Post

THREAD: When @thekrebscycle.bsky.social and his workplace, @sentinelone.com, were singled out by Donald Trump on Wednesday, I thought it was an opportunity to weigh the cybersecurity industry's rhetoric against their real world actions.

Krebs is at every other conference. His leadership of CISA, his novelty socks, his pineapple pizza jokes, and his dramatic Nov. 2020 standoff with Trump have all contributed to making him something of a cyber mascot. The typical journalistic cliche is "widely respected."

As for the industry, it often casts itself as fighting to defend democracy from election hackers & foreign disinfo. Surely punishing Krebs for defending the truth about America's elections - and punishing @sentinelone.com for the 'offense' of having hired him - would draw public indignation, right?

Well, turns out not so much. Let's start with Krebs' former employer, Microsoft. Microsoft's President Brad Smith told Congress in 2021 that: "There is no value that is more fundamental and timeless in our country than our commitment to democracy." blogs.microsoft.com/on-the-issue...

Microsoft's response yesterday to the news that their former exec had been blackballed by the president? "Nothing to share at this time."

I asked Alphabet's Google for their response. Bear in mind that CEO Sundar Pichai boasted in 2021 of driving users toward the CISA website "that debunked incorrect claims made about the integrity of the elections" - the same site that is now at the center of Trump's attack on Krebs and SentinelOne.

(Here's Alphabet CEO's Pichai's testimony: blog.google/outreach-ini...) His company's response? "We don't have anything to share at this time."

Together with @ajvicens.bsky.social I asked a total of 31 other cyber companies to weigh in on the attack on their peer (33 when you count Microsoft and Google). Tenable: "Unfortunately we're not able to offer comment for this story." Okta: "Nothing substantive to on our end to add"

And then there were those who simply didn't offer anything in response: Akamai, Cisco, Cloudflare, CrowdStrike, Deloitte, Dragos, Gen Digital, IBM, Palo Alto Networks, SailPoint, Recorded Future, Arctic Wolf, EY, PWC, Leidos, CyberArk, CommonVault, Varonis, Rapid7, Booz Allen (among others).

Most striking for me were the industry groups - groups typically set up to advocate for businesses before government and the public at large. The National Cyber Security Alliance - where Krebs once served as a Vice Chair! - didn't get back to us.

The Cloud Security Alliance - which counts @sentinelone.com as a member! - declined comment.