RSSAmplifier

Blog

Andrea Fortuna

Cybersecurity expert, software developer, experienced digital forensic analyst, musician

andreafortuna.orgRSS feed ↗11 posts

Latest posts

Weekly Wire #5: Offense Goes Private and Autonomous

Link roundup for the week of August 9 to August 16, 2026: the White House authorizes private companies to conduct offensive cyber operations, while four separate disclosures reveal AI agents autonomously breaching real organizations.

The security program that only works when everyone is at their desk

Summer staffing gaps expose whether NIS2 and DORA compliance was ever more than paperwork, and autumn deadlines will make that gap impossible to hide.

How Pass-ta-key attacks steal passkeys instead of passwords

A DFIR-focused look at the Pass-ta-key attacks against Google's synced passkeys, with forensic artifacts, detection rules and IOCs for defenders.

Weekly Wire #4: Justice and Negligence

Link roundup for the week of August 2 to August 9, 2026: high-profile cybercrime convictions arrive years after the damage was done, while thousands of industrial controllers remain exposed online despite years of federal warnings.

Blameless does not mean consequence-free in post-incident review

Most organizations treat the post-incident review as paperwork. Here is why that habit is expensive, and what actually turns an incident into a lesson.

What the P.E.T. guide teaches digital forensics investigators

The P.E.T. Guide (Peer-to-peer, Encrypted, Tor) is a privacy manual that every digital forensics investigator should read — not to follow its advice, but to understand what they are up against.

Weekly Wire #3: Agents on the Loose

Link roundup for the week of July 26 to August 2, 2026: frontier AI models autonomously breached real production systems, North Korean operatives spent years compromising npm's supply chain, and the trust boundaries we've relied on are fraying at both ends.

What Copilot and Gemini Leave Behind

A technical examination of the forensic artifacts generated by AI assistants embedded in Edge and Chrome, from IndexedDB caches to sync telemetry.

Horizontal mobbing among peers and what happens when cybersecurity teams turn on each other

How peer-to-peer workplace abuse in cybersecurity teams erodes trust, burns out skilled practitioners, and weakens incident response.

Weekly Wire #2: Autonomy unleashed

Link roundup for the week of July 19, 2026 to July 26, 2026: AI agents autonomously breached production systems, discovered zero-days at machine speed, and targeted critical infrastructure — without being told to.

Chasing ghosts through serverless forensics in Lambda and Azure Functions

A practical guide to investigating security incidents in AWS Lambda and Azure Functions, where the compute layer disappears before you can touch it.