Andrea Fortuna

Every August, without exception, someone’s SOC dashboard turns red at 3 a.m. while the two people who actually know how to respond are on a beach or a ferry, phone on airplane mode, out of office autoreply cheerfully promising a response “as soon as possible.” Attackers know this. They have known it for years, and they plan around it with the same discipline that legitimate b...

GitHub rejected it. eBay accepted it, at least until someone told them not to. Same cryptographically valid, silently forged authentication assertion, two completely different outcomes, because one relying party actually checked a single bit in the response and the other didn’t. That bit is the whole story of why passkeys, the technology everyone was told would finally kill c...

This week brought two long-delayed reckonings for major cybercrime figures: Connor Moucka pleaded guilty for the Snowflake extortion spree, and Maksim Silnikau was sentenced to 16 years for running Ransom Cartel. Both cases took years to reach resolution, and both arrived during a week when Forescout researchers found over 4,000 industrial controllers still sitting naked on t...

layout: post title: “Blameless does not mean consequence-free in post-incident review” thumbnail: “/assets/2026/post-incident-review-blameless.jpg” description: “Most organizations treat the post-incident review as paperwork. Here is why that habit is expensive, and what actually turns an incident into a lesson.” excerpt: “The post-incident review is the cheapest security in...

There is an old principle in counterintelligence that I find equally applicable to digital forensics: to understand how someone covers their tracks, you first need to understand exactly how they think about covering tracks. It is easy to spend years developing extraction techniques, learning artifact locations, and mastering mobile acquisition workflows. It is less common to ...