<story><title>Data accidentally exposed by Microsoft AI researchers</title><url>https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers</url></story><parent_chain><item><author>mymac</author><text>Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to &lt;i&gt;really&lt;/i&gt; hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you&amp;#x27;re going through are common.</text></item><item><author>sillysaurusx</author><text>The article tries to play up the AI angle, but this was a pretty standard misconfiguration of a storage token. This kind of thing happens shockingly often, and it’s why frequent pentests are important.</text></item></parent_chain><comment><author>nbk_2000</author><text>If you&amp;#x27;re a large company that&amp;#x27;s actually serious about security, you&amp;#x27;ll have a Red Team that is intimately familiar with your tech stacks, procedures, business model, etc. This team will be far better at emulating motivated attackers (as well as providing bespoke mitigation advice, vetting and testing solutions, etc.).&lt;p&gt;Unfortunately, compliance&amp;#x2F;customer requirements often stipulate having penetration tests performed by &lt;i&gt;third parties&lt;/i&gt;. So for business reasons, these same companies, will also hire low-quality pen-tests from &amp;quot;check-box pen-test&amp;quot; firms.&lt;p&gt;So when you see that $10K &amp;quot;complete pen-test&amp;quot; being advertised as being used by [INSERT BIG SERIOUS NAME HERE], good chance this is why.</text></comment>
<story><title>Data accidentally exposed by Microsoft AI researchers</title><url>https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers</url></story><parent_chain><item><author>mymac</author><text>Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to &lt;i&gt;really&lt;/i&gt; hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you&amp;#x27;re going through are common.</text></item><item><author>sillysaurusx</author><text>The article tries to play up the AI angle, but this was a pretty standard misconfiguration of a storage token. This kind of thing happens shockingly often, and it’s why frequent pentests are important.</text></item></parent_chain><comment><author>_jal</author><text>Let me tell you about the laptop connected to our network with a cellular antenna we found in a locked filing cabinet after getting a much-delayed forced-door alert. This, after some social engineering attempts that displayed unnerving familiarity with employees and a lot of virtual doorknob-rattling.&lt;p&gt;They may be rare, but &amp;quot;real&amp;quot; pentests are still a thing.</text></comment>