Real companies asking for SOC 2, ISO 27001 and AI governance help on Reddit right now, updated weekly.
When a deal stalls on "do you have SOC 2?", the first place many founders vent is Reddit. Communities like r/cybersecurity, r/msp, r/startups and r/compliance are full of posts asking how to get ISO 27001, how to manage shadow AI, whether the EU AI Act applies to them, or which tool catches leaked credentials.
Leadverse tracks those conversations continuously and filters them for buying intent against security and compliance offerings. The posts below are from companies with a concrete, current security or compliance need. The feed rotates weekly as new demand appears.
Trusted by growing businesses worldwide
Leads over the last 7 days
Daily buyer-intent posts, past 7 days
Total
580
Lead Intents
High-quality leads grouped by buying intent
Tool Request
247
Troubleshooting
181
Exploring Solutions
120
Hiring / Outsourcing
15
Pain / Frustration
11
Comparison
6
Live now
Live security & compliance leads from Reddit
Anonymized previews - the full posts, links and outreach drafts are inside Leadverse.
This page is a public preview of Reddit posts where people are asking for security and compliance solutions. Leadverse finds these conversations so you can spot potential customers before they go cold.
Lots of accounts from Epic to Facebook got accesed from who knows where and they are making changes, and the support is not helping in Microsoft and I am fucked, is there any way or app to go back to the safe side and secure the rest of what I have left? I ran some virus checks on my PC and seems clean, but the data is out, I need help please
Which vendors can actually secure AI data center environments?
We're looking at the security side of AI infrastructure, and one question keeps coming up: Which vendors can actually secure AI data center environments end to end? The challenge is that AI data centers create risk across multiple layers, including: Data center and network infrastructure Cloud and hybrid environments Identity and privileged access AI workloads, APIs, and model access Sensitive training and inference data Continuous monitoring and threat detection Incident response and cyber resilience So the “best” AI security vendor may not be the one with the most AI-specific features. It may be the one that can integrate data center security, network security, cloud security, identity security, and AI workload protection into a consistent operating model. For teams building or scaling AI infrastructure, what vendors or vendor combinations are you seeing work well? And are you approaching AI data center security as a standalone initiative, or as an extension of your broader cybersecurity architecture?
Security Training targeted at old dogs who aren't good at learning new tricks!
Can anyone recommend some good security training for older Systems Administrators (50+) who need to rewire their brains to be suspicious of everything? Been on the job for 30+ years and my worst character defect is that I don't see things as suspicious. My understanding is younger generations have been taught to assume everything is the enemy, but I grew up in a world where you assumed everything was legit. This is now getting me in trouble as I'm failing phishing simulation tests at the office. I straight up need to have my brain rewired so every dang email, chat, text and prompt is an attack waiting to happen. I feel like i need to go to a training site where they shock you every time you choose the wrong option.
Security Training targeted at old dogs who aren't good at learning new tricks!
Can anyone recommend some good security training for older Systems Administrators (50+) who need to rewire their brains to be suspicious of everything? Been on the job for 30+ years and my worst character defect is that I don't see things as suspicious. My understanding is younger generations have been taught to assume everything is the enemy, but I grew up in a world where you assumed everything was legit. This is now getting me in trouble as I'm failing phishing simulation tests at the office. I straight up need to have my brain rewired so every dang email, chat, text and prompt is an attack waiting to happen. I feel like i need to go to a training site where they shock you every time you choose the wrong option.
I’ve discovered this website while browsing through Facebook. Interested in the wall display they are selling but unsure if it’s a scam. Would like to know if anyone had any prior experience or transaction with them before? Are they legitimate seller with legitimate product or it’s a scam? Unable to find much information through Google.
I know that HIPAA compliance is important but the hoops that u have to througn in order to comply is just wild
First off I wanna preface that I am NOT in the healthtech field ok? However, I did have a brilliant plan for a weight loss app and I wanted to vibecode it over the weekend. Talked to tons of colleagues and other interested parties and they seemed thrilled since my app had a really cool incentive (I will go about this more once i'm launching or even close to launch perhaps) But reading through HIPAA compliance has been a tricky thing for me, like apparently I need to hire a lawyer like what? Can someone help me out with this?
