Marcello Delcaro

I started in software supply chain security in 2020, at aDolus Technologies, right as SolarWinds broke. For the next five years I researched and took apart the major supply chain attacks, from 3CX to the XZ backdoor. I worked on a binary analysis engine that Fortune 500 companies and critical infrastructure operators used. Exiger acquired aDolus in 2024.

Security teams drown in warnings and still miss the one change that matters. The IT admin who is already burnt out has to pick the security tools, and most of those tools add work. The parent who gets scammed does not read breach reports and gets almost no help. They need someone to tell them, in plain words, what to do next.

Phended started in 2023 as an idea: teach people about security in words they can follow. That idea became a small family of tools. I built each one to do one job, in plain words.

I also teach. I taught at Vancouver Island University, where I trained new IT professionals. I also volunteered at ElderCollege on Vancouver Island to teach cybersecurity and AI.

The tools we build

• Phended Learn, before an attack. Take a course or read a guide, and learn to spot a scam before you click.
• Dave, in the moment. If a message looks wrong, paste it in. Dave tells you what it is and what to do next.
• Phended Trace, after a scam. Paste the scammer's wallet address. Trace follows the stolen crypto to the exchange where it cashed out and gives you a report for the police.
• Vigilance, inside the software. For the teams who ship and install software. Vigilance catches supply chain attacks before the damage is done.