I think everyone here recognises that most homes don't need or have a dedicated server hosting a software-defined networking solution, managed VPN for mobile endpoints, protective DNS filtering and NIDS/ NIPS, and I'm sure sometimes we regret ever moving beyond the ISP's router - but today, my homelab might just have protected me from email compromise.
I'll preface this by saying I consider myself security aware and security conscious, though nobody's perfect and this was quite a compromise. I received an e-mail from a trusted contractor I'd been working with on a home project, I was somewhat expecting this email, the subject and body was exactly what I'd seen before, as was the attachment - so no alarm bells rang. I opened the attachment, fortunately sandboxed in a viewer, which directed my to click out to what looked like a contracts management website - again, identical to the contractor's normal practices.
The link opened, redirected, redirected and opened a blank page with nothing but a spinning loading icon - weird I thought, so, yes, I tried again. This time, I caught the redirect URLs as they loaded and then alarm bells rang, these were definitely not the contractor's portal URLs.
I immediately closed the browser, cleared history and cache, checked for any downloads and confirmed automatic app opening was still disabled - thanks Brave. I also ran an anti-malware scan of my device, which was clean, and verified no connected services or authorisations had been made to any of my accounts, which were all good.
I opened up Omada SDN and PiHole and found the link redirected a few times from an initially benign web page to ultimately a malicious domain; I've no idea what content the final domain served as I didn't attempt to open it and haven't had chance to sit down with URLScan yet, but I'm pretty sure it would have been either phishing, OAuth hijacking or a malicious payload download.
Thankfully, both Omada and PiHole caught the redirects to the malicious domain which triggered both reputational and high level TLD blocking rules and stopped anything loading right there, this was only possible since I also have my devices connected via always-on VPN when out of my home.
I rang the contractor who were just mobilizing to deal with this, and a few hours later I had the e-mail notification from them of compromise.
All in all, through my home lab and cybersecurity defence in depth at home, I think I just managed to avoid a nightmare through:
Personal security awareness (didn't work - trusted contact, expected email, well formed and disguised).
Email provider link scanning (didn't work as the original link was benign but redirected eventually to a malicious site, and the link was buried in an attachment)
Sandboxed attachment viewing (may have prevented some unknown macro or otherwise from working, but otherwise didn't stop me clicking the link to their portal).
Omada SDN/ PiHole prevented the final malicious site from opening and loading properly.
Brave browser prevented any automatic downloads, app redirects or opening in apps.