┌─[ionsec@dfir-lab]─[~]
└──╼ $ cat /etc/identity
╔══════════════════════════════════════════════════════════════════════╗
║ ║
║ NAME · Nir Halfon ║
║ ROLE · Founder & CEO — IONSEC Cyber Security ║
║ FOCUS · Digital Forensics & Incident Response (DFIR) ║
║ BASED · Israel · Operating globally ║
║ CAREER · 20+ years in cybersecurity ║
║ ║
║ PRIOR · Head of DFIR — Israel National Cyber Directorate ║
║ · Senior Security Analyst — Dell EMC ║
║ ║
╚══════════════════════════════════════════════════════════════════════╝
[+] Currently → Leading IR engagements against advanced threat actors
[+] Currently → Building DFIR tooling at github.com/ionsec
[+] Researching → Cloud forensics · wiper malware · supply-chain attacks
[+] Mission → "Conquer the cyber world together."IONSEC is a boutique cybersecurity firm built for organizations facing advanced threat actors — the kind that don't show up in commodity threat feeds.
We've logged 100,000+ hours of DFIR across IT, OT, and IoT environments, and we deliver everything from rapid incident response and forensic investigations to threat hunting, security assessments, and proactive research.
| 🚨 Incident Response | 🔬 Digital Forensics | 🎯 Threat Hunting | 🛠️ Custom DFIR Tooling |
|---|---|---|---|
| Rapid containment & eradication for active intrusions | Deep host, memory & cloud forensics on real cases | Adversary emulation & proactive detection engineering | Open-source tools shipped to the DFIR community |
| 🛡️ Project | What It Does |
|---|---|
| 🚨 Operation HANDALA | Public technical report + YARA detection rules for a sophisticated wiper-malware phishing campaign |
| 📡 DO Audit Log Scraper | Chrome extension extracting DigitalOcean audit logs with forensically precise timestamps |
| 🔥 FlareInspect | Cloudflare security assessment CLI + web dashboard |
| 🧰 Forti-DFIR | DFIR toolkit for FortiGate / Fortinet investigations |
| 📊 MAES Platform | Microsoft 365 / Entra ID forensics & investigation platform |
| 🕵️ EntraScout | External + internal Microsoft 365 / Entra ID red-team recon with attack-chain mapping |
For incident response engagements, threat-hunt collaborations, research partnerships, or just to talk DFIR.
"You can't defend what you don't understand."