The Most Exploited Endpoint Has No Firmware Update

We spend millions hardening networks, rotating keys, and segmenting clouds. Yet the oldest attack vector, a human being, still sits outside most architecture diagrams.

The signal

Nvidia’s board has launched an independent investigation, led by independent directors with outside counsel, after reports that CEO Jensen Huang was targeted by a Chinese intelligence operation. Huang has acknowledged an affair with a former executive at a Singapore-based chip company. A memo circulating among U.S. policymakers alleged she was recruited to spy on him. The board says it has no reason to believe national security or company secrets were compromised.

I won’t comment on the personal dimension, which is for the people involved. The architectural lesson is what interests me.

Leverage lives in secrecy, not in the act

Honeytraps, blackmail, and social engineering share one mechanic. The attacker doesn’t need to break your encryption. They only need something you’d rather keep hidden. The leverage comes from concealment.

That makes this a design problem as well as a moral one. If your culture punishes disclosure so severely that people hide compromising situations, you have built a coercion surface into your organisation. Psychological safety is a security control. A leader who can say “I think I’m being targeted” the day it happens is far safer than one who stays quiet from shame.

Zero Trust must include the people

We apply Zero Trust to devices and APIs: never trust, always verify, assume breach. Yet we routinely exempt the most privileged humans from the same logic. Executives hold the widest access, the most strategic knowledge, and the least scrutiny. That is a textbook over-privileged service account.

Consider what Zero Trust for people would mean:

• Least privilege for knowledge. Compartmentalise strategic information, not just files. No single person should be a single point of compromise.
• Blast-radius thinking. If a senior leader is compromised, what is the maximum damage? If the answer is “everything,” that is a design flaw.
• Verifiable controls over assurances. “We don’t share classified information with customers” is a policy statement. Audit trails and access logs are evidence. Boards should ask for the latter.

Governance is architecture too

The board’s response matters. Independent directors, outside counsel, and a defined review process are separation of duties applied at the top. Investigations run by the people being investigated are like logging systems writable by the admin.

There is also a trade-off. Monitoring and vetting that go too far become surveillance, which erodes trust and dignity. Too little, and you invite exploitation. The balance is clear policy, proportionate controls, and safe self-reporting channels rather than covert monitoring.

A lesson for founders and students

If you are building a startup or learning the craft, remember that security does not begin at the firewall. It begins with the behaviours you normalise. In a small team, the founder is the highest-privilege account in the company: the keys, the investor conversations, the roadmap. Build habits early:

• Separate personal and professional channels.
• Treat unsolicited, unusually warm approaches from strangers with healthy scepticism, especially in sensitive sectors.
• Create a culture where “I made a mistake, and I need help” is heard as a security report, not a confession.

Takeaways

• Extend Zero Trust to people, starting with the most privileged.
• Reduce coercion risk by making disclosure safe and early.
• Compartmentalise knowledge, not just data.
• Demand evidence, such as audits and access logs, not reassurance.
• Keep investigations independent of those being investigated.

As the global race over AI and semiconductors intensifies, the human layer will be probed as relentlessly as the technical one. Resilience is not the absence of human frailty, but a system designed to survive it.

---

About the Author: Sanjeev Sarma is the Founder Director and Chief Software Architect at Webx Technologies. With a core focus on Generative AI integration, Cloud-Native Scalability, and Enterprise Software Architecture, he has spent over two decades driving digital transformation across Northeast India and beyond. Beyond his corporate leadership, Sanjeev is deeply invested in shaping the future of the IT industry. He serves as an Industry Expert on the Board of Studies for Assam Don Bosco University’s School of Technology, advises state technology committees, and actively mentors emerging tech startups at STPI. He brings a unique, dual perspective of high-level enterprise execution and future-ready academic curriculum development.