I grew up under surveillance: How that shaped my threat modelling, crisis leadership, and geopolitical cyber strategy

Most cyber security professionals learn to think like an adversary through study, simulation, and certification. This speaker learned it as a child.

Growing up in Iran — rated by Freedom House as one of the world's most repressive online environments — meant navigating state-controlled telecommunications infrastructure, pervasive content surveillance, targeted identity monitoring, and internet shutdowns deployed as instruments of social control. These were not theoretical threats studied in a classroom. They were the conditions of daily life. Before threat modelling was a profession, it was a survival skill.

This session is not a geopolitical lecture. It is a practitioner's account of what nearly two decades of frontline security leadership looks like when it is built on adversarial intuition forged in a system designed to monitor, control, and suppress — and what that foundation reveals about the blind spots embedded in Western cyber security culture.

The session examines three dimensions that lived experience under a surveillance state uniquely illuminates.

1. Threat modelling beyond the framework. Conventional threat models are built on documented adversary behaviour — what has already happened. State-level adversaries operate on strategic patience measured in years, not incident cycles. Iran's National Information Network — a parallel domestic internet infrastructure designed to sever citizens from the global web during political unrest — was not built in a crisis. It was pre-positioned. That distinction, between reactive defence and pre-positioned strategic capability, changes how a security leader reads threat intelligence, evaluates risk, and makes investment decisions.
2. Crisis leadership under genuine uncertainty. Simulated crisis exercises assume a functioning information environment. Real authoritarian crisis does not — communications are severed, trusted sources are compromised, and decisions must be made with zero external reference points. The leadership frameworks built from that experience are categorically different from those built in stable environments, and they are exactly what Australian organisations need as geopolitical pressure on critical infrastructure intensifies.
3. Geopolitical cyber strategy for the Indo-Pacific. Australia operates in a threat environment shaped by nation-states — including Iran, China, and North Korea — whose cyber doctrine treats digital infrastructure not as a technical system but as a domain of political power. Understanding that doctrine from the inside, rather than from an intelligence briefing, produces a fundamentally different quality of strategic judgment. This session maps what that means for how Australian organisations should be building their threat posture, their resilience architecture, and their leadership capability right now.

The cyber security professional who grew up under a surveillance state sees threats that the professional who grew up in a liberal democracy structurally cannot. That is not a biographical detail. At a time when Australia's critical infrastructure sits at the intersection of the world's most consequential geopolitical contest, it is a strategic asset.