Thomas Weaver

🚨 SOC Analyst: Step beyond Triage Endless alerts. Surface triage. No time for real investigations. But you're ready for more. The Advanced Endpoint Investigations Path helps you: 🔍 Investigate, not just respond 🧠 Analyse real attacker behaviour 🧰 Master Windows, Linux, macOS, memory, disk image, mobile and file system Most analysts stop at triage. You won’t. It’s time to shift from responder -> investigator! 👉 Swipe to change the way you work. For good. 🔗 Start Advanced Endpoint Investigations today! https://lnkd.in/df_TKxKW

282

5 Comments

𝐍𝐨𝐭𝐞 𝐭𝐚𝐤𝐢𝐧𝐠 𝐢𝐧 𝐎𝐒𝐈𝐍𝐓 𝐜𝐚𝐧 𝐛𝐞 𝐩𝐚𝐢𝐧, 𝐛𝐮𝐭 𝐰𝐡𝐲 𝐬𝐡𝐨𝐮𝐥𝐝 𝐢𝐭 𝐛𝐞? I’m recording a video showing you how you can use Forensic OSINT to make digital notes to support your OSINT investigation. It's a simple and accessible way to make notes to support your file work. Video coming soon 👀

27

1 Comment

Do your Incident Response team a favour: If you are using the Defender Portal and sending screenshots, please set your timezone within your account to UTC. The following (redacted) image was sent to me yesterday by a client. I had access to the client's DFE portal; however, we were in different time zones. I had to search for the Event text, comparing the seconds of the alerts in my view with the screenshot, because I was not sure in which time zone the screenshot was taken. The whole process was slowed down. Especially for international organisations, please use UTC.

248

21 Comments

The UK Government has released guidance for a voluntary Software Security Code of Practice, with plans for offering a certification based on compliance. There are four themes: Secure design and development, Build environment security, Secure deployment and maintenance, and Communication with customers. The guidance consists of fourteen principles which are reasonable for vendors of all shapes and sizes to satisfy (at least to some degree). I typically dislike these generic guidance documents stating things like "Distribute software securely to customers," but not everyone is fortunate enough to have a team of internal security professionals. If it's any signal for software supply chain security, to see even the most fundamental guidance include software composition analysis and maintenance of third-party components is a huge win!

24

Our Information Security Lead, Ashley Dunn (CISSP, CEH), will be taking the stage later today at an Open Web Application Security Project (OWASP® Foundation) event in Bristol. He’ll be hosting a session on Bug Bounty Programs. Ash’s Q&A session will draw on his experience in the industry and include a breakdown of why companies should consider using bug bounties to help improve their security posture, how to implement them, and the ROI and unexpected wins that can come from implementing them. 📍Dareshack, Bristol 📅 July 15th 🕟 6:40 - 7:30pm For more information on the session, head to the comments below 👇 #OWASP #InformationSecurity #SuperAwesome

14

1 Comment

Production line penetration testing is killing the industry. You know the kind that leaves you wondering how much involvement an actual pen tester even had? But it's not the testers fault. I mean, how much value can you really deliver when you're given 2 days to run a test that really needed 6? ...and you've just had 5 back-to-back projects just like it. If you’re not giving pen testers: - a say in the scoping process, and - time between tests to up-skill and find efficiencies Then you're delivering what I like to call: production line penetration testing. ---------------------- If your last pen test felt like a production line, send me a message. We can talk about what a real tailored security engagement looks like (one that ticks the compliance box and actually strengthens your security.)

19

I looked at my last 72 calls with SOC Analysts across the UK. 50% of them worked in a current SOC role that was remote. 37.5% worked in a hybrid role, and the remaining 12.5% worked fully on-site. If you're a SOC Analyst finding it difficult to find a remote role, you're looking in the wrong places, they exist. (P.S, for the purpose of this remote meant no days in office or no more than 2 days a month, followed by hybrid, with on-site being every day worked in office) Whether fully remote is the best way to run your business is a totally different debate, but for the majority of businesses out there - It seems to be working. Does this match what you thought?

30

2 Comments

If you know you're in need of penetration testing but are unsure of what exactly, Lewis Lockwood ChCSP breaks down the three common types and explains what they are and what they do. They are: 1️⃣ Infrastructure testing 2️⃣ Web app testing 3️⃣ Cloud Security And you can find out more about how we conduct penetration tests here https://lnkd.in/eW7ewhBp