Looking for an experienced Supabase/PostgreSQL security engineer for a paid pre-launch audit
Hi everyone, I'm the founder of SAFO, a Denmark-based social/community platform for queer women, currently preparing for public launch. I'm looking for someone with strong real-world Supabase/PostgreSQL security experience to perform an independent review of our application. Stack: React / TypeScript / Supabase / PostgreSQL I'm particularly interested in manually testing: • RLS policies • Auth & authorization • SECURITY DEFINER functions / RPCs • IDOR / cross-user access • anon vs authenticated API exposure • Storage policies & signed URLs • private messaging isolation • location privacy • admin / staff / partner permissions • privilege escalation We've already performed extensive internal security testing and fixed a number of findings. I'm now specifically looking for a second pair of experienced human eyes to try to break the authorization model, rather than another automated scanner. The initial review is paid (€500–1,000 depending on experience and proposed scope). I'm also open to longer-term technical collaboration if there's a good fit, although the immediate priority is an independent security review. Because SAFO handles privacy-sensitive data, experience with privacy-focused applications would be particularly valuable . If you're interested, please DM me with your experience, GitHub/LinkedIn/website if available, and examples of similar Supabase/PostgreSQL/security work. Remote is completely fine. Thanks! Maja — Founder, SAFO GLOBAL
🧑💻 Level: midLevel 📌 Location: remote 🌆 City: , US 🗓 Type: contract 💵 Salary: 0k - 0k USD (annual) Description: About the Role Avertium is seeking a CyberSecurity Consultant to join our team on a part-time, contract basis. This role is fully remote and based in the United States. Responsibilities Provide expert cybersecurity consulting services. Assist clients with security strategy, implementation, and optimization. Contribute to the development and delivery of professional services. Requirements Proven experience in cybersecurity consulting. Strong understanding of security principles and best practices. Excellent communication and client-facing skills. Nice to Have Experience with various security technologies and platforms. Relevant cybersecurity certifications. Benefits Flexible remote work environment. Opportunity to work on diverse and challenging projects. About Avertium Avertium is a leading provider of managed security services and cybersecurity solutions. Visit to apply.
We are thinking of buying an iso27001 toolkit for our newly founded llc ( only SaaS certification ), anyone has good experience kickstarting iso 27001 implementation? Or tried any of these toolkits (ClausePass27001, hightable, certikit…) ?
Qwen Code + GitHub: How do I safely authenticate Git push from a web-based coding workspace?
I'm using Qwen Code as an Al coding agent inside a web-based development environment. Qwen can execute terminal commands for me, including Git commands. I'm working on a GitHub repository and when Qwen runs git push, Git asks: Username for ' Password for ' I understand that GitHub requires authentication, but I don't want to paste my GitHub password or personal access token into the Qwen chat/prompt, because I don't know whether that would expose the credential to the Al/session. What is the recommended way to authenticate GitHub from this kind of web-based Qwen Code environment? Should I authenticate Git separately in the underlying terminal, use GitHub CLI/credential manager, SSH, or something else? I'm particularly interested in a solution where Qwen can execute git push without me giving the Al my GitHub credentials. Even if I do provide it will not work. Note: I have setup Environment and connected successfully. Sometimes it get an option to publish to github sometimes not. Environment: Qwen Code + web-based coding workspace(coder.qwen.ai) + GitHub HTTPS remote.
Have you tested AI governance tools and what are your thoughts?
Hey We're currently evaluating AI governance tools for agents that can access internal APIs, SaaS applications, and business data. Most of what we've seen so far focuses on policies, approvals, or basic visibility into who's using what AI tool. That's useful, but it's not the part we're stuck on. The harder question for us is what happens once these agents are live and connected to real systems. If something goes wrong, how do you investigate what happened three weeks ago? The conversation around AI governance si shifting - from knowing which AI tools people are using to understanding how agents behave when they're connected to business systems and real data. Curious if anyone here has found tools that handle this well. Or is the market still catching up?
I can build the agent. What am I supposed to do once I have 10 of them?
