r/SecOpsDaily: rules, karma requirements and posting culture

Who posts here

Posts are written for people who already work in security operations. They use TTPs, IOCs, CVE numbers and MITRE technique IDs without explaining them, and the usual structure is a technical breakdown followed by what defenders should do. Nothing stops a beginner posting, but a basic question is more likely to be ignored than answered, because most posts get no replies.

• SOC analysts, detection engineers and incident responders skimming the day's threats.
• Sysadmins and identity admins who turn up when an advisory or a broken patch affects them directly.
• Small security teams asking how others handle escalation, finding backlogs or tool sprawl.
• People with a tool or service to mention, mostly in the comments.

Karma and account requirements

What it takes to get a post through in r/SecOpsDaily.

What you can post

What happens to a new post

Where the most recent posts ended up. Sample size: 400.

• Stayed up100%
• Removed by Reddit's filters<1%

Reddit counts a removal by the subreddit's own AutoModerator rules as a moderator removal, so that share is not all human. Held by AutoModerator means the post is waiting in the mod queue.

What happened when we posted here

We have posted here ourselves. This is how our own posts and comments fared.

Stayed up

100%

Removed by Reddit's filters

0%

Removed by moderators

0%

Period

August 2025 to August 2026

The culture

r/SecOpsDaily is closer to a news wire than a discussion forum. It has under 16,000 members and around 33 posts a day, and the large majority of those are summaries of security news, advisories and vendor research, written to a fixed pattern: a short framing paragraph, a technical breakdown with attack vector, TTPs and indicators, then defensive advice. There is also a daily roundup post that links out to the day's sources.

Because the feed is so regular, human posts stand out. The sample has a handful of them: a small team asking whether a category of cloud security tool really cuts the findings queue, someone asking how to test an escalation playbook after a messy incident, a question about tying code scanning results to production risk. These are the posts that read like a colleague talking, and they are the exception.

Comments are sparse. The median post gets none, and when replies do come they are short, around 14 words, and usually a dry remark about a vendor, a correction, or a practical question such as asking for the indicators on a hosted product. Sidebar aside, there are no published rules and no sign of active gatekeeping.

What lands

• News that hits admins on Monday morning: an authentication deprecation with a hard deadline, an update that breaks domain logins or remote desktop. These pulled the most comments in the sample.
• Identity and phishing stories, such as a campaign abusing passkey registration to take over cloud accounts. That was the top post, at about 60 points.
• Consumer-adjacent flaws people can picture, like a smart TV that can listen while in standby.
• Operational questions with your own setup stated: cluster count, team size, how big the backlog is, what renewal is coming.

What gets removed or ignored

• Very little. No moderator removals appear in our sample, and Reddit's own filters caught about 0.3% of posts.
• There are no published rules to break beyond the sidebar's request not to be rude.
• Bare image and link posts advertising a product did stay up in the sample, but they are a tiny share of the feed and drew no visible discussion.

The unwritten rules

• Scores are small. The best posts in the sample sit between 20 and 60 points, and most sit near zero. Getting a post through is easy. Getting it read is the hard part.
• The house format is a structured breakdown: what happened, technical detail, what to check or patch. A post without that shape looks out of place unless it is a real question.
• Accuracy gets checked. One of the few long comments in the sample is a reader pointing out where a summary did not match the source article.
• Comments that name a tool and drop a link exist, about 4% of comments carry one, but they sit alone under posts and nobody replies to them.
• Expect sarcasm about big vendors. It is the default register in the replies.

Self-promotion

There is no self-promotion rule, because there are no written rules at all. In practice product posts and comments with links are not removed, at least not in our sample. They are also not rewarded: the product image and link posts got no traction, and tool mentions in comments go unanswered. If you have something to share, the format that fits is a technical write-up with indicators and defensive steps, where your product is a detail and not the point.

How people write here

Typical post length

191 words

Typical title length

11 words

Titles phrased as a question

2%

Typical comment length

14 words

Comments that include a link

4%

Posts that carry a flair

84%

Top keywords

The words and phrases that show up far more often here than in other communities, from recent posts in r/SecOpsDaily.

• technical breakdown 279 posts
• defense 306 posts
• iocs 185 posts
• ttps 124 posts
• source 251 posts
• attack vector 85 posts
• monitor 175 posts
• initial access 91 posts
• attack 152 posts
• anomalous 90 posts
• vector 136 posts
• threat 126 posts
• vulnerability 123 posts
• hashes 84 posts
• access 201 posts
• affected 133 posts
• attackers 87 posts
• ips 99 posts
• attacker 93 posts
• exploit 97 posts
• exploitation 95 posts
• e.g 130 posts
• malicious 100 posts
• detection 117 posts
• likely 146 posts
• execution 128 posts
• specific 172 posts
• patch 102 posts
• mitre 65 posts
• targeting 104 posts
• exfiltration 62 posts
• critical 103 posts
• impact 112 posts
• phishing 76 posts
• social engineering 47 posts
• chain 104 posts
• security 132 posts
• compromise 71 posts
• cve 67 posts
• compromised 76 posts

Common questions