Huntress CEO says threat hunter used 'poor judgment' in alerting ransomware crim about law enforcement probe

Huntress’ CEO Kyle Hanslovan admitted a “poor judgment” lapse where a current employee disclosed to ransomware operator Devman that law enforcement had contacted them, after former employee Ben Folland alleged the insider “passed communications from US law enforcement” to Devman. Hanslovan says Huntress found no evidence of illegal conduct or broader disclosures and tightened policies for researchers, but Folland argues the behavior meets the definition of an insider threat and could put clients at risk. The incident—tied to DragonForce/Conti-derived code and Devman’s alleged Russia links—raises reputational and compliance concerns for the security firm.

Analysis

A trust incident at a vendor that monetizes access to threat intelligence matters less for immediate revenue than for procurement behavior. Enterprise buyers of MDR and threat-hunting services are effectively outsourcing privileged human judgment; that raises the value of auditability, chain-of-custody controls, and boring compliance, which structurally favors scaled platforms over boutique operators.

Second-order, this is a margin issue for smaller cyber firms: more process, more supervision, slower analyst interaction with threat actors, and likely higher legal/compliance overhead. That does not move public earnings next week, but over 1-3 months it can widen sales cycles and create a slight preference for larger names like CRWD, PANW, and ZS versus the more service-heavy tail in HACK/CIBR. In regulated verticals, buyers may also start asking for explicit insider-threat controls in RFPs, which is a hidden win for incumbents with mature governance.

The contrarian risk is overreaction. If the internal investigation ends without evidence of illegal conduct or customer impact, this stays a reputational bruise rather than a sector event, and any selloff in small-cap cyber proxies should fade. The real falsifier is not headlines but evidence of customer churn, a partner termination, or repeated disclosures; absent that, the trade is more about modest multiple dispersion than fundamental impairment.

Key Decisions for Investors

• Long CRWD vs. short HACK for 1-3 months; use any sector-wide weakness to enter. Thesis: quality/trust premium expands as buyers gravitate to audited platforms. Target 8-12% relative outperformance; stop if CRWD underperforms HACK by 5% after the next earnings cycle.
• Overweight PANW on dips versus the broader cyber basket (HACK/CIBR) for 1-3 months. The governance and compliance narrative is a tailwind for large-platform vendors; risk/reward is better than chasing smaller service-heavy names. Falsify if enterprise checks show no procurement sensitivity.
• Avoid initiating fresh longs in smaller MDR/threat-intel service names for the next 4-6 weeks; if the sector rallies on sympathy, use it to trim. The asymmetry is that one more disclosure would hit multiples harder than this news can help them.
• Set an alert for any FBI confirmation, customer loss, or regulatory inquiry. If any of those surface, add to the short HACK leg immediately; if not, expect the market to move on within days and the issue to matter only at the next selling-season conversation.