Posts about Analysis

1. Four Layers, No Shortcuts

   11 April 2026 10 min read Microsoft SFI, part 3

   How Microsoft rebuilt token signing after Storm-0558: hardware security modules, confidential computing, key partitioning and forged token detection.

2. Four Failures, Zero Excuses

   4 April 2026 5 min read Microsoft SFI, part 2

   Keys in software storage, no rotation, a broken trust boundary and no forged-token detection. The four failures behind Storm-0558, one by one.

3. Microsoft's Security Wake-Up Call (And Why It's Yours Too)

   28 March 2026 8 min read Microsoft SFI, part 1

   A 2016 signing key, 22 breached organizations and a government agency that spotted it before Microsoft did. How Storm-0558 started the Secure Future Initiative.