Tom D

Getting a payment approved can still leave an important question unanswered: did the request actually come from your teammate? In this workshop clip, we talk through an impersonation attempt where the approval process carried the attacker’s request forward. Confirming the amount, recipient and purpose directly with the requester through a known contact channel would have helped catch it. That’s why we like working through real scenarios in our OpSec workshops. They give teams a chance to discuss how they’d handle these situations before an urgent message lands! Bring the conversation back to your own team 🫡 The slides are free to view and share: auditware.io/opsec-training#…

Founders and security leads, you’ve got better things to do than chase training certificates through Slack 🙂‍↕️ That’s why we’ve connected Sentry, our platform for Web3 security training, to Vanta! Your team can work through phishing, wallet drainers and malicious approvals while their completion records stay updated automatically in your SOC 2 workflow. See the connection in action 👇 sentry.auditware.io

We loved talking OpSec with everyone who joined! We were glad to have @areta_io along as our special guest 💜 In this clip, we discuss how fake job interviews can put work accounts and personal wallets at risk, and why separating dev work from wallet activity matters. These workshops are our way of sharing free resources with the community and giving teams time to ask questions about their own setup. We hope you find something useful to bring back to your team! The slides are free for anyone to browse and share: auditware.io/opsec-training#… 🤓

We’re proud to announce that @SafeLabs_ whose technology powers 60M+ crypto wallet accounts, is using Sentry for Web3 security training 💜 Our modules cover phishing, wallet drainers, and malicious approvals. Teams can test their understanding with quizzes, earn completion certificates, and keep timestamped training records for SOC 2 evidence. Bring the same training to your team: sentry.auditware.io 🔐

Auditware's Bug Bounty Program is LIVE. We break other people's systems for a living, so for our first bug bounty program we're not hiding behind privilege. Every hunter gets root in the labs over at k8.auditware.io by design, but we want to see if you can break out entirely to our outer infra. The ~$1,000 pot (in ETH) sits behind the one wall we're most sure holds: escape your lab session's microVM. The program is officially published in this post - which means that if you're seeing this, you're not contesting against the full bug bounty world, but only against our followers and X reach. This doesn't mean it will be easy though, as four layers of defense-in-depth are between you and the money: 1. Own the k3s API inside the runner (part of the labs) 2. Break from Container → guest kernel 3. Break from Guest kernel → ? 4. Reach the outer AX41 host Rules are simple - read the full brief below. Safe harbor if you play in good faith. Submit via DM to our founders @joe_vanloon and @forefy (telegram forefy_t) --- Ensure to register as an active bug bounty hunter by replying something to this post -- Who's taking this box apart ⁉️ k8.auditware.io

Announcing the Web3 OpSec Standard (W3OS) - the first open OpSec framework that enables you to measure your organization's security posture, and take concrete actions to improve it. Including contributions from @ethcforg and others 👇