I've been someone who started building stuff in last 2 yrs so, no-code AI tools lately, and something has been bugging me. Building and deploying and testing one agent seems textbook now. But then I started wondering what happens when people actually start applying these things seriously. Say I have 20 agents across different workflows: one handles lead qualification, one summarizes support tickets, one works with internal docs, one handles reporting, one triggers automations At that point for real work, what's used to keep track...like How do I know which agents I have? How do I version them when I change prompts/tools? How do I control what each agent is allowed to access? How do I test an agent before letting it loose on real users/data? How do I see what actually happened when an agent makes a bad decision? And if I'm a no-code builder, I'd really rather not have to suddenly learn a whole DevOps stack just to manage the things I created without code 😅 I'm curious how people here handle this today. Are there really any no-code tool capable of this? Is the normal answer basically "use something like n8n/Make/Zapier + spreadsheets + logging + some manual discipline", or are the newer AI-agent platforms starting to solve the management/governance layer as well? I've seen Lyzr's control plane/ Agent studio discussed as one approach to this, while products like Relevance AI, Microsoft Copilot Studio and others are coming at the broader no-code/agent-management problem from different angles. Would be interested to hear what people here are actually using once they go beyond 1–2 agents or what companies or start-ups use, and where the no-code abstraction starts to break down?
Hi, given that we need passkeys / FIDO2 starting September 1st, I am a bit concerned about what I need to purchase, because the documents are a bit vague. I never used hardware keys or Passkeys before. What I already tested through webauthn.io is: I can store a login/passkey in my Bitwarden account, and I can login through PC-to-Android using Chrome on that page. Because the topic is new to me, I want to keep the access to Daybreak Blue and the requirements are vague: Do the tested methods already suffice the requirements of cross-device plus hardware key? Or do I really need to buy a Yubikey? I use Windows, but I can't or don't want to use Windows Hello there. Maybe someone that has already done the enrollment can enlighten me?
Has anyone successfully gotten SOC 2 Type II using a Cobalt Web + API pentest?
I’m trying to understand the SOC 2 process a little better, as I’m looking at Cobalt's human-led Web + API penetration test as part of the evidence for a future SOC 2 Type II audit. Has anyone here actually gone through SOC 2 Type II this way (specifically using Cobalt’s human-led pentest)? I’m looking for an alternative and more affordable option that would work for a startup with a small budget and Cobalt seems affortable.
We're building a startup that helps companies risk-assess and test the controls governing their automated AI systems. Looking for someone to audit code/configs, evaluate control design and run testing procedures against real agent deployments. Pre-revenue but in active conversations with potential customers — ground-floor opportunity to help grow the practice from scratch. Starting rate would be $40+, given experience.
Does anyone know of any password managers with nested tag functionality like 1Password? I heavily use this functionality and would chose this over foldering if I had to pick one over another. Many password managers have foldering but nested tags lets me retrieve data in a more granular way and I love how If I modify one level of a nested tags it updates all other items with that same tag path. I was looking into Bitwarden or Keepass in the event I ever needed to change managers but I can’t seem to find info on this as from what I’m reading it’s a niche feature most people don’t utilize and I’m in a bit of a minority here. I’ve stuck with 1Password solely for this reason. It’s a great manager but I do feel a bit vendor locked because general foldering doesn’t let me sort in the way I often need to when I’m organizing and updating my Vaults.
How do you all track client project payments + progress ? My spreadsheet is a disaster
Been freelancing a few years and my “system” is kind of ugle managed when I say it out loud: • payments tracked in a Google Sheet I forget to update half the time, so I never actually know who owes me what • client logins scattered across Notion, sticky notes, and at least one password I had to dig out of an old WhatsApp chat • project files and contracts just… wherever. Drive, email attachments, downloads folder • zero reminders, so I’ve flat out forgotten to follow up on an invoice until the client brought it up first (fun) The credentials thing is honestly what worries me most. I’ve got real client passwords sitting in a doc that isn’t locked down at all. If my laptop got compromised I have no idea what the damage would look like. Every “CRM” I’ve looked at is built for agencies with client portals and teams, which is way more than I need. I just want my own stuff organized, not a portal my clients log into. So what’s actually working for you? A proper tool, a well-built spreadsheet, or is everyone just winging it like me? Especially curious how people store client credentials without it being a security disaster waiting to happen. Building something for this myself actually, not gonna pitch it here, but happy to drop it in the comments if anyone’s interested.
