Gregorio Montanari, independent technical consultant
I have worked on production systems since 1994. I started in Genoa with projects for the university, the city council and private companies, then moved into roles where the consequences were mine: IT manager of a supplier of academic databases, then of Italy’s leading supplier to public libraries, technical director of the Centro Libri group, Italy’s second largest book wholesaler, during its acquisition by Messaggerie. From 2018 to 2026 I was CTO of DGLine, a B2B software vendor with its own products: WMS and MES, an ERP, e-commerce, document processing with OCR and AI.
In 2022 I co-founded Dfence, a continuous vulnerability assessment service for company networks, and ran it as CTO and Head of Product until 2025. Twenty paying customers with three to five sites each, about 100 physical appliances at customer sites, all governed by one SaltStack master with Python modules I wrote. That is where I learned what an operation that returns data instead of text to interpret is worth.
For eleven years I taught Linux system administration to Italian Army officers at the Telecommunications School in Chiavari. I also trained as a counsellor, which I use in technical work more than it seems: separating facts from emotions in an audit, reading the dynamics between a client and their long-standing vendor, delivering an uncomfortable finding without breaking the relationship.
How I work
No number without a source, no claim without proof, limits stated explicitly. That applies to my clients and to this site.
The code I write to measure stays with you, in a repository with instructions to run it. If only I can repeat a measurement, the day I am gone the number has expired and nobody notices.
Before correcting I measure, and before measuring I check that the instrument is measuring. On one e-commerce store the owner called me because Google Analytics showed visits collapsing. Orders in the database were stable, 3.67 a day against 3.70: the cookie banner, reconfigured without Consent Mode, made everyone who declined vanish from the statistics. Nothing was wrong with the site. We could have spent weeks optimising it.
Before intervening I ask which resource is scarce, and whether the intervention acts on it. I once spent days on a technically flawless operation aimed at the wrong resource, while the saturated quota was another one. Since then it is my first question.
If the initial assessment shows that the big piece of work is not needed, I say so and we stop there.
Tools
The list contains what I actually use and can show work on. Playwright for lab measurements and regression probes. sitespeed.io with Graphite and Grafana for continuous measurement. The CrUX API for field data. SonarQube, OWASP ZAP, Trivy, Dependency-Track and gitleaks in GitLab CI and GitHub Actions pipelines, with SBOMs in CycloneDX format. Python for extraction, verification and agents, including an MCP server I wrote. Linux, Docker, SaltStack, Cloudflare.
What I do not do
No 24/7 security operations centre, no forensic incident response, no manual penetration testing: if you need them, I will say so and help you choose who provides them. No compliance certifications. No scraping that bypasses authentication or anti-bot protection.