It feels especially good to write it now, because my favorite company continues to step outside the usual boundaries. My colleague writes about this brilliantly, and I’m happy to pick up his truly valuable ideas — even though we’re separated by a big beautiful ocean.

What kinds of integrations have I seen throughout my career?

1. Marketing announcements between two different companies’ products

2. Technical integration through SDKs and APIs

3. Internal integration of products inside one large corporation

Want details? I’ve got plenty.

1. Marketing Announcement
The emptiest type. A beautiful croissant with nothing inside. Lots of noise, joint webinars, press releases. Under the hood — usually just shared APIs, syslog, and a couple of tested configurations.
The real goal is to create a cartel to push out a common competitor. The desire for mutual customer penetration usually ends with 2–3 pilot projects and then salespeople spreading the news by word of mouth. Friendship is friendship, but money is separate. Everyone wants a piece of someone else’s pie.

I’ve seen Web Application Firewall + DDoS protection cloud, data masking systems + database monitoring, and many others. Looks great on stage. Works weakly in production.

2. Technical Integration via SDK
More interesting technically. One vendor embeds another’s solution, usually on a Revenue Share model. Fast and convenient, but almost zero flexibility.
Examples: Web Gateway + antivirus, DLP + image recognition system. Such modules are often sold on the principle “you can’t live without them.”

3. Internal “Friendship” Inside One Corporation
The most fascinating and simultaneously saddest story.
The company loudly trumpets “one unified ecosystem” in every presentation, while inside, independent product teams fight for resources and don’t want to let their internal competitors onto their territory. This is especially common when there’s an old and a new product, or after mergers and acquisitions.

The result: dedicated salespeople pushing only their own direction, customer brain explosions (“why is one employee praising one thing and another praising something completely different?”), and the constant need for someone inside the company who can resolve all these internal conflicts.

What else don’t you know about the ugly side of IT integrations, but were afraid to ask?

Want me to continue “shocking” you with real cases? Let me know. Feedback helps me keep the right tone.

Stay naked.

© 2026 Michal Domalewski / Naked CyberSec. All rights reserved.

I remembered a product presentation by my future boss that ended with the classic line: “Come to the dark side — we have cookies.” At that time the world looked binary to me: clear light and darkness, no fifty shades of grey. I was hooked on security systems that could detect both external hackers and internal threats — insiders, corrupt employees, or those who looked loyal but kept a “fig in the pocket.”

That passion led me to two favourite technologies: IPS/NTA for network visibility and DLP for data leakage prevention.

The core ideas were solid even back then. The problem was execution. Everything required massive manual tuning because we didn’t have AI assistants that could simplify these tasks by orders of magnitude. Classification, policy creation, maintenance — it all demanded heavy upfront consulting. Many projects started with enthusiasm and died in the details.

Today the fundamental principles haven’t changed, but the tools have. As smart people say: knowledge of a few principles frees you from knowing many facts.

Modern DSPM platforms (with heavy use of LLMs and contextual graphs) finally make the old dream viable: automatic discovery and classification across the entire estate — cloud, on-prem, mainframe, SaaS — with minimal manual effort, real-time risk scoring, and automated orchestration into existing DLP, SIEM, and IAM tools.

The fairy tale we told ourselves in 2012 has become reality. What used to be blocked by the sheer volume of manual work is now achievable in weeks, not months.

My Top Practical Tips for Hunting Violators

External threats (network / attacker perspective):

1. Clearly separate network-based and agent-based approaches. Mirror traffic at minimal chokepoints — ideally the core switch. Agent-based monitoring eats resources fast (cloud APIs are a separate conversation).

2. Protocol support should be broad, but real value comes from metadata analysis speed and depth. Real-time blocking of sophisticated attacks is still mostly a fairy tale. Focus on understanding collected metadata to trace and remediate.

3. Track events religiously. Anomaly detection alone doesn’t guarantee 100 % coverage, but it will definitely help you spot the elephant in the china shop.

4. Maintain a living network map and asset inventory. This isn’t just for nice management reports — it’s your daily tool for vulnerability hunting and context.

Internal threats (data leakage / insider perspective):

5. To truly understand data flows inside the organisation, start building and maintaining a connectivity graph.

6. Keyword analysis remains the solid foundation for leak hunting; everything else (ML, context, etc.) is a powerful addition.

7. Remember: DLP is not a product — it’s a triangle of people, processes, and technology. I like to illustrate it as “dark matter”: it absorbs everything and should release nothing. The “quasars” you see are exactly the leaks.

8. Monitoring without immediate prohibition is often the most effective long-term measure. Prevention and sanctions work best as exceptions, not the default.

