Book a demo
About CyberXYZ

Built by someone who was there at hour zero.

CyberXYZ was founded by Amro Haddadah. He spent five years on Microsoft's Cybersecurity Incident Response Team (CIRT) and worked Solorigate and HAFNIUM from the first hours. He started CyberXYZ to stop the next supply-chain attack before it installs.

Read our story Meet the team
  • 5 yearsMicrosoft CIRT
  • CIT (now MTU)MSc thesis, 2023–2025
  • Cork · Vancouverbuilt in · shipped from
how it started, from Amro's phone
hour-zero
  1. Dec 2020 Solorigate
  2. Pager · Microsoft CIRT
    SEV 1 SolarWinds Orion. Somebody shipped a backdoor inside a signed update.
  3. On it. Hour zero. Putting the coffee on.
    Read
  4. Mar 2021 HAFNIUM
  5. Pager · Microsoft CIRT
    SEV 1 Exchange Server zero-days. Exploited at scale.
  6. Again?
  7. Same pattern every time. They're not breaking in any more. They're shipping in.
    Edited
  8. Mar 2024 xz
  9. A developer
    🧑‍💻
    Did you see xz? Someone spent years befriending a maintainer just to slip in a backdoor.
  10. Right. I'm watching every publish on every registry from now on.
    Read
  11. Today CyberXYZ
  12. A developer
    🧑‍💻
    npmnpm install axios@1.14.1
  13. CyberXYZ
    Blocked
    axios@1.14.1 stopped before installHijacked release that drops a remote-access trojan. Use 1.20.0 instead.cyberxyz.io
  14. A developer
    🧑‍💻
    ...ok, that's fair.
  15. That's the whole idea.
    Read

Dramatised. The dates and the axios verdict are real; the coffee is not.

Our story

Why we started CyberXYZ.

CyberXYZ started in incident response. Our founder, Amro Haddadah, spent five years on Microsoft's Cybersecurity Incident Response Team (CIRT), doing forensics and incident response on nation-state intrusions. He was on Solorigate and HAFNIUM from hour zero, helping build the tooling and detections responders used to hunt the attackers down.

Case after case showed the same shift. Attackers had stopped breaking in and started shipping in, through signed updates and trusted code that companies installed themselves. Open source is the widest door of all. Millions of packages from strangers are installed automatically on laptops and build servers every day.

When the xz backdoor surfaced in March 2024, Amro started watching every publish on the public registries. That work became CyberXYZ, a firewall that checks every package before it installs and blocks the malicious ones, on laptops, on servers and in CI.

The cheapest breach to clean up is the one that never lands.

// what incident response taught us
Team

Meet the people behind CyberXYZ.

Amro Haddadah

// founder

Amro Haddadah

Five years on Microsoft's Cybersecurity Incident Response Team (CIRT), on Solorigate and HAFNIUM from hour zero. Then Principal Architect at Roche, leading enterprise security, and Cybersecurity Incident Commander at lululemon, on the security leadership team, leading the response to major cyberattacks and supply-chain threats. Now he builds the detection engine behind CyberXYZ and writes up the attacks it catches.

  • Microsoft CIRT
  • RochePrincipal Architect
  • lululemonIncident Commander
  • MSc · CIT (now MTU)
John Roble

John Roble

Business Development, Cybersecurity Solutions

in their words

What the people who worked with Amro say.

I had the pleasure of working with Amro, and I can confidently say he is one of the strongest cybersecurity professionals and incident leaders I’ve had the opportunity to work with. Amro brings exceptional leadership, sound judgment, and a calm, measured approach to even the most challenging cybersecurity incidents.

Mark KinneyOperations Leader, Incident & Crisis Managementsenior to Amro at lululemon · 2026

I can vouch for his technical abilities in the field of Cybersecurity Incident Response. … His particular interest in zero day vulnerabilities and its exploits made him a go to guy for any vulnerability related queries within the team.

