r/AskNetsec

I do a lot of reading where an AI assistant explains a security concept, and the explanations sound authoritative — but I've learned not to trust that on its face. Sometimes the described thing turns out to be well-documented and real; other times it seems to be invented, just dressed in real-sounding terminology.

The pattern I keep noticing: the individual pieces are all legitimate (real terms, real concepts), but the specific named thing they're combined into returns nothing when I go looking. Authoritative tone, real ingredients, but the overall item may not actually exist.

My question is strictly about verification method, nothing operational: when you want to confirm whether a described vulnerability or technique is real, what's your go-to process? Straight to CVE and MITRE CWE? Vendor advisories? Is "the components check out but the specific named thing has no sources" a dependable sign of fabrication, or does that heuristic fail in practice? I'm trying to put together a reliable checklist for telling real from made-up.

We ran a discovery pass on our outbound traffic a few weeks back expecting to see ChatGPT and maybe Grammarly and it came back with 27 different AI tools. One was a resume site that someone in HR had fed the whole org chart into.

Yes the DNS logs gave me the obvious ones easily enough, but its the rest that slips past me. I only found out last week that one of the devs had a browser extension quietly summarising internal tickets, something my filter would never have caught because it does not resolve a known domain. The same goes for the AI features that got switched on inside a couple of SaaS tools we already pay for. A script someone pointed at an API key only turned up when the monthly bill jumped.

I would like to hear from people who have pushed past a DNS baseline. What is catching the personal account and extension usage in your environment and how did you end up finding your agents?

Had a really annoying afternoon last week. Sentry started lighting up after a deploy and it traced back to a changed value in one of our config files. Easy enough, I just needed to know who changed it and when.

GitHub's audit log showed the push, but it came through a token that a few different things use. No way to tell if it was a person, a pipeline, or some script somebody wrote months ago and forgot about. I ended up lining up commit times against CI runs and deploy timestamps for like an hour, and I'm still not totally sure I got it right.

Honestly kind of irritating. If the logs can't tell me who or what was behind a change, I'm not sure what we're keeping them for.

How are you all handling this? Is there a setup that ties a change back to a specific person or job, or is everyone just matching timestamps and hoping?