Discussions, questions and news about EDR from cybersecurity professionals on Cyberr.
0 members · 68 posts
Jordan Hadley — Senior Security Consultant
Has successfully verified SentinelOne Sales Engineer Expert (SentinelOne), SentinelOne Paladin Certified (SentinelOne) and 1 more certification
· 0 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
29 minutes. That's how little time defenders may have before an attacker starts moving laterally. Think about what your security team can realistically accomplish in 29 minutes. Investigate an alert. Identify the affected endpoint. Determine whether the account is compromised. C…
· 4 reactions · 1 comments
samuel watua Soita — Full Stack Software Engineer
The cloud didn't eliminate the perimeter. It moved the perimeter into identity. This is one of the biggest shifts in modern cybersecurity. Your infrastructure may be protected by: Firewalls. WAFs. EDR. Network segmentation. DDoS protection. But if an attacker obtains a highly pr…
· 1 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
Your EDR says “no malware detected.” Should you be relieved? Not necessarily. CrowdStrike's 2026 Global Threat Report found that 82% of detections in 2025 were malware-free. It also reported an 89% increase in attacks by AI-enabled adversaries. This tells us something important…
· 2 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
You can secure your company perfectly—and still be compromised through someone you trusted. That's the uncomfortable reality of modern supply-chain attacks. Your organization may have: MFA. EDR. Firewalls. SIEM. Strong passwords. Security policies. But what happens when a truste…
· 3 reactions · 0 comments
Alborz Nazari — Cybersecurity Engineer | Technical Writer
Let's assume a hardening chain of thought. Suppose that you got hired to harden a business that appeals to two distinct types of clients: public and private. Public clients' concerns include GDPR and PII protection, while private clients' concerns include legal disclosures, conf…
· 9 reactions · 0 comments
REEMA Nasser ALMUTAIRI — Cybersecurity Engineer
For those working in SOC L2 what are you guys seeing lately in real-world investigations? I’m curious about what’s actually changing in the way you investigate alerts, hunt for threats, and build detection rules. Any new techniques, tools, or approaches that have made a real dif…
· 5 reactions · 4 comments
Schomer — Principal Security Solutions Architect & Founder
Look at the sheer velocity of this week's tactical threat snapshot. BeyondTrust, Ivanti, Cisco, and Palo Alto Networks all had critical edge vulnerabilities weaponized in the wild. Take a close look at the mechanics behind the BeyondTrust exploit (CVE-2026-102764). It’s a 9.3 CV…
· 7 reactions · 1 comments
SHERIF SALAH EL-DIN — Cyber Security Analyst
🔐 Splunk SIEM INTEGRATION Generate → Collect → Forward → Parse → Index → Normalize → Search → Alert ⚠️ Collection fails = Splunk is blind. ⚠️ Forwarding/parsing fails = Detection can fail. 🏗️ SPLUNK CORE 🔹 UF → Endpoint log collection 🔹 HF → Optional parsing/routing 🔹 Index…
· 4 reactions · 0 comments
SHERIF SALAH EL-DIN — Cyber Security Analyst
https://youtu.be/1Z0vLZ7PnSA?si=20iKqu8QPtsYY87F Is SOC really the right starting point for anyone looking to build a career in Cybersecurity? In this episode of Open Discussion, we take a practical look at the SOC and Blue Team career path and discuss what a SOC Analyst actuall…
· 2 reactions · 15 comments
samuel watua Soita — Full Stack Software Engineer
The attacker doesn't have to be smarter than your security team. They just need to be quieter. Most organizations invest heavily in prevention. Firewalls. EDR. MFA. SIEM. WAF. IDS/IPS. And rightly so. But security controls don't eliminate risk. They create signals. The real ques…
· 3 reactions · 1 comments
Schomer — Principal Security Solutions Architect & Founder
1,416 Reasons the Patching Paradigm Just Died. To everyone triaging the massive Ivanti Connect Secure bypass (CVE-2026-104935) on my trending thread: Look at your calendar. It gets worse. On October 13, the industry quietly hit a tragic milestone. Microsoft dropped a historic 1,…
· 4 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