Universal rule that applies to both hunting:

9. Ideas (and insights) are like fish. If you want to catch little fish, you can stay in the shallow water. But if you want to catch the big fish, you’ve got to go deeper. Down deep, the fish are more powerful and more pure. They’re huge and abstract. And they’re very beautiful. — David Lynch

In threat hunting this means: don’t stop at surface-level alerts and obvious IOCs. Dive deeper into context, relationships, business impact, and subtle behavioural patterns. The real “big fish” — sophisticated insiders, advanced persistent threats, or critical dark data exposures — hide in the depths. Modern tools with AI and multidimensional graphs finally let us go there without drowning in manual effort.

The approaches we loved 10–15 years ago are still relevant. The difference now is that AI and modern data intelligence layers remove the biggest historical blocker — endless manual labour.

If this resonated or gave you a useful idea, you can BUY ME A COFFEE.

---

© 2026 Michal Domalewski / Naked CyberSec. All rights reserved.

Sitting on a Starbucks terrace with coffee and a cigarette, I noticed a tall, muscular guy in a vest from the local Black Dogs LE MC (Czech Republic). That instantly took me back to my one-time participation in a Night Wolves event, my last visit to their clubhouse in Moscow’s Mnevniki district, and the best “business manual” series my old friend — a Lead AE at the Russian office of a major American IT vendor — ever recommended: Sons of Anarchy.

It was perfect decompression after a heavy business day. Nothing clears the head like bikes, brotherhood, and controlled chaos.

“Companies don’t do business with companies.
People from one company do business with people from another.”

Despite the surface-level differences — motorcycles, gangs, guns, and drugs in the series versus suits, Excel files, and procurement procedures in real life — the core ideas are strikingly similar:

• Ruthless competition

• Discipline and hierarchy

• Intelligence gathering (OSINT and insiders)

• Building deep trusted relationships

• Confidential negotiations

• Strategy and power struggles for resources and positions

Two Very Different Clubs, Same Code

Black Dogs LE MC (Czech Republic)
Founded in 2002, this is the first Law Enforcement Motorcycle Club in the Czech Republic. Membership is restricted to police officers, soldiers, firefighters, paramedics, and other state servants (99% LE). The club emphasizes discipline, service to the law, and riding together. It is independent and a co-founder of the Czech National LE MC Coalition.

Night Wolves MC (Russia)
Founded in 1989 in Moscow by Alexander “The Surgeon” Zaldastanov. One of the largest and most influential motorcycle clubs in Russia (estimated 5,000–7,000 members across 45+ chapters). Closely tied to the Kremlin, they organize Victory Day runs and large-scale bike shows. The club and its leader are under Western sanctions.

Two clubs on opposite sides of the geopolitical divide, yet living by surprisingly similar principles: loyalty, hierarchy, brotherhood, and a strong code.

The Dark Mirror: Hunter S. Thompson and the Hells Angels

To understand the darker side of this culture, it’s worth remembering the greatest gonzo journalist, Hunter S. Thompson. In 1965 he began with an article for The Nation, then spent over a year fully embedded with the Hells Angels — riding with them, drinking in their bars, and living their life as a participant-observer.

The result was his 1967 classic “Hell’s Angels: A Strange and Terrible Saga” — one of the most honest portraits of 1%er outlaw motorcycle culture ever written. Thompson showed the raw mix of brotherhood, violence, freedom, alcohol, and rebellion against society without cheap sensationalism.

At the end of his time with the club, he was severely beaten by members. The relationship ended badly, yet the book remains a landmark.

10 Rules from Traditional 1%er Motorcycle Clubs

Here are ten core rules commonly found in the charters (bylaws) of traditional outlaw motorcycle clubs like the Hells Angels and similar groups:

1. Loyalty to the club above all else.

2. Always back your brothers.

3. No talking to outsiders. No snitching.

4. Respect the hierarchy and chain of command.

5. Prospecting period is mandatory — full membership and trust are earned over a long trial.

6. Club property (Colors, Vest, Brand, reputation) is sacred and untouchable.

7. Never lie to or steal from your own.

8. Membership is a lifelong commitment. Leaving the “company” does not cancel past obligations or responsibilities.

9. Strict selection — new members (or key partners) accepted only by unanimous vote. One “no” is enough.

10. Discipline for violations is swift and severe.

Now replace the word “motorcycle club” with “corporation” — and you get a surprisingly accurate unofficial bible of corporate business worldwide.

That’s the naked truth. If this was useful, you can BUY ME A COFFEE.

---

© 2026 Michal Domalewski / Naked CyberSec. All rights reserved.

Based on real events. All names changed, companies/brands anonymized (except actor Vladimir Vdovichenkov from “Bumer 2” and black BMW X5).

So, Bumer. Film Two.

