This period is the most mysterious of his career. Rumors persist that he was the architect of a system known colloquially as "The Weirwood" —a real-time threat intelligence sharing platform connecting the CIA, MI6, Mossad, and the German BND. The system, allegedly, allowed these agencies to share only the metadata of attacks without revealing their own sources or methods, solving a decades-old trust problem.
He has since become a mentor to a new generation of "purple teamers"—security professionals who blend red-team offensive thinking with blue-team defensive rigor. His private seminars, held twice a year in an undisclosed European location, have a waiting list of over three years. Alumni of the "Kapanawa Circle" now lead security teams at Google, Palantir, and the World Bank. Today, Gal Kapanawa is in his late forties. He suffers from a chronic neurological condition that he refers to only as "the flutter." It has reportedly slowed his typing speed but sharpened his focus. He currently leads a small, 20-person research unit called Axiom Labs , funded by a anonymous grant. Gal Kapanawa
Critics called it dangerous. Proponents called it visionary. In 2019, a major ransomware gang using a variant of Ryuk penetrated a healthcare network protected by Phoenix Protocol. The gang spent three days encrypting fake patient records while the actual hospital ran normally on the cloned backup. The gang did not get paid. posted a single tweet after the incident: "Sometimes you don't fight the fire. You starve it of oxygen." Philosophy: The Ethics of Active Defense What sets Gal Kapanawa apart from other cybersecurity gurus is his unflinching stance on active defense. He famously refuses to call it "hacking back." In his 2020 keynote at Black Hat (his first and only public keynote), he stated: This period is the most mysterious of his career
The result, released in 2007, was the —a microkernel-based security module that sat below the operating system, monitoring every single system call, memory allocation, and data flow. What made the Kernel revolutionary was its use of behavioral entropy analysis . Instead of looking for known malware signatures, it learned the "rhythm" of a healthy system. Any deviation—even a brand-new, never-before-seen exploit—triggered an immediate lockdown. He has since become a mentor to a
After completing mandatory military service in an elite intelligence unit (sources suggest Unit 8200, though the military has never confirmed his affiliation), Kapanawa pursued a master’s degree in Cryptography at the Technion – Israel Institute of Technology. It was here that he wrote his groundbreaking, though classified, thesis on "Asymmetric Trust Models in Hostile Network Environments." Lecturers who remember him describe a quiet, intense student who spent more time breaking the university’s own network than attending lectures.