u/bitslammer

I have never liked the idea of these tools because IMO unless your tool does only 1 simple thing, every demo should be custom tailored to each prospect based on what you learned in discovery.

Don't reinvent the wheel. Use an existing framework like the NIST CSF which actually has guidance for small business: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf If that doesn't appeal then look at the CIS controls as well.

To me this is really up to the business unit(s) who use the app. If they need a wild amount of customization then it may be time to look at another tool or have that painful conversation about them paying for more IT resources to support them changes.

Kind of depends on what style you want, but for me the garlic knots at Aldi are pretty hard to top and are dead simple to bake as well.

Such a nuanced and intelligent position. /s

How the hell is White Castle getting the $$$$ price rating? This is why I hate services like Open Table where I'm forced to share contact info. It's actually a huge turnoff to me to have to do that to get reservations because of the incessant SPAM you get.

While that's your perspective, some police have done that and that is going to elicit some really strong feelings. While I don't condone the vigilantism it's not hard to see why people feel this way.

Police misconduct seems to be endemic to the profession. If you really want to the extent check out some credible sources like this lawyer on Youtube: https://www.youtube.com/@thecivilrightslawyer/videos You may be shocked here as well. This is just one lawyer and he has dozens and dozens of videos on extremely egregious behavior on the police trampling people's 1st, 2nd and 4th amendment rights as well as killing them and lying to cover up their misconduct.

The true scope and size of the problem is obviously worse than this on channel can convey. People like to call such cases "lone wolf" or isolated, but when it happens hundreds of times a week that argument falls apart.

We have a very real and very serious problem in our country and as I said while I don't condone the vigilant route it's not hard to see the very deep and widespread disgust people have for law enforcement and the legal system i general.

This is to broad and basic of a question. GRC is a huge umbrella concept and is done in as many ways as there are companies.

You need to figure out exactly what role you're interested in and then realize that "GRC" is really more of a broad concept that's handled differently from org to org.

For example I'm in a larger org (~80K people in ~50 countries) that is very risk focused as we are in the financial/insurance industry. We have no single team or department called "GRC" nor does anyone have GRC in their job title. For us those things are functions handled in departments like our Integrated Risk Management dept, out IT Risk dept, the data privacy teams, the legal teams, internal audit etc.

So even though we likely always have open positions in those teams if you searched our job site for 'GRC' you'd get no hits.

For me I started in more technical more hands on roles. If I didn't have that I would look at some of the foundational type training and certs like Sec+. You may not come out of that knowing how to deploy firewalls or IPS from scratch, but you will gain an understanding of the core concepts.

The amount of commenters calling for the death of cops was a bit shocking.

How many were there and how many of those could have been bots. Even if you saw 100 commenters that's not even .012% of the population of Hamilton county. So while it mat seem so that's not at all "shocking." You're seeing a miniscule number of self selected people that in fact seems completely expected. People do and say weird stuff in the Internet. They have done so before. Just look at the people who were fans or supporters of Charles Manson.

I've said this before on many similar type posts.

You cannot look at Facebook and then extrapolate what you see to conclude it represents the real world. There's all kind of bias in doing that. There's the bias that you're only seeing the view of people who use Facebook, the biased view of people who will comment on topics like this, the skewed view that the Facebook algorithms feed you and so on.

Facebook's #1 goal is engagement. They want your eyeballs and clicks above all else and if you obsess on something they're going to feed you more of that, even, and especially, if that's something that agitates you. Then there are all the bot accounts that come into play as well.

This sounds like the common scenario where an org decides they're going to do their own internal SOC without really having the correct tools and talent.

If you suspect a natural gas leak you call Duke ASAP. They will check and advise if there's an issue and will fix it if they own the issue which is pretty much up to and including the meter.

Maybe some truth there, but it's not going to be an overnight type of thing.

I work in a large global insurance/financial org now. We've had business units doing this for the past year with things like Cursor, Claude etc. We are in fact replacing commercial off the shelf and SaaS based solutions. What we aren't and can't replace are those services that go beyond the basic functional software.

One good example is something like our email security platform which is Proofpoint. We could develop something that does what their stuff does, but we wouldn't have the benefit they have of being able to analyze and detect threats across their entire customer base. Same goes for something like Microsoft Defender. When they catch something bad across just one of their millions of customers they can instantly use that to protect all the rest. There are other tools that not only do some function, but come with a huge amount of historic data and analysis. Those companies who offer these types of solutions are going to be just fine.

