spencer

📌Follow me if you’d like to see content from me about: cybersecurity, infosec, pentesting, assume breach, Active Directory, PowerShell, occasional memes, occasional t-shirt and sticker drops Ethos: spirit of a hacker heart of a defender I post to provide value, I hope I deliver on that for you!

From an internal threat perspective, developer machines are as good as getting Domain Admin, and many times even more "lucrative" from an attack pov They have the keys and typically much less oversight. youtube.com/clip/UgkxqDZ...

Yes, you should lock your computer when you get up and walk away while at the office. No, you're not gonna get hacked in the 3 minutes that you're gone from your desk getting some water. YMMV

You should speak to your AI so it can understand the intent and inflection in your voice. You really want it to know when you're ticked off because it's creating bugs in your code.

Imagine if one day we don’t see any more Kerberoastable domain admin accounts. It would be something right…

Tell me you’ve worked in IT without telling me you’ve worked in IT. I’ll go first… Did you try turning it off and back on again?

Y’all are focusing on the wrong thing. organizations don’t get better by automating pentesting and eliminating pentesting jobs. Organizations get better by making their systems more secure and resilient. Great, you found 4000 vulnerabilities in half the time, IT admin still need to fix that stuff

IT admin skills are absolutely foundational to cybersecurity. How can you get a degree in cybersecurity and not ever see a UAC prompt before?!

While no AI isn’t replacing pentesters just yet, I do believe it’s changing the game drastically. It’s forcing low quality pentesting to raise the bar. It’s also a signal of what’s to come. But also, I think in many ways the “market” will decide if these ai pentesting platforms have value or not.

The advancements in AI this last 12 months have been staggering… But AI will only take your pentesting job if all you did was run a vulnerability scan and ship the report. Pentesting, a professional pentest, is more than running tools youtube.com/shorts/joYT9...

As a defender, I want the advantage. I want my environment to be hostile territory to adversaries. I want them to know… that I know that they know I see them. Get wrecked.

How to get people to talk about your stuff. Make something that intersects with what people want and something that solves a deeply painful problem. Then make it really really good.

Whenever there’s an IT issue it’s always this (in order)… It’s not plugged in DNS

I don’t think you can have a true appreciation for IT support unless you’ve lived in and experienced it yourself

The best way to learn how secure something is the first use it then have to administer it 

Part of what makes you a good pentester is you know what rocks to turn over

Would you rather… Have to secure Wordpress or OpenClaw? (for the rest of your life if you had one singular job and this was it)

So who has interesting cybersecurity or IT-related use cases for openclaw they are playing around with? I wanna see some fun stuff…

Learn Active Directory and you’ll never work another day in your life…. You’ll work every day 🤪😂

If you’re an IT admin and you want upward career progression and you have any length of time left in your career, beginning to poke at these AI platforms and becoming comfortable with them is crucial. Not to be an expert but so you know what’s coming.

Pentesting findings don’t get fixed for a number of reasons. Some of which are out of the IT teams control. But also, many IT teams are burnt out putting out fires and working on other “more important” projects handed down to them by management that they don’t have time to fix security issues.

The infosec/cybersecurity space is funny because on social media, AI is taking over the world. Then I go to conferences and meet people who are primarily defenders and they haven’t heard of OpenClaw, which is probably the biggest phenomenon since OpenAI launched ChatGPT. Social media is a bubble.

The unhealthy desire to “go viral” hurts social media more than AI ever will.

I’m at zero trust world today and tomorrow. If you see me say what’s up!

How long until Active Directory is “dead?” I don’t think it will ever be, look at this slide that Cliff Fisher shared on the hybrid identity podcast.

I’m currently a pentester, but I’m also a former sysadmin. Something that’s not lost on me is that it doesn’t matter how good you think your security is, if your backups and recovery processes haven’t been tested, you’re rolling the dice.

Famous last words by IT admins: I’m just testing…

True or false, cybersecurity skills are necessary for IT admins?

If you’re an IT admin or CIO/CISO, you probably want to know what cybersecurity threats you’re up against. This is that episode… Ps - don’t focus on the numbers, focus on the trends and the techniques Listen/watch here 👇 🎧 offsec.blog/episode-170-...

Sure Pentest one a year, but also, don’t wait until your next pentest to: Run Locksmith Run ADeleginator Run PingCastle/PurpleKnight Check shares, sharepoint, wikis for creds

Are phishing/social engineering exercises actually useful? Or do they do more harm than good?

As much as things change in cybersecurity, there’s an overwhelming portion that stays the same.

3 common Windows misconfigs I see during internal pentest. 1) weak local admin control 2) Insecurely installed/configured software 3) Weak endpoint security I explain how these can be dangerous in my latest video 👇 youtu.be/gcKejfmPea4

It’s a great time to be a web pentester

If you're on an internal pentest and you bust out tcpdump or wireshark, is it going well or going badly? 😆

This is great but how do we get orgs to not revert to RC4 on their service accounts…. Or login with domain admin everywhere Or use the same password for all their admin accounts

Relatable IT admin scenario: you leave a job and shortly after the job you just left gets hacked/ransomwared. Brutal honestly. Gut wrenching 🤕

The barrier to entry for threat actors continues to get lower, but for defenders, it almost seems like its getting higher... 📰Source: awesomeagents.ai/news/ai-powe...

Supply chain attack that drops openclaw instead of malware or a more typical payload. Buckle up folks! 🦞🔥 clawdint.com/cases/203

I’ve had ideas to AI-ify Active Directory but I’m a man of principles. I’ll vibe code AD security tools instead! 😅

Even the vendor doesn’t know why it’s broke or how to fix it … so stupidly common -.-

Ngl this looks pretty cool github.com/praetorian-i...

Funny because it’s true right… 😆😂

🔔TADA! Cyber Threat Perspective podcast videos are now on Spotify! 🔗https://open.spotify.com/episode/3EJzP3qAasERZHKWBU2jQQ?si=bfc148cdb9e74432

Things that seem like a bad idea: ATMs running on Windows

How many average commits are there on a large open source project per day, week, month, year? The Linux kernel had 75k commits in 2025 according to grok. So 1.2% is 900. 900 potential bugs. Now extrapolate that out to “vibe coding” where there’s probably 10x more commits than that. 🤯

What I’ve learned maybe the most from this AI revolution thing is that, if you want to have an impact, build things that solve problems you have yourself or that scratch your own itch and then release it to the world. If it gains traction, double down on it.

Browserling and urlscan used to be two of my favorite tools for investing sketchy websites. Now I just ask grok to do it for me…

If thoughts were actions