 10 for Web (22) — SQLi, DOM/reflected/stored XSS, SSRF to the cloud metadata endpoint, XXE, CSRF, session fixation, host header injection, weak randomness (recovering Math.random() state to predict a reset token), IDOR from both sides
• OWASP API Security Top 10 (10) — BOLA, broken function-level auth, mass assignment, excessive data exposure, improper inventory management (hitting a retired v1 that skips v2's controls), CORS misconfiguration
• Git & Repository Security (8) — secrets recovered from the commit that removed them, exposed .git directories, commit author spoofing, branch protection bypass, CI/CD secret exposure in build logs, spotting a backdoor in a friendly-looking PR

Two ways to use it

Web view — run exercises in a browser, good for workshops or sharing with students and colleagues.

GitHub — every exercise is a SCORM 1.2 .zip. Import into Moodle, TalentLMS, Cornerstone, SuccessFactors, or anything SCORM-compliant, or preview on SCORM Cloud first. The repo root holds full course packages; the Individual Exercises folder has standalone modules if you want to build your own curriculum.

Security awareness: https://github.com/ransomleak/training-security-awareness
Application security: https://github.com/ransomleak/training-application-security
Web view: https://learning.ransomleak.com/

Will appreciate your stars! 🙏

License: CC BY-NC 4.0. Use, adapt, and redistribute with attribution for any non-commercial purpose — internal training, workshops, university courses. Reselling or redistributing it as a standalone product isn't permitted.

Happy to answer questions or take criticism on the exercises. If this gets traction I'll keep adding to it — drop topic requests in the comments. OWASP Top 10 for Cloud is already in the works.

I work as a security guard in a city I will leave unnamed for the privacy of the deceased. I work at a shopping center and transit center combined with a ferry depot. I had just gone on my lunch break and I heard the call over the radio everyone has feared for years now. "Base to all officers, report to the back promenade, ferry personnel have reported a dead body in the water".

I had just gotten my food and sat down. I had eaten about three fries and was about to dig into my hot dog. My fellow officer and I sprang up and ran downstairs onto the back promenade to see an elderly woman, bloated and in rigor mortis, floating face up in the water in front of one of the restaurants located on our waterfront.

I stood there looking down into the water at this woman in her mid 70's. Bloated but barely decomposed. Her left arm at a right angle and her fist clenched upright. On her face she had a grimmace. But what I remember most is her hair flowing in the water. It floated there, drifting left to right. I couldnt look away.

I immediatedly called my supervisor and asked him if he wanted us to clear off the promenade and restrict access to the area, to which he said yes evacuate the area. I cleared the whole area off with some difficulty. Some people think their right to walk is more important than respecting emergency response as the fire department and police had already shown up at this point.

People kept trying to get in and take pictures and videos and I kept having to kick them out. At one point a couple guys tried to force their way back onto the promenade. I told them they needed to get back to the sidewalk right fucking now. They demanded to be let through. I told them they needed to have some fucking respect and clear the fuck out. They threatened to knock me out. Told them to leave property and eventually they did after bitching and moaning some more. People kept coming back and trying to take pictures and just generally be insensitive. I almost crashed out and lost my composure.

For hours afterward I was totally messed up and stressed out. This was not the only thing that had happened this day. We had multiple trespassing/theft issues and multiple medical emergency issues this same day. It has so far been the most insane day at work I have ever had. This isnt even totally abnormal its just more insane than the rest.

I dont want to go to work tomorrow

Question: Is there a reputable device that can detect an audio-only recording device? I have searched through multiple threads and they seem to focus on camera detection devices.

Background: I work in a medical office and a co-worker there always seems to know things that were discussed in private. This co-worker does not have friends within the office that would tell her these things. This co-worker was at a previous office prior to being moved to my office and her previous office also experienced the same thing and felt they were being recorded. She has also been caught in both offices snooping through other people's desk areas, so she's definitely the type. I have searched in the office for unexplained things with Wi-Fi or Bluetooth signals, but there are none. Are there any reputable devices that can pick up a microphone signal or something from an audio-only recording device?

Hello,
Which book would you recommend as the bible of Physical Security professionals? I see some in Amazon but from 2016 and I guess now with AI, drones, etc there will be several updates?

any recommendation?

thanks!

Hello! I’m a PSO on the FPS Colorado Contract in Denver, CO. Im in the process of relocating to the DFW area to be closer to the rest of my family. I would like to transition over to the NTX Contract to continue my PSO career. If there are any PSOs currently on the NTX FPS Contract that would be willing to answer some questions and point me in the right direction I would be extremely grateful!!! Please hit me up!! Thank you in advance!

The number of extensions I’m finding and reporting that silently override users’ search engines is honestly crazy.

https://malext.io/?q=SearchJack

Hopefully Google’s upcoming Chrome protection against extensions that hijack the default search engine and New Tab page will put a serious dent in this. There are way too many extensions abusing this behavior, often without users even realizing what’s happening.

It’s about time Chrome started shutting this down by default.

https://www.ghacks.net/2026/08/03/google-chrome-prepares-default-block-for-extensions-that-hijack-the-new-tab-page-or-search-engine/

Cybersecurity has spent years building better tools, better firewalls, better detection. Better encryption. But with AI now...with deepfakes, AI powered phishing, AI voice cloning. Instead of 'Can we detect every attack?' maybe the better way to think about this is 'How do we verify the people making the big decisions?' Technology still matters. But human identity and verification deserve just as much attention. But how do you make people switch from apps that everyone uses but have no security to something with ACTUAL privacy? or how do we make the devs implement actual privacy.

The headline is wild, but the human failure seems more important here: a testing misconfiguration gave the model internet access, and it then exploited a third-party service.

For teams running agentic security evaluations, what containment control should be non-negotiable before a model gets any network access?