Released in 2006 when the first part was already a massive hit. The main theme became ringtones for thousands. We watched Part 1… during a Social Studies class in IT college 😂

Context: watch at least the first 17 minutes with English subs. In the director’s cut (5–7 min) there’s a deleted scene: “Cat” (Vladimir Vdovichenkov) to the prison boss – words I’ll never forget:
“Why did you kill a good guy… he had only several months left to parole…”

The film’s key symbol: material dream of the boys — a black BMW X5.
Premiere: March 7, 2006 (Russia & Kazakhstan). My first university year. One year later I met Vladimir Vdovichenkov… at the traffic police getting plates for new cars. Mine – bronze Hyundai Accent from dad. His – guess two times 😏

Real events hit in 2013. Age 25. Left bank cybersec tech role, became pre-sales manager (cybersecurity focus) at a big IT integrator. Preparing million-dollar tender proposal: TCO, architecture, vendor & client calls.

14:00 – buried in Excel. Hear boss: key outsourced customer hit by massive DDoS. Business down, terminals in richest regions offline, top management in panic.

Google search → volunteer to help. No standard playbook → sent to “hold the dying man’s hand.”

15:00. Racing with tech manager. Explain problem & solutions on the way. Found Frostbyte (our partner) & Shieldex in 5 min. Call A.Zvizdilov – get a storm of swearing: “We won’t protect this client for any money – he accused us of staging the attack.” Calm him down, agree. Fix with AE: if client says yes – protect at list price + standard discount, no haggling.

16:00. 30th floor business center, view almost like Central Park NYC. Present options: SECaaS optimal, on-prem “free” but limited, hybrid best of both. Draw scheme on whiteboard.

17:00. Chemistry with CIO. Panic fades, reason returns. Action: whitelists, collect terminal IPs piece by piece, BGP tunneling, extra firewall, approval, prod. 3 intense hours. Order pizza.

21:00. Pepperoni, black soda, mood up. Reroute traffic, wait for DNS prop, test, tune. Not instant – another ~5 hours, but calm & professional. Business restored.

04:00 next day. Watch sunrise together. Handshakes, go home.

09:00. Call through sleep: tender manager — “Where’s TCO?!” Deadline 18:00. Aggression: “I need it NOW!” Shave, shower, wipe tears of frustration.

10:00. Proposal sent, I’m on the carpet — restrained but pissed.

Outcome: bonus (bought first motorcycle), ride in boss’s black BMW X5, personal coaching from him. Built deep trust with CIO – became their trusted architect. Shared expertise, built IR plans.

Later attack on customer DB via web server — they were ready. Detected leak via read spike in Storage monitoring, blocked channel in time. It turned out to be just a couple of lines of malicious code injected into the website. Who could have done that? 🤔

Peak twist: I’m on client side, defending them to authorities & R.Borodach (Frostbyte investigations head) — “All measures taken, no admin liability for data breach.”

3 years on: R.Borodach arrested. Frostbyte: “No known violations,” fired same day. Still serving sentence.

Moral (short & hard):

1. Control ALL your assets. Even a simple landing page can be entry point. Never mix public & business flows. Think 10× about risks before publishing.

2. Store data only on Enterprise-Ready Storage. Invest in monitoring & response processes – saves nerves, time, and proves innocence when shit hits the fan.

3. Read my blog, take ownership, but stay away from gray zones. Respect the law. Ignorance is no excuse.

Resources: Mobylnik (soundtrack)

Movie or real life — which is crazier? Drop thoughts below.

If this was useful, you can BUY ME A COFFEE.

---

© 2026 Michal Domalewski / Naked CyberSec. All rights reserved.

Today I want to talk about new data storage technologies and virtualization in particular. Right away: no praising companies I worked for, work at, or will work for. It’s cool when someone climbs so high that challengers lose the desire to compete directly. But every security guy knows: behind every beautiful marketing slide hides the same thing — caffeine addiction, ruined personal life, work-life balance broken over the knee, peeking into the windows of the neighboring business center, pouring water from glass to glass.

And everyone who has tried BDSM (I mean Business Development Sales & Marketing) knows: to keep your glass full, you have to dry someone else’s a little.

So let’s talk about the outdated and long-obsolete approach of storing data on physical servers. Because it’s been bugging me.

Remember that clumsy, humming supertower in the server room? Puffing, groaning, but God forbid you bump it with your elbow or spill coffee nearby — the head admin gets a near-heart attack because the entire accounting department lives on it.

Scale doesn’t matter: in a big company you might have 200 of these.

Remember? You can’t do anything with it — old-school rule: “It works — don’t touch it.” Yes, with bugs. Yes, by mood. Once every 1–2 years you have to stay up all night restoring because a disk failed or a fan died. All with downtime and nerves.