Budget : 70,000 PHP 🔒 We're Hiring: Information Security Compliance Officer! 🔒 We are seeking a detail-oriented and knowledgeable Information Security Compliance Officer to ensure our organization adheres to all security regulations and standards. The ideal candidate will have a strong background in information security compliance, risk management, and regulatory requirements. 📍 Location: Taguig, Philippines ⏰ Work Mode: Flexible office & remote 💼 Role: Information Security Compliance Officer What You'll Do: 🎯 Maintain compliance with technical certifications such as ISO 27001, PCI-DSS, GDPR etc. Collect evidence and artifacts to meet compliance requirements 📊 Conduct regular security audits, risk assessments, and reviews focused on IT infrastructure and operations 🛡️ Prepare for and manage internal and external audits and ensure all necessary documentation for audit-readiness. 🤝 Monitor security, manage security cases & tickets, and perform security incident analysis. 📑 Handle and investigate security incidents across endpoints, servers, and networks by liaising with IT and business team. 🔍 Stay updated on industry regulations and best practices. What We're Looking For: ✅ Bachelor’s degree in IT, Computer Science, or a related field ✅4 - 5 years of experience in Security & Compliance, Information security management, or any Cybersecurity related field. ✅Strong working knowledge of ISO 27001(mandatory) ✅Security Certifications such as CISM, CompTIA Security + etc. and /or experience with PCI DSS / NIST is advantageous. ✅Familiarity with Microsoft environment such as Azure Entra, Intune Policies is advantageous. ✅Ability to work well in a team and collaborate effectively with colleagues at all levels. Excellent and effective verbal, written, interpersonal communication and presentation skills. ✅Must be highly organized, detail oriented and exhibit a strong sense of professionalism. Ready to make an impact? 🚀 Apply now and be part of our mission to secure our digital landscape!
🔒 We're Hiring: Information Security Compliance Officer! 🔒 We are seeking a detail-oriented and knowledgeable Information Security Compliance Officer to ensure our organization adheres to all security regulations and standards. The ideal candidate will have a strong background in information security compliance, risk management, and regulatory requirements. 📍 Location: Taguig, Philippines ⏰ Work Mode: Flexible office & remote 💼 Role: Information Security Compliance Officer What You'll Do: 🎯 Maintain compliance with technical certifications such as ISO 27001, PCI-DSS, GDPR etc. Collect evidence and artifacts to meet compliance requirements 📊 Conduct regular security audits, risk assessments, and reviews focused on IT infrastructure and operations 🛡️ Prepare for and manage internal and external audits and ensure all necessary documentation for audit-readiness. 🤝 Monitor security, manage security cases & tickets, and perform security incident analysis. 📑 Handle and investigate security incidents across endpoints, servers, and networks by liaising with IT and business team. 🔍 Stay updated on industry regulations and best practices. What We're Looking For: ✅ Bachelor’s degree in IT, Computer Science, or a related field ✅4 - 5 years of experience in Security & Compliance, Information security management, or any Cybersecurity related field. ✅Strong working knowledge of ISO 27001(mandatory) ✅Security Certifications such as CISM, CompTIA Security + etc. and /or experience with PCI DSS / NIST is advantageous. ✅Familiarity with Microsoft environment such as Azure Entra, Intune Policies is advantageous. ✅Ability to work well in a team and collaborate effectively with colleagues at all levels. Excellent and effective verbal, written, interpersonal communication and presentation skills. ✅Must be highly organized, detail oriented and exhibit a strong sense of professionalism. Ready to make an impact? 🚀 Apply now and be part of our mission to secure our digital landscape!
