The one-paragraph verdict

This is reported journalism, not a security manual, and it earns the comparison to a good thriller — the pacing is relentless and the BlackEnergy-to-NotPetya throughline is genuinely clarifying. Greenberg is good at the part that usually gets lost: how a single trusted update channel becomes a worm that erases Maersk and Merck without ever “targeting” them. The flip side of that talent is the occasional drift into doom-narration, and if you already live in this domain the technical depth is thin — you get the shape of the attacks, rarely the internals. It also repeats its own beats; the back third circles. Still, the central lesson holds up under scrutiny.

Who should read it

Platform and infra engineers who keep deferring segmentation work should read it as motivation — it makes lateral movement viscerally concrete. It’s also a clean entry point for security-curious generalists. Skip it if you want packet-level forensics or a defender’s playbook; this is the why, not the how.

Where it earned its place

NotPetya is the reason I stopped trusting the inside of my own network. That conviction is exactly what zero-trust mTLS and identity is built around — every call authenticated, no implicit trust from “it’s on the LAN.” The blast-radius argument also drove the default-deny posture in Kubernetes network policies: a compromised pod should reach nothing it wasn’t explicitly granted.

Skip it if…

You want hands-on detection or response technique — this is narrative history, and a security practitioner hunting depth will outpace it fast.