A company can be a perfect fit for your solution, recognize the financial upside, and still have no compelling reason to act today.

This is something that many just don't realize or are in denial about. To me the #1 reason someone may not act in such a situation is priorities. I've been on both sides of the table where on paper things looked like a perfect match, but the problem was there were 10 other things on the list to do that were higher priority.

Just think of this in terms of personal life. Almost everyone has a list of things they really want or need to do, but for many reasons can't do them all at once. Sometimes it's a matter of money sometimes it's a matter of time or dependence. For example if you need a new roof because you have a leak, shoddy old windows, worn out carpet and a dying furnace the roof and furnace are likely going to be top priority over the others and it wouldn't make sense to put new carpet under a leaky roof from a logical perspective.

Your prospects face similar scenarios all the time and there's really little you can do about it. You need to wait for the right timing and not blow your shot by wrecking the relationship.

Are electricity and running water under appreciated?

I think IT, the internet etc., fall into the same bucket now. It's just an expected commodity infrastructure thing that people are wholly dependent on but don't think about until the lights go out.

Don't know much about them from the sales side, but from a buyer/customer side I will say they are very different from companies like Broadcomm. TB seems to have much smarter people doing their acquisitions and managing them. I've been a customer of several of their brands that they've kept for 8+yrs and have not seen them degrade.

They don't seem to do the quick flip that others do and in many cases have invested and made their brands significantly better in a way that is felt by the customers. As a potential prospect I wouldn't touch a Broadcomm offering with a 10 foot pole but have no issues in considering TB options.

Just my 2¢, but I know many on the customer side who feel the same.

That's a great analogy. I often use the pilot/aviation mechanic one as well. Different skill sets to do the role, but a ton of crossover.

Yep. Ours just got raised by about $80/paycheck so that's a $2080 paycut in my eyes. On top of that all of the copays and deductibles got raised as well so if we do need it for anything it's going to hit harder.

Hard to say. Usually the culprit is authentication/permissions of the account if it's a credentialed scan and the plugin needs proper auth and permissions. Could also be the install not being registered or in an odd path as some plugins only check a few default paths. Might also be different PHP versions.

If it's an unauthenticated scan on port 80/443 then there should be no issues unless there's a firewall or something causing the issue. I'd be willing to bet there's at least some fundamental difference between the servers it's detecting on vs. missing.

I've been using Tenable for years and every time I had something like this happen there was a obvious reason once discovered and not a fault of the scan.

We're using Tenable since that's our core tool for this kind of thing. The have released multiple plugins for detection.

https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote

This is a very logical and common move. Your background in software engineering can be leveraged in the roles you mention as well as others such as IAM, vulnerability management, pen-testing and pretty much every area that is or surrounds development activity.

The best way to do that is with an internal transfer since that internal knowledge is the bonus for the security side of things.

Given that Mexican is one of my favorite choices of food this is good news. I hit Tacos Time and El Rancho Grande often so why not add another if I'm out that way.

+1 and in many cases the VP level is too high.

I'm now in a larger global org and at least as it applies to IT and cybersecurity you're never going to speak with the CIO/CISO unless you are MS or AWS. The people you want to connect with are 2-3 levels below them. They have all been carpet bombed with outreach to the point they have the phone and inbox locked down.

You reach them via channel partners, VARs, at events, hosting events, going to your local professional chapters etc. It's 2026. If they want to reach you they will, you just need to at least be out there for them to find you.

Spot on. There are 3 of us who are the most active and we all have day jobs so we aren't here 100% of the time. We're very active behind the scene as we review or act on about 1500 posts a week in

Do we get it right 100% of the time? Absolutely not, as none of us have time to spend 10 minutes going back through every single childish flame war to see who started it. We take a quick look, take action, or do nothing, and move on.

I think we've made it pretty clear that any post has to have an active and direct tie to the area specifically. State and national issues are not Cincinnati specific, not matter how strongly they may have impact.

This post is a good example of an allowable post as it is calling out the visit to the area and not just the topic of the ad and that's why it's been allowed despite the heavy reporting by people who want it removed.