And cybersec is not just about “nobody finds your security hole.” It’s first of all about business resilience, continuity, risk control, and making sure catastrophic events don’t put the company out of business.

Then virtualization came and brought virtual farms. Most people screamed: “Unsafe! How can you share power between 2–3 (max 7–10) beautiful modern servers with a shared resource pool?”

Turns out — you can. And it’s much safer than 50 dying repurposed PCs.

But life moves on, and we move with it. The needle of virtualization turned out stronger than morals, and your dealer decided to raise prices sharply. Where to put your Enterprise files now?

My answer: 1–2 unified storage systems with well-organized role-based access for all departments, replication of critical data, fast and convenient migration between storages, encryption, deduplication, and compression.

But that’s just my opinion. You decide and act.

If this was useful, you can BUY ME A COFFEE.

---

© 2026 Michal Domalewski / Naked CyberSec. All rights reserved.

My story started long before I ever touched a computer. In 1936, thousands of Poles and Germans from the border regions of Ukraine (mostly Volyn and Zhytomyr) were deported to Kazakhstan by order of the Soviet government. They were loaded into freight trains with only an hour to pack. Their past was erased in one trip.

One of those trains carried my grandfather – a little Polish boy – and his family. They ended up in Labor Settlement No. 12 of Karlag (now the village of Pervomayka in Akmola Region, Kazakhstan).

Karlag was one of the biggest agricultural camps in the Gulag system. At its peak, it covered almost 1.8 million hectares with hundreds of small points, farms, and sites.

People survived in the endless steppe, built farms, and raised children. My grandfather made it through. Despite his “unreliable” background, he finished a railway college, married a doctor (my grandmother), and in 1955 my father Alexander was born in the same Akmola Region.

I was born on July 27, 1988, in Stepnogorsk – a completely closed town that wasn’t even on public maps until the late 1980s. The main factories were the Central Mining and Chemical Plant (uranium mining and processing) and the Progress plant (where they developed components for biological weapons in Soviet times). After the USSR collapsed, the town suffered hard in the 1990s: factories closed, people left. My family moved too – first to Moscow Region, then to Moscow in 2000.

I loved computers from early childhood. We got an 286 PC – the second one in the whole town – when I was four years old. That decided my path. I went to College of Information Technologies, and later chose university in cybersecurity – back then it seemed the most romantic field in IT.

University was brutal: 5-6 exams twice a year, constant stress, math, physics, philosophy, database and network security, low-level and high-level programming, tons of paper-based security rules, and basics of cyber warfare. My fuel was five Ritter Sport chocolates a day. Languages were hard, but math and history always came easy.

After graduation I started as a security administrator in a big bank. A couple of years later I realized I wanted to work more with people than with machines. I moved to system integration. Over the years in Russia I worked at well-known vendor companies: Kaspersky, Positive Technologies, Garda Technologies, Solar Security. I traveled all over the country – from Kaliningrad to Yuzhno-Sakhalinsk, and many times to Kazakhstan and Kyrgyzstan on business trips.

Everything was going fine until 2022, when the war started. I left — first to Kyrgyzstan, then to Kazakhstan. I got a residence permit and applied for Polish citizenship through repatriation. In 2025 I finally returned to the homeland of my ancestors.

Why am I telling you this long personal story?

Because this blog is called Naked CyberSec. After 15+ years in the field, I’m deeply convinced: real cybersecurity is impossible without trust.

Everything we build – Zero Trust architectures, immutable snapshots, AI enterprise infrastructure – rests on trust. Even in Zero Trust the second word is still trust. Trust, but verify. I know who I am. Now you know too.

This blog is my way of being completely open. No masks. With a history that goes through the Gulag, deportations, closed uranium cities, to today — living in Prague as a digital nomad with my dog Diego.

Stay naked. To be continued...

---

© 2026 Michal Domalewski / Naked CyberSec. All rights reserved.

So, the blog is live. Naked CyberSec. No fancy logo (yet), no marketing team breathing down my neck, just me, a laptop, and my dog Diego snoring like a tiny chainsaw next to me on the couch in Prague.

It’s March 19, 2026. 00:30 in Prague. The streets are quiet now—only the occasional tram rumble and night owls heading home. Diego is snoring peacefully beside me, and I’m finally hitting “Publish” on the first post of Naked CyberSec. No more excuses.

Why now? Why this blog at all?

Because the infosec world (and IT in general) is drowning in polished corporate fluff, vendor spin, and “best practices” that sound great in webinars but fall apart in real production environments. We need more naked truth — raw, unfiltered, from someone who’s actually been there.

Short answer: because the IT world needs more naked truth and less polished corporate fluff.

---

© 2026 Michal Domalewski / Naked CyberSec. All rights reserved.