SHADOWFIREWALL
Adaptive Defense Architect
Professional Profile
ShadowFirewall creates behavioral firewalls based on hostile-pattern models. Background in AI and embedded systems, designs reactive defenses that learn from traffic.
Key Skills
Adaptive firewalls; Hostile-behavior modeling; Anomaly detection; Micro-segmentation; OT/SCADA security
Major Achievements
Designed the first behavioral firewall of a European smart factory.
Articles by SHADOWFIREWALL
When SSO Turns Rogue: Two Critical miniOrange Flaws Put WordPress Trust at Risk
A pair of severe bugs in a WordPress SAML login plugin show how a single verification failure can turn federated identity into unauthorized access.
When a Real Microsoft Login Becomes the Attack
A phishing-as-a-service kit built around device-code abuse shows how attackers can turn a legitimate sign-in and MFA challenge into a valid cloud session.
When AWS Keys Escape, the Account Boundary Can Start to Disappear
A large set of publicly exposed AWS access keys underscores how cloud risk can hinge on identity, privilege, and how long a credential stays valid after it leaves private control.
VPN or Zero Trust: Why 2026 Remote Access Is Becoming an Architecture Decision
Business VPNs still matter, but the real security question is whether a company needs broad network access or narrower, policy-driven access to specific apps and services.
Cloud Keys That Would Not Die: Why Active AWS Secrets Are a Standing Risk
More than 9,300 publicly exposed AWS access keys are still active and valid, turning old leaks into live authentication material that defenders must revoke, rotate, and monitor.
Microsoft’s Entra ID Patch Exposes a Hard Truth: When Identity Breaks, Everything Feels It
A maximum-severity Entra ID vulnerability patched by Microsoft reinforces how fragile cloud trust becomes when the identity layer is under attack.
Identity Management Faces Its Next Test: When Non-Human Accounts Start Acting Like Operators
Non-human identities are already more numerous than human ones inside many enterprises, and the arrival of AI agents pushes identity control beyond static access lists toward governance of purpose, action, responsibility, and autonomy.
From Build Pipeline to SaaS Exposure: How a GitHub Actions Flaw Could Have Exposed Internal Credentials
A public workflow issue in Snowflake’s snowflake-connector-net repository illustrates how CI/CD script injection can turn routine automation into a secret-harvesting opportunity.
Encrypted Password Vaults Are Quietly Becoming Identity Defenses, Not Just Storage Apps
A discounted Proton Pass Plus offer puts the spotlight on a bigger security shift: password managers now bundle encryption, aliases, 2FA, dark web monitoring, and passkey support into one identity-control layer.
The Seven-Hour Secret Hunt That Exposed How Fast Cloud Defenses Can Collapse
A reconstructed attack path showed how one exposed credential, plus overbroad access and weak segmentation, can turn a single mistake into a wide blast radius across cloud and production systems.
The Quiet Identity Shift Behind Enterprise AI Risk
As AI agents move from chat interfaces into real workflows, security teams are being pushed to govern them like identities, not just software features.
Cloud Portal Misread as a Breach, Data-Extortion Claim Follows
A suspected Power Pages configuration issue is tied to a large data exposure claim, but the available evidence still points to public-table access rather than a confirmed exploit.
When the Directory Becomes the Target: Why AD Hardening Still Decides the Outcome
A new 2026 guide on Active Directory security points back to a familiar truth: if identity is weak, the rest of the environment inherits the risk.
Microsoft Pushes Entra ID Toward Passkeys, and Legacy OTPs Toward the Exit
Microsoft plans to make passkeys the default in Entra ID in 2026, then retire its own SMS and voice MFA delivery in 2027, forcing enterprises to confront the weakest link in their sign-in stack.
When the Inbox Is Not the Entry Point: Google Workspace and the OAuth Blind Spot
Google Workspace attacks may begin with stolen OAuth tokens, giving attackers another path into Gmail, Drive, and connected systems.
The Hidden Power Grid Behind Enterprise Logins
Identity and Access Management is often treated like admin plumbing, but in modern enterprises it is the system that decides who gets in, what they can touch, and how quickly access can be revoked.
Missing MFA Turns a Simple Credential Spray Into Ransomware Risk
A reported gap on remote access helped a credential-spraying attempt move into an Akira-linked intrusion, underscoring how one control failure can change the stakes fast.
Public Portals, Private Data: The New Harvesting Playbook on Salesforce and ServiceNow
A reported campaign called City-Forum is focusing on anonymous access paths in SaaS portals, where weak guest permissions can turn a public page into a quiet collection point.
When Identity Checks Move Into Chat, the Trust Problem Moves With Them
An in-WhatsApp verification experience can cut friction for users, but it also concentrates identity risk inside a channel attackers already love to imitate.
When a Low-Privilege Login Becomes Fleet-Wide Power
A critical Rancher authorization flaw puts the management plane itself in the crosshairs, where one authenticated account can turn into a much larger Kubernetes risk.