Trying to start your tech journey or pivot to tech? Awesome . A few tips then. 1. Choose a niche :I can’t over emphasize on this because it might just be what determines wether you stay the course and succeed or get overwhelmed and give up.The tech space is vast.

Day 25/31 of Cloud + AI Security. What If Your AI App Is Secure but One Dependency Isn’t? You can secure your own application extremely well and still inherit risk from something you did not build. AI applications depend on models, libraries, APIs, plugins, datasets, open-source packages and third-party services. Every one of those becomes part of your trust chain. Where did the model come from? Who maintains the package? Are dependencies being scanned? Are versions controlled? What data is going to third-party APIs? Would you know if one of those components changed or was compromised? Securing your own code is only part of the job. You also need to understand everything your AI application depends on. #aisupplychain #aisecurity #supplychainsecurity #cybersecurityawarenessmonth

This is so apt ..

Day 24/31 of Cloud + AI Security. Sometimes you do not need to attack the AI directly. You attack the information it trusts. If an attacker can manipulate training data, a RAG knowledge base, documents or another trusted data source, they may be able to influence what the AI produces. That is why data integrity matters so much in AI Security. Who can modify the data? Where did it come from? Can we detect changes? Are trusted and untrusted sources separated? Can high-impact outputs be validated? If you can corrupt what the AI trusts, you can influence what the AI produces. #datapoisoning #aisecurity #cybersecurityawarenessmonth

PHP runs close to 70% of the websites on the internet. And this week, we found out there were two critical holes in PHP itself that could potentially let an attacker get into the server without a login or password. Just the right request. That’s PHP2Shell CVE-2026-109618 and CVE-2026-109619 both rated 9.2 critical. These bugs were originally discovered back in August with the help of AI models and were being kept under coordinated disclosure while a fix was being prepared. But Amazon says it saw an exploitation attempt on October 17. That’s FOUR DAYS before the vulnerabilities were publicly disclosed. And once the details became public, exploitation attempts started showing up very quickly. That’s why the message from defenders right now is simple: PATCH. If you’re running PHP, update to: 8.5.12 8.4.27 8.3.36 8.2.35 And if you’re on PHP 8.1 or older, the PHP project is no longer releasing official updates for those branches. Some vendors may backport fixes, but honestly, that should also be your sign that it’s time to move to a supported version. If you or your organization haven’t taken care of this PHP vulnerability yet… you need to PATCH UP. #Cybersecurity #PHP #InfoSec #Vulnerability #PHP2Shell #CloudSecurity #WebSecurity #AI #TechTok #Subtletechie

🤣🤣🤣🤣 i can’t help but agree with this .

With the events of the last couple weeks in Cybersec, I hope it’s getting clearer that AI isn’t coming for ALL your jobs. If anything, AI is creating more RISKS. And more risks means we need more hands on deck to fight the bad guys. #CybersecurityAwarenessMonth

Day 23/31 of Cloud + AI Security. A company can think it knows where AI is being used while employees are quietly using tools nobody approved. That is Shadow AI. Maybe someone is using a free AI assistant to summarize internal documents. Someone else is using an AI coding tool. Another person connects an AI service to company files. Now security has less visibility, company data may be moving into unknown systems, third-party integrations are increasing, and nobody may know what those tools can access or retain. The answer is not simply “ban AI.” The better approach is approved tools, clear policies, visibility, data controls and education. You cannot secure AI usage you do not even know exists. #ShadowAI #AISecurity #DataSecurity #CybersecurityAwarenessMonth

What an interesting couple of days it has between in cyber sec ,😤😤😤 and to think it’s CYBERSECURITY AWARENESS month .😩😩😩 #CyberSecurity #PHP2Shell #cybersecurityawareness

NIST. ISO. OWASP. MITRE. If you are getting into AI Security, it can feel like you are supposed to learn all of them at once. You are not. The easier way is to understand what each one helps you do. NIST AI RMF helps structure AI risk management. ISO/IEC 42001 helps organizations build and manage an AI management system. OWASP GenAI Security gets much closer to the technical risks practitioners need to understand. Do not ask which one is “best.” Ask what problem you are trying to solve. Frameworks become useful when you know where they fit. Day 22/31 of Cloud + AI Security. #AISecurity #iso42001 #owasp #cybersecurityawarenessmonth

