Joseph Shenouda (Cyber Consult) "Since the Election of the New Pope, Cybersecurity Is No Longer a Priority for the Vatican"

Joseph Shenouda, founder of Vatican Cyber Volunteers, tells JDN he had to dissolve the group due to the Vatican's lack of commitment to cybersecurity.

JDN. The Vatican has decided to distance itself from the Vatican Cyber Volunteers. Can you tell us more about this?

Joseph Shenouda. With the Vatican Cyber Volunteers, we were producing threat reports on cyberattacks targeting the Holy See, all on a volunteer basis. At first, I sent them directly to Paolo Benanti, the well-known priest who advises the Pope on AI. He would then forward them to the communications department, which has its own IT team led by CTO Francesco Masci. After a while, I established a direct line with the CTO. He often thanked me for alerting them to these threats and sometimes fixed the vulnerabilities we found. But when the new Pope, Leo XIV, was elected, he stopped listening to us. In August 2025, he did offer to meet with us. But that meeting never happened...

Did you still keep sending your reports to the Vatican?

Yes, but we were no longer being heard, and the vulnerabilities we reported were no longer being fixed. It felt like it was either a political issue or that cybersecurity was no longer a priority for the Vatican after the new Pope was elected. We later gathered at the Vatican with other volunteers to try to meet Paolo Benanti and Francesco Masci, but they refused. We also tried to alert the Vatican police about these vulnerabilities, but they responded with threats. Some of us sent reports to the Vatican gendarmerie... but without success. In short, four years of work went down the drain...

Why do you say the Vatican security forces were threatening?

One of the volunteers is a diplomat and had a pass to enter the Vatican. He joined us to help relay the reports to higher levels, including the head of the Vatican gendarmerie, Gianluca Gauzzi. In July 2026, he went directly to the Vatican law enforcement to deliver one of our reports. But they didn't understand what it was about... They mistook this volunteer for a cybercriminal! They issued him an official warning and revoked his Vatican access badge. Since then, he's been barred from entering. After that, I decided to shut down the association's activities to avoid putting the other volunteers—most of whom are CISOs—at risk.

What kinds of vulnerabilities were you detecting?

Thanks to our dark web scanning tools, we found multiple threats in leaked Vatican data. There were compromised Wi-Fi connections, bounce proxies used by cybercriminals to bypass Vatican firewalls, and credentials and data from the Vatican Bank circulating online, among other things. We even saw Vatican credentials being used on pornographic websites. When the Pope, who is Augustinian, was elected, URLs of Augustinian websites were changed to redirect users to porn sites. We were actually the ones who alerted the Vatican to that attack. Many cybercriminal groups target the Vatican for geopolitical or financial reasons, or when the Pope speaks out about wars, like the conflict between Russia and Ukraine. These groups include LockBit, Lazarus Group, DragonForce, Conti, Scattered LAPSUS$ Hunters, Play, Interlock, Akira, Killnet, and others. They all wanted to hack the Vatican! For context, the reason I got involved in 2022 was because the Vatican was one of the least secure countries in the world when it came to cybersecurity...

But doesn't the Vatican have a CISO?

No, the Vatican doesn't employ any cybersecurity experts. We warned them about the need to appoint a CISO, but that doesn't seem to be a priority for them either.

This article was automatically translated from French. Read the original version: https://www.journaldunet.com/cybersecurite/1557813-depuis-l-election-du-nouveau-pape-la-cybersecurite-n-est-plus-une-priorite-du-vatican/