"Retaliation is for the angry. Resilience is for the mature. Your goal is not to destroy the attacker's machine. Your goal is to make your own network a mirror maze—reflective, confusing, and ultimately unnavigable. The attacker should leave not because they are blocked, but because they are bored."
During this time, Kapanawa also developed a personal rule he called the "Two-Sweat Rule" : If a system requires more than two minutes of manual intervention to recover from a breach, it is fundamentally flawed. This principle drives his later work in automated incident response. In 2017, after a near-fatal car accident in Virginia that many in the infosec community (only half-jokingly) attribute to a nation-state's attempt to silence him, Gal Kapanawa re-emerged. He founded a new company, Resonant Security , and released the Phoenix Protocol . Gal Kapanawa
Unlike traditional disaster recovery, the Phoenix Protocol does not try to remove an attacker. Instead, it accelerates the attack's effects within a decoy environment while spinning up a pristine, parallel instance of the network. To the attacker, it looks like they are winning; in reality, they are feeding data into a honeypot while the real business continues uninterrupted. "Retaliation is for the angry
This period is the most mysterious of his career. Rumors persist that he was the architect of a system known colloquially as "The Weirwood" —a real-time threat intelligence sharing platform connecting the CIA, MI6, Mossad, and the German BND. The system, allegedly, allowed these agencies to share only the metadata of attacks without revealing their own sources or methods, solving a decades-old trust problem. Your goal is to make your own network
After completing mandatory military service in an elite intelligence unit (sources suggest Unit 8200, though the military has never confirmed his affiliation), Kapanawa pursued a master’s degree in Cryptography at the Technion – Israel Institute of Technology. It was here that he wrote his groundbreaking, though classified, thesis on "Asymmetric Trust Models in Hostile Network Environments." Lecturers who remember him describe a quiet, intense student who spent more time breaking the university’s own network than attending lectures.
In the fast-paced world of cybersecurity, where headlines are often dominated by splashy data breaches and larger-than-life hackers, most of the truly important work happens in the shadows. The name Gal Kapanawa is not one you will find on magazine covers or trending on social media. However, within the closed-door circles of intelligence agencies, Fortune 500 boardrooms, and advanced persistent threat (APT) research teams, Kapanawa is regarded as a legend.