Blog – PwnDefend

Why U.S. and Israeli Airstrikes on Iran Won’t Shift…

The U.S. bombing of Iranian nuclear facilities on June 22, 2025, alongside Israel’s ongoing military campaign, marks a significant escalation in the Middle East conflict. While these airstrikes target Iran’s nuclear capabilities, they are unlikely to alter the broader cyber threat landscape, which remains dominated by cybercriminals exploiting systemic weaknesses in global digital security. This blog explores why these high-profile military actions, though geopolitically significant, won’t address the entrenched issues fueling cyber threats.

Guides

Bolting on security does not work

In my travels I have found it matters more how you do IT securely than how you ‘do security’. What I mean by this is, the prevailing themes of orgs recently is to bolt on SOCs/MDR and other services to a low maturity/low capability IT organisations with the hope that its magic’s all the security problems away. This sounds lovely, the salespeople will almost certainly productise your security improvement journey and make it sound like a dream.

Education

Why a SOC Without Triage, Analysis, and Remediation Is…

In the world of cybersecurity, the term Security Operations Center (SOC) carries significant weight. It evokes images of highly skilled analysts working around the clock to detect, respond to, and mitigate cyber threats. However, not all SOCs live up to this expectation. If a SOC lacks core functions like triage, analysis, assessment, and remedial action, it’s not truly a SOC—it’s merely a contact center masquerading as one. Let’s explore why these functions are non-negotiable for a SOC and why their absence undermines the entire purpose of cybersecurity operations.

Education

Business Email Compromise Check List

As part of my Cyber SOC GitHub repo I’ve put together lots of resources to try and help people with some common cyber security tasks, applicable to CISOs through to SOC analysts.

I also want to highlight one of the most common incident types if you are an Office 365 customer is a business email compromise scenario, so I’ve put together a high level view of the steps you might want to take after a BEC event is discovered:

Defence

Business Email Compromise: Impact Assessment

If you are are a victim of unauthorised mailbox access and/or attempted fraud via mailbox compromise (BEC) then you know that one of the tasks outside of understanding how the compromise has occurred, what configurations have been tampered with, removing devices and resetting usernames/passwords (and tokens/MFA) etc. is to start to understand the data breach impact.

If someone has logged into a mailbox it’s very very unlikely that zero data has been accessed!

News

Japan goes on the Cyber Offensive

Ok with my AI companion GROK I’ve gone exploring on the differences between Japan’s new cyber laws and the UK! This is more GROK than me, but I thought people might find this interesting!

Guides

Wifi, Iphones and Persec/Opsec

I’m back with my AI enabled self! This evening I’m jumping into some interesting things about WIFI probes! Now back in the day you could deploy a pineapple etc. can you would hear phones calling out all the time for SSIDs to connect to, you could fingerprint phones (and infer people) from them!

But that’s not really the case anymore! If we camp with a pineapple or other setup, it’s not really the same anymore! (unless someone has a hidden SSID… they are terrible for PERSEC/OPSEC!!)

Want to know why? Well it’s down to how phones are programmed to poll (probe) for SSIDs… I’ve tested this in a car park miles away with a range of kit! (not dodgy at all right!)

To help me answer this I turned to my currently favourite LLM: GROK

Education

Supporting the Cyber Leadership Challenge

Earlier this year I had the honour of supporting the Cyber Leadership Challenge as a judge at the BT Tower! I’ve been a judge at Cyber 912 previously but I’ve always been doing that virtually, so it was great to be able to goto the event not via a webcam! The Cyber Leadership challenge is a national cyber emergency competition for UK university students. The students work in teams through an evolving national major cyber incident, so they will likely be thinking through areas many don’t give two seconds thought to, such as:

Leadership

Cybercrime and data theft

During an incident it’s one of the first questions people ask, what did the attacker do? Did they steal any data? How did they do it?

All of which are typically rather difficult to answer in the first, probably week of an incident (incidents vary, sometimes it’s very obvious, other times you can’t be 100% sure on some details!)

But recently I’ve been talking lots about the way organisations communicate during incidents to their customers and the public etc. I’ve been explaining that the day 0 comms of ‘no data was stolen’ followed by a ‘lots of data was stolen’ in say day zero plus five… well it doesn’t help with my my trust in the victim organisation. Which to me, seems like an odd strategy for organisations to take. They have options:

Vibe Coding Tools & Educational Cyber Games

Over the last month I’ve been using GROK heavily to see if it can be used to create products and services to help people with cyber security challenges. Now you might wonder how far you can get with notepad (ok I used vscode because I’m on a Mac right now!) and GROK. Basically I’ve not written a single line of code! Not one! Do you want to see what mrr3b00t + AI has created?