Gal | Kapanawa

The result, released in 2007, was the —a microkernel-based security module that sat below the operating system, monitoring every single system call, memory allocation, and data flow. What made the Kernel revolutionary was its use of behavioral entropy analysis . Instead of looking for known malware signatures, it learned the "rhythm" of a healthy system. Any deviation—even a brand-new, never-before-seen exploit—triggered an immediate lockdown.

During this time, Kapanawa also developed a personal rule he called the "Two-Sweat Rule" : If a system requires more than two minutes of manual intervention to recover from a breach, it is fundamentally flawed. This principle drives his later work in automated incident response. In 2017, after a near-fatal car accident in Virginia that many in the infosec community (only half-jokingly) attribute to a nation-state's attempt to silence him, Gal Kapanawa re-emerged. He founded a new company, Resonant Security , and released the Phoenix Protocol .

Unlike traditional disaster recovery, the Phoenix Protocol does not try to remove an attacker. Instead, it accelerates the attack's effects within a decoy environment while spinning up a pristine, parallel instance of the network. To the attacker, it looks like they are winning; in reality, they are feeding data into a honeypot while the real business continues uninterrupted. Gal Kapanawa

Critics called it dangerous. Proponents called it visionary. In 2019, a major ransomware gang using a variant of Ryuk penetrated a healthcare network protected by Phoenix Protocol. The gang spent three days encrypting fake patient records while the actual hospital ran normally on the cloned backup. The gang did not get paid. posted a single tweet after the incident: "Sometimes you don't fight the fire. You starve it of oxygen." Philosophy: The Ethics of Active Defense What sets Gal Kapanawa apart from other cybersecurity gurus is his unflinching stance on active defense. He famously refuses to call it "hacking back." In his 2020 keynote at Black Hat (his first and only public keynote), he stated:

The product was initially dismissed as "too paranoid" by mainstream IT departments. But in late 2007, a sophisticated attack targeting three major European banks was silently thwarted by the Kernel hours before it could exfiltrate data. The banks couldn't discuss the attack publicly, but word spread through the security underground. had just predicted the rise of fileless malware years before it became a common threat. The Shadow Years: Government Consulting Between 2010 and 2016, public mentions of Gal Kapanawa vanished. His LinkedIn was deleted. His academic papers were removed from public databases. According to later leaks from the Edward Snowden documents (though his name is redacted in most releases), Kapanawa was recruited by a "Five Eyes" partner to design a cross-domain solution for air-gapped networks. The result, released in 2007, was the —a

"Retaliation is for the angry. Resilience is for the mature. Your goal is not to destroy the attacker's machine. Your goal is to make your own network a mirror maze—reflective, confusing, and ultimately unnavigable. The attacker should leave not because they are blocked, but because they are bored."

After completing mandatory military service in an elite intelligence unit (sources suggest Unit 8200, though the military has never confirmed his affiliation), Kapanawa pursued a master’s degree in Cryptography at the Technion – Israel Institute of Technology. It was here that he wrote his groundbreaking, though classified, thesis on "Asymmetric Trust Models in Hostile Network Environments." Lecturers who remember him describe a quiet, intense student who spent more time breaking the university’s own network than attending lectures. In 2017, after a near-fatal car accident in

This period is the most mysterious of his career. Rumors persist that he was the architect of a system known colloquially as "The Weirwood" —a real-time threat intelligence sharing platform connecting the CIA, MI6, Mossad, and the German BND. The system, allegedly, allowed these agencies to share only the metadata of attacks without revealing their own sources or methods, solving a decades-old trust problem.