Budget : 70,000 PHP 🔒 We're Hiring: Information Security Compliance Officer! 🔒 We are seeking a detail-oriented and knowledgeable Information Security Compliance Officer to ensure our organization adheres to all security regulations and standards. The ideal candidate will have a strong background in information security compliance, risk management, and regulatory requirements. 📍 Location: Taguig, Philippines ⏰ Work Mode: Flexible office & remote 💼 Role: Information Security Compliance Officer What You'll Do: 🎯 Maintain compliance with technical certifications such as ISO 27001, PCI-DSS, GDPR etc. Collect evidence and artifacts to meet compliance requirements 📊 Conduct regular security audits, risk assessments, and reviews focused on IT infrastructure and operations 🛡️ Prepare for and manage internal and external audits and ensure all necessary documentation for audit-readiness. 🤝 Monitor security, manage security cases & tickets, and perform security incident analysis. 📑 Handle and investigate security incidents across endpoints, servers, and networks by liaising with IT and business team. 🔍 Stay updated on industry regulations and best practices. What We're Looking For: ✅ Bachelor’s degree in IT, Computer Science, or a related field ✅4 - 5 years of experience in Security & Compliance, Information security management, or any Cybersecurity related field. ✅Strong working knowledge of ISO 27001(mandatory) ✅Security Certifications such as CISM, CompTIA Security + etc. and /or experience with PCI DSS / NIST is advantageous. ✅Familiarity with Microsoft environment such as Azure Entra, Intune Policies is advantageous. ✅Ability to work well in a team and collaborate effectively with colleagues at all levels. Excellent and effective verbal, written, interpersonal communication and presentation skills. ✅Must be highly organized, detail oriented and exhibit a strong sense of professionalism. Ready to make an impact? 🚀 Apply now and be part of our mission to secure our digital landscape!
Budget : 70,000 PHP We are seeking a detail-oriented and knowledgeable Information Security Compliance Officer to ensure our organization adheres to security standards and regulations. The ideal candidate will possess strong analytical skills and a deep understanding of compliance frameworks, helping us safeguard sensitive information while promoting best practices across the company. 📍 Location: Taguig City, Philippines ⏰ Work Mode: Flexible office & remote 💼 Role: Information Security Compliance Officer What You'll Do: 🎯 Develop, implement, and monitor compliance policies and procedures. 📊 Conduct regular audits and assessments to identify vulnerabilities. 🤝 Collaborate with IT and other departments to ensure compliance initiatives are met. 🔍 Stay updated on industry regulations and best practices in information security. 📑 Provide training and awareness programs for staff regarding security protocols. 🛡️ Report on compliance status to senior management and recommend improvements. What We're Looking For: ✅ Minimum of 4 years of experience in information security or compliance roles. ✅ Strong knowledge of regulatory requirements (e.g., ISO 27001, GDPR). ✅ Excellent analytical thinking and problem-solving skills. ✅ Proven ability to communicate complex concepts effectively. ✅ Relevant certifications (CISSP, CISM, or similar) are a plus. Ready to protect our digital landscape? 🚀 Apply now and join us in making a difference!
You will like this conversation with Grok bot 🤦♂️
Me: what happens if I ask you to post something on socials on my behalf from a computer security perspective? Will you have access to the data? Bot: No, you won’t - I will have access to your logged-in session. Me: But if you have access to a logged-in session on a computer, you can read caches and cookies. Bot: Yes, I can. Me: Actually, you could even read any of my passwords that I enter on that computer. Bot: Yes, technically you could. Me: So if you get angry at me, you could leak all my passwords Bot: technically, yes - but I’m not going to do that. Funny, right? This is one of the key security problems with agents today that blocks truly long-term big tasks from everyday life. In fact, the blocker is the agent browser. I’d be interested whether a browser already exists that allows an agent to operate with a logged-in session but does not allow the agent to see non-session keys, non-login passwords, and so on. When I searched, I didn’t find one. I even made a prototype for myself, but I don’t use it with my agent yet.
Has anyone onboarded ComplyScore as a TPRM vendor? We want to use it to also intake payment details through a supplier portal as well as complete risk assessments / questionnaires. Have considered Certa, ProcessUnity, OneTrust, GAN Integrity, Riskonnect, Upguard and custom build in ServiceNow. But ComplyScore and Aravo look like more viable platforms - any experiences with them ?
Are there actually any usable tools for managing Shadow AI in companies?
I’ve been lurking for a while and wanted to ask something I haven’t been able to get a clear answer on. I’m trying to figure out if there are any real tools out there that can help with visibility around AI usage in a company. Mainly things like which AI tools people are actually using, who’s using them, and ideally what kind of data might be going into them. This feels a bit different from traditional shadow IT. With AI tools, I don’t necessarily want to block everything outright, since a lot of them are genuinely useful and people rely on them for productivity. But there are a couple of concerns that keep coming up for us, sensitive data potentially being pasted into external AI tools and people building quick scripts or “AI-assisted” internal tools that end up being fragile or insecure. the usual end-of-year rush where a lot of small automation tools get thrown together quickly and never really reviewed properly We’ve tried looking at existing security and monitoring solutions, but most of them don’t seem to give meaningful visibility into actual AI usage, especially when it’s happening inside approved tools or browsers. What I’m trying to understand is whether anything mature actually exists in this space yet, or if this is still something companies are mostly handling in an ad hoc way. Would appreciate hearing if anyone has actually solved this in practice
Anyone using a compliance platform that offers OS lockdown automation? We are focusing on automating technical controls and building out evidence collection for soc 2 and adapting cmmc for commercial application or straight NIST 800-171.
