Since none of the tech companies "red teams" seem to actually red team their own shit and leave them riddled with trivially exploitable bugs, I wonder if I could get a job being an actual red teamer who hates the product and tries to break it with malice. How do you get that kind of job. Like everyone else I have listened in envy to the pentester episodes of darknet diaries and I want that for me.
Replying to @theorangetheme@en.osm.town
@theorangetheme @jonny @Viss Shit, I can't even get an interview for the same kind of work I'm already doing. I'm not the one to tag to help someone make a career change, unfortunately.
Replying to @theorangetheme@en.osm.town
@theorangetheme @jonny @Viss No worries, just frustrated by the state of things. 🍻
Replying to @theorangetheme@en.osm.town
@theorangetheme @cR0w @jonny i have a bunch of advice but im not sure it matters anymore. this year i got told one potential customer wasnt going to sign because they were going to use ai as their vciso, and then another potential customer asked me to come up with some language defending using a human for security at all in preparation for that guy expecting the ceo to ask
Replying to @Viss@mastodon.social
@Viss
@theorangetheme @cR0w
I can't imagine how exasperating it must be to be like "but look at it, the thing is swiss cheese even with the latest hotness in AI security evaluation, but I as a human can see it right there." and still having people not see value in the profession at all.
Replying to @jonny@neuromatch.social
@jonny @theorangetheme @cR0w i just have to calmly explain:
- 100% of every org that has ever had a massive deletion event or had an ai go off the rails experienced that because they gave the ai too much access
- if you dont have a security expert there to interpret the results, you will have no way of knowing if what the thing just told you is an outright lie or not
- the risks are quite extreme when dealing with security, and accounting for these existing problems llms have