Pranay KrishnaCybersecurity Incident Commander IIsame team at Microsoft CIRT · 2023

Amro’s biggest strength is his ability to deal with conflicting priorities in high-pressure situations, and he never loses his cool, which is one of the reasons he stands out as a Cybersecurity Incident Responder.

CC Catherine ChengIR engineer, Microsoftsame team at Microsoft · 2023

Even though we were in different time zones with 6hr+ difference, Amro was always very helpful, responsive and had a great sense of urgency.

Sofia MarinSenior security researcher, Microsoftsame team at Microsoft · 2023

I had the pleasure of working side by side with Amro over the past year at lululemon. Amro is one of those diamonds that are rarely seen in our industry. … As a Cybersecurity Incident Commander, Amro had the ability to stay calm and focused when things got chaotic.

Chad HardcastleStaff Security Analyst, lululemonsenior to Amro at lululemon · 2026

Amro has solid communication skills and knows how to present information in a crystal-clear way.

HK Huy KhaDirector of Security Research, Netwrixsenior to Amro at Microsoft · 2022

Amro has also helped numerous customers to fix their security vulnerabilities, providing them pragmatic and agile recommendations. He’s a great communicator who can deal with the toughest situations.

Emmanuel BoersmaIncident Responder, Microsoftsame team at Microsoft · 2022

When there is any vulnerability the only name that comes to mind is Amro.

AD Anup DholakiaCyber Security Consultant, Microsoftsame team at Microsoft · 2022

Since he joined the Incident Response team 3 years ago, he always went above and beyond to learn and develop his technical and social skills. … He always strives to give his best to build trust within the team and with customers. Amro brings a great value to the customers, teams and business.

Inga IsraelyanDirector Support Engineering Management, Microsoftsenior to Amro at Microsoft · 2022

I am just impressed that Amro always kept up to date, applied new knowledge while also working on cutting edge technology.

Felix GerberMES Project Engineer, Bachemsame team at Roche · 2025

Amro is a very talented Cyber Security Incident Response Engineer, always willing to help both Customers and colleagues with every challenging task we may face.

Stefano CrivellaroCyber Security Incident Responder, Microsoftsame team at Microsoft · 2023

With his technical depth and passion, he is good at investigating security incidents, providing inspiring opinions, and helping both colleagues and clients to achieve more.

Wanjun PengDFIR, MDR, SOC Operationssame team at Microsoft · 2022

// excerpts from 12 of the 19 recommendations on Amro’s LinkedIn profile, in their own words · read all 19 on LinkedIn

on stage

Where we’ve spoken.

Talks on the attacks we track and how to catch them, at the conferences security teams go to.

OWASP Global AppSec SF 2026 artwork with Polina Moshenets and Amro Haddadah 5Nov 2026
OWASP Global AppSec USA 2026 · San Francisco upcoming

The Compromised Maintainer Problem: Detecting Malicious Code in Legitimate Dependencies

With Polina Moshenets, Founder & CEO of SichGate. Attackers now go after the packages teams already trust, the ones with millions of weekly installs, and this talk walks through the detection patterns that catch them across npm, PyPI, NuGet and Go.

Thursday 5 November, 2:15 pm PST · Grand Ballroom A

Session page
ATLSecCon 2026 conference logo 9Apr 2026
ATLSecCon 2026 · Halifax

Beyond CVSS: Detecting Phantom Critical Vulnerabilities (PCV) in APT Attack Paths Using AI-Driven Exploitability

Thursday 9 April, 11:00 am ADT · Halifax Convention Centre

Session page
Who we work with

Working with security teams. Built with the tools they run.

Security teams at consultancies, payment companies and AI-security startups work with us, and we build on the platforms their engineers already use.

Book a 15-min demo Become a partner
  • Working with security teams at Accenture, AthenaGuard, Network International, Etuteki Lab and SichGate.
  • Built with Microsoft, GitHub, GitLab, SentinelOne, Elastic, Harness, Red Hat and IBM.

// top row: security teams we work with · bottom row: platforms we build with