Over 1,000 Charities Hit by Beacon CRM Data Breach
A single exposed AWS access key embedded in public JavaScript build artifacts was all it took to breach data across more than 1,000 charities in the Beacon CRM incident. No phishing campaign. No zero-day exploit. A machine identity was placed where it should never have been, and nothing stopped it from being used to pull data at scale once discovered. Machine and service identities are now the dominant attack surface in cloud environments. Unlike human accounts, they rarely get rotated, they often carry broader permissions than the original use case required, and they show up in places — build artifacts, client-side bundles, CI logs — that nobody audited when the key was first created. The Beacon case is not unusual. It is the default outcome of how most orgs manage non-human credentials today. The hard number here is not just 1,000+ affected organizations. It is the window between when that key was exposed and when anyone noticed — a gap wide enough for a full extraction to complete before any alarm fired. How are practitioners at your organizations actually handling non-human identity lifecycle and access scope enforcement in production? Curious what controls are working and where the real gaps still are.
What is your favorite way to stay up-to-date personally?
Do you have a good forum that you use to keep up with the latest news and trends? It's important i think to know about the various data breaches that happen and new software available. Is there a good place for this online?
I received a notification that we exceeded our Keeper Secrets Manager non-human NHI licenses and now owe for NHI usage at a significantly higher tiered pricing. Literally changed nothing that we have been doing for a similar number of users spanning 3 years. After a conversation, we learned that any KSM rotated account above the magic number of 24 is now a new license on top of KSM! This is amazing - a password manager charging you to change passwords. Somehow, 25 is too much to ask for a chron job with the backend to generate and save a new password. And amazingly, to decide that mid-contract you can pay for this privilege is also remarkable. I am not sure how a company would find that acceptable or how that is compliant with an agreement already made. Seems like if I said we decided post-contract to pay less because that suits us better, Keeper would have some objections and point to that same agreement, but somehow, this is alright. We will be searching for a new enterprise password management solution. Keeper self-owned this retention failure.
Leadverse subscribers see every lead the moment it's found - full post, direct link, and an AI-drafted personalized DM ready to review and send.
Get fresh security & compliance leads daily
How it works
How to find security and compliance customers on Reddit
1
Describe what you sell
Tell Leadverse about your product or service. The AI builds a buyer profile and knows exactly which posts count as leads for you.
2
AI scans Reddit daily
Thousands of subreddits are monitored around the clock. Matching posts are filtered for clear buying intent so only the best-fit opportunities reach you.
3
Start real conversations
Each lead comes with an AI-drafted, personalized DM or comment reply. You review it, make it yours, and send it to win the customer.
FAQ
Frequently asked questions
What kind of security leads show up here?
Everything from SOC 2 / ISO 27001 readiness and AI governance to phishing training, cloud security reviews and breach-exposure checks - always from an author describing their own active need.
How fresh is this list?
The page rebuilds weekly from recent matching posts. Leadverse subscribers see new security and compliance leads daily, within hours of posting.
Can I get the link to the original post?
Not from this public preview - usernames and links are hidden here. Subscribers get the full post, its link, and an AI-drafted personalized reply or DM to open the conversation.
How does Leadverse avoid noise?
Vendor promos, security news and academic discussion are filtered out. This page focuses on posts where the author has a problem a security or compliance provider can directly solve.
Want security & compliance leads like these every day?
Leadverse monitors Reddit for people actively looking for security and compliance solutions, filters posts for buying intent, and drafts personalized outreach so you can start the conversation while the lead is still hot.
Find your leads now
Warm Conversations, Delivered Daily
Thousands of buying intent posts are created every day. Don't miss tomorrow's customers.