For weeks, German security authorities have been warning about an ongoing wave of attacks carried out through the Signal messenger app. Germany’s Federal Office for the Protection of the Constitution and the Federal Office for Information Security describe it as a targeted campaign against politicians, military personnel, and journalists. The Federal Public Prosecutor General is now investigating on suspicion of espionage. The key point: these attacks do not exploit a technical vulnerability. Instead, they use social engineering and legitimate app functions to gain access to chats and contacts. The campaign against political decision-makers reveals a clear pattern: the target is not infrastructure, but identity and trust. The attacker does not need zero-day exploits, malware, or network access. A single successful social engineering contact is enough to create legitimate access. This is the real disruption: for decades, security architectures were built around systems: firewalls, EDR, network segments. This attack bypasses all of that completely and targets the human being directly as part of the architecture. Messengers such as Signal effectively function as decentralized identity systems without organizational control. A phone number or username replaces traditional IAM mechanisms, while features such as “device linking” become a new entry point. Security remains technically intact, but is overridden by user decision-making.

Most systems do not fail because they are broken, but because they are designed under the assumption of flawless execution. The Artemis II mission deliberately took a different approach. What interested me less about this mission was the spaceflight itself, and more the underlying architecture when viewed through the lens of core IT security principles. The decision to use a free-return trajectory ensured that the spacecraft would return to Earth even if critical systems failed. In other words, safety was not derived from perfect control, but from the structure of the system itself. This was precisely where the parallel to cybersecurity emerged. At its core, this reflected what we define as fail-safe design and risk mitigation: not the elimination of failure, but the reduction of its impact by design. The comparison became even more compelling when considering an alternative scenario in which the mission would have entered lunar orbit. This would have required a precise braking maneuver, a clear single point of failure. The success of the entire mission would have depended on one critical event. Technically feasible, but architecturally far more vulnerable. It was also where the concept of Zero Trust aligned. The mission did not “trust” that all systems would function exactly as planned. Instead, it assumed that failures could occur at any time and the architecture was built accordingly.

For me, this was the real value of Artemis II: it demonstrated in a very tangible way that resilient systems are not created by relying on perfect execution, but by anticipating failure and engineering for it from the outset.