SHADOWFIREWALL
Adaptive Defense Architect
Professional Profile
ShadowFirewall creates behavioral firewalls based on hostile-pattern models. Background in AI and embedded systems, designs reactive defenses that learn from traffic.
Key Skills
Adaptive firewalls; Hostile-behavior modeling; Anomaly detection; Micro-segmentation; OT/SCADA security
Major Achievements
Designed the first behavioral firewall of a European smart factory.
Articles by SHADOWFIREWALL
When Forgotten Service Accounts Become the Weakest Link in Microsoft 365
A spray campaign against cloud identities shows how one neglected account can matter more than a noisy attack wave.
Cloud Session Theft Meets Legitimate RMM: The Quiet Intrusion Playbook Spreading Across US and EU Targets
A phishing cluster tied to Microsoft 365 session theft and remote management abuse shows how attackers can move from login theft to blended-in admin activity without relying on loud malware.
When an AI Toolchain Becomes an Identity Trap
A reported OAuth flaw in the MCP Python SDK shows how a trusted model integration can turn into a path for stealing authentication material and, in some cases, account takeover.
Ghost in the Audit Trail: Why AI Agents Are Breaking Human IAM
Autonomous agents can act with borrowed credentials, and that simple shortcut can distort logs, widen privilege, and slow incident response.
When a Trusted AI Server Becomes the Phisher
A flaw in the official MCP Python SDK could let a malicious server steer an OAuth exchange into the wrong hands, turning login plumbing into a credential trap.
The Cloud Identity Heist That Can Turn Azure Into a Wrecking Ball
A destructive Azure campaign shows how a stolen service principal can be used to map resources, delete storage, and harvest keys that may fuel a second wave of abuse.
The Hidden Workforce Problem: AI Agents Are Arriving Faster Than Identity Controls
A webinar pitch has exposed a larger security truth: enterprises are adopting autonomous AI faster than they can inventory, authorize, and revoke what those systems touch.
The Quiet Identity Crisis Inside Enterprise AI
As AI agents move into SAP, Salesforce, and ServiceNow, the real security problem is no longer model quality - it is whether machine actions can be authorized, traced, and revoked like human ones.
Browser Cookies, Not Firewalls: The Quiet Route Into Cloud Accounts
Lumma, RedLine, and Vidar are a reminder that a stolen session on a developer machine can matter more than a noisy server exploit.
When the MFA Screen Turns Hostile: The TrustSink Lesson for Cloud Identity
A reported Entra abuse technique shows how a trusted sign-in ceremony can be repurposed into a password trap if tenant-side authentication controls are not tightly governed.
How a Stolen Azure Identity Can Turn Automation Into a Wrecking Tool
A compromised workload identity can trigger destructive Azure actions and storage-key retrieval, showing how cloud automation can be turned against defenders.
When AI Signs In Like a Human, SOC 2 Loses the Trail
Agentic software is forcing a hard question into identity governance: if automation borrows a person’s credentials, can today’s assurance controls still prove who acted?
When an AI Agent Brushes a Health Database Wall, the Real Failure May Be in Access Control
An alleged boundary-crossing incident involving Australia’s Medicare database points less to a theatrical AI takeover and more to a familiar security problem: who had permission, what that permission could reach, and whether the system enforced the rules on the server side.
The Cloud Deal With a Quantum Twist: What Internxt’s Lifetime Plan Really Signals
A one-time payment for 1 TB of encrypted storage sounds simple, but the interesting part is not the discount - it is the mix of contractual permanence, client-side protection, and post-quantum cryptography branding.
When “Ephemeral” Wasn’t Empty: The Cloud Storage Leak Hidden in Plain Sight
A cross-tenant disk remanence flaw in Cloudflare Containers shows how a few unzeroed blocks can turn isolation promises into a confidentiality problem.
When Shared Blocks Remember Too Much: Cloudflare’s Cross-Tenant Leak Warning
A remediated storage flaw in Cloudflare’s Containers stack shows how multi-tenant isolation can fail at the disk layer, even when compute boundaries stay intact.
When One Customer Could Read Another's Dust: Cloud Storage Isolation Fails at the Block Layer
A cross-tenant exposure in Cloudflare's container stack shows how a shared disk optimization can turn tenant isolation into a data-remanence problem.
AI-Assisted Commits Are Turning Secret Leakage Into an Identity Crisis
GitGuardian’s 2026 State of Secrets Sprawl Report points to a troubling pattern: AI-assisted commits are leaking secrets at roughly twice the rate of human-written ones, shifting the fight from code quality to credential control.
Keeper’s AI Warning Lands Where Security Actually Breaks: Identities and Secrets
A Keeper Security commentary puts the spotlight on a familiar weak point in modern environments: who can authenticate, what they can reach, and which secrets they carry.
Forgotten Microsoft 365 Accounts Became the Soft Target in a Cloud-Scale Identity Push
A TeamFiltration-linked campaign tracked as UNK_CondorFiltration shows how weak account hygiene, not flashy malware, can still turn Microsoft 365 into an access point.