Your firewall can be working perfectly while an attacker is already inside. That sounds contradictory. It isn't. Modern attacks don't always look like attacks. A compromised employee account can authenticate normally. A stolen session token can bypass the login process entirely.…
· 2 reactions · 1 comments
Schomer — Principal Security Solutions Architect & Founder
You cannot out-patch an 11-minute automated exploit window. When a critical edge appliance or internal routine blindly trusts an incoming payload simply because it made it past the front door, the game is already over. The threat actor weaponizes that missing validation gate, du…
· 2 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
THE DOOM LOOP OF DOWNSTREAM DETECTION: WHY REACTIVE SECURITY IS COLLAPSING The industry is currently drowning in an administrative "patch tsunami." Frontier AI is being weaponized by threat actors to generate thousands of polymorphic zero‑click variants every single cycle, and s…
· 4 reactions · 1 comments
samuel watua Soita — Full Stack Software Engineer
The most dangerous alert in a SOC might be the one that looks completely normal. An employee logs in. A legitimate PowerShell command executes. A service account accesses a database. An administrator creates a new API token. Nothing immediately looks malicious. But cybersecurity…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Critical Perimeter Alert: The Reality of Chained Zero-Clicks Today's CISA KEV expansion highlights a massive reality check for enterprise defense. Look at the Ivanti Connect Secure chain (CVE-2026-104935): 1. Auth bypass via an edge script (welcome.cgi) 2. Arbitrary file-write v…
· 3 reactions · 0 comments
While waiting for the CybHER bootcamp to start (Monday!!), I kept working on the Level Effect platform. And I'm happy to say I've passed their CDCA certification that validates the end of the "from 0 to Tier 1 SOC analyst" training path. For the "exam", you have to work through…
· 7 reactions · 2 comments
Schomer — Principal Security Solutions Architect & Founder
Rethinking the Protocol Ingress: Moving from Signature Defense to LayerZero State Determinism Traditional endpoint detection and response (EDR) matrices are built to monitor application-layer anomalies and process actions. However, when an architectural vulnerability occurs with…
· 4 reactions · 0 comments
Princewill Odoemelam — SOC Analyst
🚨 OPEN TO WORK | ENTRY-LEVEL SOC ANALYST I’m currently looking for an Entry-Level SOC Analyst / Junior Cybersecurity Analyst opportunity where I can contribute my skills, gain real-world experience, and grow within a security operations team. 🔐 What I bring: • SOC monitoring a…
· 4 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
A cyberattack doesn't always begin with an alert. Sometimes, it begins with silence. An attacker gets access today. Nothing crashes. No ransomware appears. No obvious malware is detected. The business continues operating normally. Meanwhile, the attacker may be: → Mapping the en…
· 1 reactions · 0 comments
🤖 AI + Cybersecurity: Are Cyber Attacks About to Become Far More Advanced? The more I learn about cybersecurity, the more obvious it becomes that AI is going to fundamentally change the cyber threat landscape. But there are two sides to this. 🔴 AI for attackers AI could potent…
· 4 reactions · 1 comments
Khaled Fawzy — Penetration Testing and Red Teaming Team Leader
Spend a few minutes to discover what we can provide you during conducting Security service such as Penetration testing, Red Teaming, Phishing Campaigns, EDR Assessment/Evasion, etc. Just check it out SECSQUAD https://secsquad.io
· 2 reactions · 0 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
Most security budgets go toward tools: SIEMs, EDR platforms, threat intel feeds, vulnerability scanners. Fewer go toward the thing that actually decides whether those tools produce good outcomes, how the people running them think. A well-tuned detection stack still fails if the…
· 4 reactions · 1 comments
Schomer — Principal Security Solutions Architect & Founder
Look at the emergence of the new x47.c botnet architecture currently evading standard endpoint monitoring. Instead of relying on static, hardcoded C2 instructions that legacy systems easily flag, this malware dynamically queries the xAI Grok API in real time to adaptively mutate…
· 3 reactions · 0 comments