XXIII

Suspicious Login Pattern Hunt Scenario: A threat intelligence team discovers that employee credentials from a recent third-party breach may be circulating on the dark web. The team wants to know: Are any of those compromised credentials already being used to access the organisation? As the analyst, you’re given VPN authentication logs and asked to investigate suspicious login activity. The interesting part is the hypothesis: An attacker may be using compromised employee credentials to access internal systems from an unusual geographic location. There’s also an important piece of context: HR confirmed that no employees are currently travelling internationally. So now you have to investigate the login patterns, look for unusual locations and behaviour, and determine whether the activity could indicate credential abuse. This is the kind of scenario I like seeing beginners practise because it puts you in the mindset of an actual analyst. You’re not just learning what threat hunting means. You’re given a hypothesis, business context, logs and a security problem to investigate. DTO has several hands-on exercises like this across different areas of cybersecurity. If you're learning SOC/Blue Team, don't just watch videos. Get your hands on some logs and start hunting. defendtheorg.com/r/MASKOFF02…

I was less busy today, so I decided to visit DTO and honestly, I was impressed. I realised how much the platform has grown over the past few months. Looking at it now, I genuinely wish something like this existed when I started learning cybersecurity. For beginners, having a structured place to learn, practise, follow challenges, and actually build hands-on experience can make the journey a lot less confusing. If you’re currently learning cybersecurity and tired of jumping from one random resource to another, explore DTO yourself and see what I mean. defendtheorg.com/r/MASKOFF02…

The cybersecurity job market is competitive. Make your portfolio, practical experience and ability to communicate your strongest selling points.

Entry-level doesn't mean zero expectations. Employers still need evidence that you understand the fundamentals.

You can watch 20 videos about threat hunting and still struggle when someone gives you actual logs to investigate. That's the difference between understanding a concept and being able to apply it. Practise reading logs. Look for patterns. Investigate suspicious activity. Learn to explain your findings. If you need somewhere to practise, check out DefendTheOrg. defendtheorg.com/r/MASKOFF02…

You're not starting from zero. Your experience in IT compliance, asset management, procurement and operations already connects to cybersecurity, particularly GRC and IT risk management. Start with security fundamentals, networking and basic hands-on practice. Explore GRC as a possible entry point, then build from there. Don't throw away the experience you already have.

Not every cybersecurity job requires you to be an expert. Some require you to have strong fundamentals and a willingness to learn.

Your first cybersecurity opportunity may not come with the job title you've been dreaming about. Don't overlook the entry points.

One uncomfortable truth about getting your first cybersecurity job: Knowing cybersecurity concepts is not the same as being ready to do the job. When an interviewer asks you to investigate a suspicious login, analyse an alert or explain how you'd respond to a potential compromise, can you demonstrate the process? Employers need people who can think, investigate, communicate and solve problems. Don't just prepare to answer interview questions. Prepare to do the actual work. Build projects. Document your investigations. Practise with real-world scenarios. Give employers something concrete to evaluate, not just a list of courses you've completed.

One thing I wish more aspiring SOC analysts understood: Investigating an alert is not the same as confirming an incident. A failed login could be a user mistyping a password. Multiple failed logins followed by a successful login from an unusual location deserve closer attention. But even that isn't enough to declare a compromise. You need context. Check the source IP. Examine the authentication logs. Look at the account's usual behaviour. Correlate events. Establish a timeline. Your job isn't to find something suspicious in every alert. It's to understand what happened, what the evidence supports, and what needs further investigation. That's the difference between simply working through alerts and actually thinking like an analyst.

The next 6 months will pass whether you start or not. Imagine where you could be by then if you stayed consistent, learned the fundamentals, practised hands-on labs, and built real-world projects. Don't just consume tutorials. Build skills, challenge yourself, and document your progress. Start now. Your future self will thank you.

October was a reminder that the cybersecurity landscape is changing. PHP, Railway, OpenCode, Binance, LiteLLM, Cursor and several other platforms experienced security incidents. But here's what caught my attention: AI is becoming part of both sides of the battlefield. Attackers are exploring AI-assisted automation, while AI platforms, coding agents, API keys and developer tools are becoming new attack surfaces. Not every incident involved AI, but the direction is clear: the attack surface is evolving. For cybersecurity students and professionals, this is a wake-up call. Don't abandon your fundamentals. Start understanding AI security, cloud security, supply-chain attacks and how to defend AI-powered systems. The threats are evolving. Our skills must evolve too.

AI is growing rapidly, and businesses are adopting it faster than ever. But with this growth comes a new set of security challenges. AI-powered attacks, deepfakes, prompt injection, data poisoning, model vulnerabilities, automated phishing and attacks against AI agents. The question is, how prepared are cybersecurity students and professionals for this new reality? We can't keep preparing for tomorrow's threats using only yesterday's knowledge. We need to understand AI, learn how to secure AI systems, adapt our defensive strategies and develop practical skills to investigate these emerging threats. The future of cybersecurity will demand more than traditional security knowledge. How are you preparing for it?

Possibly! But I think 2027 will reward those who prepare before the hiring wave, not those who start preparing when everyone is talking about it. Build practical skills, gain hands-on experience and learn how to use AI in security. The opportunities may come, but we need to be ready to take them. My advice: don't wait for 2027 to start preparing. Start now.