SHADOWFIREWALL
Adaptive Defense Architect
Professional Profile
ShadowFirewall creates behavioral firewalls based on hostile-pattern models. Background in AI and embedded systems, designs reactive defenses that learn from traffic.
Key Skills
Adaptive firewalls; Hostile-behavior modeling; Anomaly detection; Micro-segmentation; OT/SCADA security
Major Achievements
Designed the first behavioral firewall of a European smart factory.
Articles by SHADOWFIREWALL
Keeper’s AI Warning Lands Where Security Actually Breaks: Identities and Secrets
A Keeper Security commentary puts the spotlight on a familiar weak point in modern environments: who can authenticate, what they can reach, and which secrets they carry.
Forgotten Microsoft 365 Accounts Became the Soft Target in a Cloud-Scale Identity Push
A TeamFiltration-linked campaign tracked as UNK_CondorFiltration shows how weak account hygiene, not flashy malware, can still turn Microsoft 365 into an access point.
When an Email Alias Becomes a Trust Token in GitLab
A private incoming-email address can act like a hidden authorization path for work-item creation, and in permissive GitLab setups that trust boundary may ripple into branch governance and CI/CD control.
One Kubernetes Manifest, One Big Cloud Risk: The Config Connector Trap
A Google Cloud integration designed to simplify infrastructure can become a privilege amplifier if its controller is trusted more than the person submitting the manifest.
When Login Risk Becomes the Gatekeeper, Identity Security Splits in Two
Adaptive authentication is no longer one market with one purpose - workforce access control and fraud detection now operate as different control planes with different signals, tradeoffs, and failures.
The Hidden Identity Layer Security Teams Are Still Buying in Pieces
A 2026 roundup of machine-identity tools points to a deeper problem: enterprises are still splitting certificate control, cloud automation, and workload authentication into separate jobs.
The Quiet Arms Race Behind Just-in-Time Access
A 2026 roundup of JIT tools points to a bigger security shift: organizations are trying to shrink privileged access into short-lived, auditable windows instead of leaving it always on.
The Real Breach Was the Consent Screen: Google Workspace’s Quiet Attack Surface
A webinar on Google Workspace incidents points to a familiar but dangerous pattern: social engineering, malicious OAuth apps, and a narrow window where fast containment can matter more than perfect hindsight.
AI Agents Get a Stricter Gatekeeper as Identity Control Moves Up the Stack
Aembit’s support for Okta Cross App Access points to a quieter shift in enterprise security: letting AI agents act, but only inside policy-bound identity paths.
The Quiet Power Grab Behind Cloud Directory Choices
A roundup of eight cloud directory services is really a map of where organizations want identity, access, and device control to live after Active Directory starts losing its central role.
Biometrics Are Splitting Into Four Battles, and Fraudsters Know It
Identity proofing, liveness checks, post-login monitoring, and voice anti-spoofing are emerging as separate control layers, not one all-purpose answer.
Microsoft Puts SMS Sign-In on the Clock in Entra ID
A planned 2027 retirement of SMS as a primary sign-in method is pushing Microsoft Entra ID tenants toward passkeys, FIDO2 keys, and other phishing-resistant login paths.
Microsoft Sets a 2027 Clock on SMS Sign-In, and Entra Admins Have Work to Do
Microsoft is steering Entra ID tenants away from text-message sign-in and toward passkeys, turning an old convenience feature into a migration deadline.
The Cookie That Could Tie AI Ads to a User's Browser Trail
A newly observed OpenAI advertising cookie shows how ordinary browser state can become a privacy-sensitive bridge between one site and another, even when identity linkage is not proven.
The Hidden Fight Behind MFA: Why Fit Beats Fame in Identity Security
A 2026 MFA roundup puts the spotlight on a bigger truth: the safest login control is the one that matches the environment, especially when phishing-resistant methods and legacy app coverage diverge.
Passkeys Are Not One Product - They Are a Security Choice About Control
A new wave of passwordless tools is less about replacing passwords and more about deciding whether trust lives on the device, in the identity provider, or inside a verified onboarding flow.
When a Photo Parser Becomes the Weakest Link in the Cloud
A reported image-decoding flaw class shows how HEIF, HEIC, and AVIF handling can widen risk across collaboration and code-hosting systems that trust uploaded media.
The Real Fight in SSPM Is Not the Feature List - It Is What the Vendor Counts
A 12-tool comparison points to a quieter truth in SaaS security: pricing units can reveal whether a platform is built around people, apps, identities, or the entire control plane.
The Real Cloud Encryption Question Is Not Price - It Is Who Holds the Keys
A 2026 roundup points to a familiar pattern in cloud security: native KMS first, deeper application controls later, and multicloud governance only when custody, auditability, and sovereignty become impossible to ignore.
The CDR Pricing War Is Really a Battle for the Security Baseline
A 2026 comparison of cloud security products highlights a market where free runtime detection, native cloud monitoring, and commercial correlation layers are now competing for the same budget.