Login

r/Infosec

Looking for some real-world ISO 27001 experience — would really help a young team
▲ 19 r/Infosec+3 crossposts

Looking for some real-world ISO 27001 experience — would really help a young team

Hey everyone,

hope this is okay to share here. I read through the subreddit rules beforehand, but if I missed something and surveys like this aren’t appropriate, apologies — just let me know and I’ll take it down.

We’re a small, very early-stage founding team with a cybersecurity background, and we’re currently trying to understand how ISO 27001 projects actually work in practice, not just how the process is supposed to work on paper.

We’re particularly interested in things like where teams lose the most time, what creates uncertainty, which parts are still unnecessarily manual, how consultants and software are used today, and where software or AI could genuinely make the process easier.

We put together a short survey around this. It takes about 8–10 minutes and can be completed anonymously.

If you’ve actually worked with ISO 27001 (internally, as a consultant, auditor, ISMS lead, security professional, etc) your experience would genuinely help us a lot at this stage. We’re still early enough that feedback from people who know this space can really influence what direction we take and stop us from building around the wrong assumptions.

We’re also absolutely not looking for people to tell us that our ideas are great. If you think software/AI isn’t particularly useful for certain parts of ISO, or we’re looking at the wrong problems entirely, we’d genuinely like to hear that too.

Here is the survey: https://tally.so/r/b5RAro

Thanks a lot to anyone who takes a few minutes to help us out. And again, mods, if this isn’t appropriate here, apologies — happy to remove it.

u/Emotional_Number_889 — 10 days ago
▲ 6 r/Infosec

Talk me out of this: rerunning vendor reviews every time a SaaS app adds AI is not sustainable

Third-party risk here, biotech, around 300 SaaS apps in the inventory. starting to think re-reviewing a vendor every time they bolt on AI is a hamster wheel. sub processor emails come in weekly now and half of them add some AI provider. a couple vendors had the feature switched on before the notice even hit my inbox. so the app i signed off on two years ago goes right back in the queue and the re-review is a questionnaire. they write "we don't train on your data," i can't check it, it goes in a folder. rinse and repeat. If a re review ever caught something the contract wouldn't have, i'd happily eat my words. am i wrong?

reddit.com
u/amgfcbiozo — 10 days ago
▲ 2 r/Infosec

What's the real identity risk from shadow IT apps nobody told security about?

We found a marketing tool last month that had been storing employee credentials in plaintext for over a year, completely outside any security review. Nobody thought to flag it because it wasn't seen as a "real" application, just some tool a team signed up for on their own.

Curious what other people have found when they've actually gone looking for this stuff, and whether it's usually this bad or if we got unlucky.

reddit.com
u/Sebasnio-Weakness690 — 10 days ago
▲ 3 r/Infosec+1 crossposts

Next-Gen Web Application Firewall (WAF) & Edge Reverse Proxy

Please forgive the self-promotion here, but this project took an immense amount of time and effort to build, and it honestly turned out way too good for us to keep to ourselves.

We wanted to share our work with the community. Our team of security engineers built Aegis , focusing obsessively on raw performance and zero-overhead threat defense.

It handles deep packet inspection with sub-millisecond latency, featuring full OWASP Core Rule Set anomaly scoring (to prevent false positives), Layer 7 rate limiting to stop credential stuffing and bots, automated TLS management, and dynamic zero-downtime policy updates.

The community edition is 100% free and open-source.

We would love for you to check it out on GitHub, and if you have any feedback or recommendations for our team, we would really appreciate your thoughts:

https://github.com/divinelabio/aegis

u/Divinelab-io — 12 days ago