14

Black Arrow Cyber Threat Intelligence Briefing 18 April 2025: -Fraud in Your Inbox: Email Is Still the Weakest Link -Firm Fined After Stolen Client Details Leaked onto Dark Web -Financial Fraud, with a Third-Party Twist, Dominates Cyber Claims -Cyber Risks in M&A: When Companies Merge, So Do Their Cyber Threats   -CISOs Turn to Cyber Risk Quantification to Bridge the Gap Between Security and Business -UK Financial Services Under Pressure from Cyber Security Challenges and Mounting Regulatory Requirements -Organisations Can’t Afford to Be Non-Compliant -C-Suite Divides on Cyber Security Threats Pose Organisational Risks, Study Finds -Cyber Security Threats and Geopolitical Risks Top Business Travel Concerns -Rising Cyber Threats Fuel 12.2% Growth in Global Cyber Security Spending -Understanding Credential Stuffing: A Growing Cyber Security Threat -30% of Charities Experienced Cyber Security Breaches or Attacks Last Year -The UK’s Phone Theft Crisis Is a Wake-Up Call for Digital Security #blackarrowcyber #cyber #threatintelligence #threatreport #opensourceintelligence #riskmanagement #grc https://lnkd.in/e7CE4pqC

3

PCI DSS Level 2 Compliance: Not as Scary as It Sounds At loveholidays, we're on a mission to open the world to everyone through unlimited choice, unmatched ease, and unmissable value. When you're the third largest ATOL holder taking over 5 million UK passengers on holiday, and you're processing millions of card transactions annually, trust matters. So when our acquiring banks told us the increase in volume of transactions we process meant we'd moved to Level 2 merchant status and needed our first external PCI DSS assessment, I wasn't worried. Not because I'm particularly clever, but because I knew the work was conversational, not technical—and we'd already done it. We've been running an Information Security Risk Committee for the last 2 years, we meet teams regularly and have created a culture where everyone can be open about risk, process, and ways of working. When everyone actually talks about security instead of hiding from it, compliance becomes straightforward and crucially, the business is more secure. That's it. No panic. No all-nighters. Just good governance paying off. Why this matters for growth: Security has to scale with the business. External PCI DSS certification proves we can handle the growth ahead—more markets, more customers, more transactions—without compromising on trust. So what? Thousands of companies achieve PCI DSS every year. Well, we did it with one person, alongside their day-to-day business as usual. No external contractors, no expensive gap analysis tools, no teams of consultants running around with clipboards. Just good governance, cross-functional collaboration, and a Risk Committee that actually works. The lesson? Build security into how teams work, not bolted on afterwards. Be nice—we're here to make things safer, not catch anybody out. Get everyone comfortable talking about risk. Automate what you can, securely. When external validation comes knocking, you're ready. -- If you're running security in a small team and wondering how to scale, happy to share what's worked for us. #PCI #InformationSecurity #Compliance #CyberSecurity #loveholidays

36

4 Comments

Offensive Security Helps You Spend Smarter Security budgets are tight. Offensive security helps you spend smarter. Instead of guessing where to invest, penetration testing shows you where attackers would actually succeed. It highlights the gaps that matter most—whether it’s outdated software, weak passwords, or misconfigured systems. The result? 🔹 Targeted investments that reduce real risk 🔹 Fewer wasted hours chasing false alarms 🔹 A stronger case for funding where it counts Offensive security doesn’t just find problems—it helps you fix the right ones, faster. #SmartSecurity #RiskReduction #PenetrationTesting #SecurityROI

4

Many deepfake attacks succeed because people don't know what to look for. CloudGuard have published a practical guide breaking down 10 visual and audio deepfake warning signs, plus a short interactive walkthrough you can share internally. If your team can spot the signs, they can help stop the attack. 👉 Read it here: https://lnkd.in/eKem5xGe

53

5 Comments

🏫 “Precautionary shutdown” is becoming a familiar phrase in cyber incidents. After a cyber attack disrupted IT systems, a secondary school in Warwickshire remains closed while investigations and system restoration continue — with students pushed to external resources for learning. What stands out: this wasn’t about stolen data headlines. It was about loss of operational capability. Many education and public-sector organizations don’t fail because of sophisticated exploits — they fail because basic attacker paths weren’t tested before someone abused them. When was the last time your organization validated how far an attacker could actually get? #CyberAttack #SchoolIT #CyberOperations

6

🎤 Main Stage Speaker The #BSidesBirmingham stage is calling… and Andy Swift is answering 🙌 Andy is the Technical Director of Offensive Cyber Security at Six Degrees, bringing over 16 years of experience across incident response, red teaming, penetration testing and vulnerability research. In “Git Happens: When a Company Accidentally Open-Sourced Its Knowledge Base”, Andy walks through a real-world case where sensitive internal information was unintentionally exposed through Git, and what defenders can learn from it. One for the defenders in the room 👀 #BSidesBirmingham #BSides #Infosec #CyberSecurity

33

2 Comments

🔐 Security+ vs CEH vs CISSP… which one do UK employers actually care about? Stop guessing. 🚫 ✔ Security+ = Strong foundation 🎯 CEH = Offensive / ethical hacking roles 🏆 CISSP = Senior-level leadership cert They’re not competitors — they’re different stages. Start smart. Build properly. Progress strategically. 🚀 Comment “CERTS” if you want the right order 👇🔥 #CyberSecurity #CompTIA #CEH #CISSP #ITCareers #TechUK #Course2Career