AI Security can get overwhelming very quickly if you start by trying to memorize every risk list you see. I would start with the patterns instead. Manipulation. Can someone influence how the AI behaves? Data. Can the system expose information it should not? Access. What can the AI actually reach or do? Trust. Can someone manipulate the information the AI relies on? Dependencies. What models, APIs, libraries or services are you trusting? Once you understand those five patterns, frameworks like OWASP start making a lot more sense. Understand the security problem first. Learn the terminology later . Day 21/31 of Cloud + AI Security. #AISecurity #OWASP #GenAI #CybersecurityAwarenessMonth

All gems on this one. Point number one is something I preach to my mentees a lot. Stay a beginner for as long as you can. There is no rush wanting to sell yourself as an expert and all.. Focus on becoming so good and knowledgeable that folks point to you as the go to person even when you are not there .

Every company is racing to ship AI right now: chatbots, agents, copilots wired into internal data. Somebody has to make sure that thing can’t be tricked into leaking customer records or handing over the keys. That’s the AI Security Engineer. You’re securing the models, the data they learn from, and the pipelines that push them into production. Prompt injection, data leaks, model theft. You try to break it before someone else does. Pay sits around $153K on average in the US, with the top end past $200K. Getting in isn’t easy. Most people come from security or cloud first and pick up the ML side after. But the demand is real: cyber job ads asking for AI skills doubled in a year. Do you see yourself in this role someday? Tell me below. Day 21 drops tomorrow. #AISecurity #CloudSecurity #CyberSecurityCareers #TechCareers #LLMSecurity #SubtleTechie

Connecting AI to private company data can make it far more useful - but it also gives us more to secure. With RAG, the AI can retrieve information from internal documents, policies, customer data or knowledge bases and use that information to answer questions. Now the security questions start immediately. Can one user retrieve another user’s information? Who decides what the AI can access? Could sensitive data leak through the response? Can malicious instructions be hidden inside retrieved content? What happens if the knowledge base is poisoned? And are we logging what the system actually retrieves? Every new source of information you connect to AI increases its usefulness - and increases the importance of access control, data protection and monitoring. Day 19/31 of Cloud + AI Security. #aisecurity #datasecurity #cybersecurityawarenessmonth

Yes - and that is what makes prompt injection such an interesting security problem. Direct prompt injection is when somebody gives the AI malicious instructions directly. Indirect prompt injection is when those instructions are hidden inside content the AI later reads - a webpage, email, document or file. And the risk gets much bigger when the AI can access private data or use tools that let it take actions. There is no single magic prompt that solves this. Limit permissions. Restrict tool access. Validate inputs and outputs. Use human approval for sensitive actions. Design around the possibility that malicious instructions will eventually reach the model. The real question is not only "Can the AI be manipulated?" It is "What can it do if it is?" Day 18/31 of Cloud + AI Security. #PromptInjection #AISecurity #GenAI #CybersecurityAwarenessMonth

In this Cyber sec field of ours you need people skills as much as you need technicals skills . #CyberSecurity #CybersecurityAwarenessMonth

POST CAPTION You hear this a lot when people talk about AI Security: “Just put guardrails around it.” Guardrails are useful, but they are not the whole security strategy. They can help control what an AI system is allowed to accept, generate or do - things like filtering risky inputs, blocking sensitive outputs, restricting certain behaviors, or adding approval steps around higher-risk actions. But guardrails do not replace IAM, least privilege, secure APIs, data protection, network controls, logging or human oversight. Think of a highway guardrail. It can stop a car from leaving the road, but you would never remove the brakes, seatbelt and traffic rules just because the guardrail exists. A strong AI security strategy uses guardrails as one layer inside a bigger defense-in-depth approach. So the question should not only be: “Does this AI have guardrails?” It should be: “What happens if the guardrail fails?” Day 17/31 of Cloud + AI Security. #AISecurity #AIGuardrails #DefenseInDepth #GenAI #CybersecurityAwarenessMonth