Could You Switch Off a Critical System on Friday Night’s Notice?

Last Friday, September 25, a software vendor did something almost no vendor ever does. Kiteworks, which sells tools that companies use to move sensitive files and run secure email, told its customers to shut down their systems for the weekend. There was no breach to report. The company said plainly that it had received “credible threat intelligence” from federal authorities that an attack might be coming, and that it had no indication anyone had been compromised. In its own words, the advisory was “preventative rather than a response to a confirmed breach.”

Customers were asked to take their systems offline during a roughly nine-hour window on Saturday, September 26, timed by region. Self-managed customers had to do it themselves. Kiteworks shut down the systems it hosts. By Sunday the advisory was lifted and systems were coming back.

Then the story got more interesting. According to Kiteworks, it found and fixed a previously unknown critical flaw in one product, called Advanced Forms, during the shutdown window. The company says only a small share of customers use that product (press reports put it at fewer than 50 organizations), that the flaw was never exploited, and that no CVE, the public catalog number for a vulnerability, has been assigned yet. Kiteworks has not said whether that flaw is the one law enforcement was worried about. It also has not said who the suspected attacker is, or which agency supplied the warning. The FBI declined to comment, and CISA either declined or did not respond to press inquiries, depending on the outlet.

Why a vendor would risk this

Kiteworks has history here. Before it took its current name, the company was called Accellion, and in December 2020 attackers exploited multiple zero-day flaws in its older file-transfer product. A zero-day is a flaw nobody has patched yet because nobody knew about it. The ransomware group Clop was tied to the campaign, and victims included Kroger, the University of Colorado, and the Washington State Auditor. Reporting at the time put the number of breached organizations at fewer than 100 out of roughly 300 customers of that product.

So when the vendor says it would rather be early than certain, it is speaking from experience. Kiteworks CEO Jonathan Yaron told CyberScoop: “The industry standard is to wait for proof of an attack. We would rather be proactive on credible warning than wait for certainty and be too late.”

Whatever you think of the tactic, notice what it exposed. One vendor’s precaution became a live-fire drill for thousands of customers. A healthcare organization told TechCrunch it shut its server down immediately, and patient communications were disrupted as a result. Even a precaution that costs only a weekend has a price, and someone has to be authorized to pay it.

The question hiding inside this story

Here is the question I’d put in front of any board: if a critical vendor called you tonight and said “shut it down for nine hours,” who in your company could say yes, and what would break?

This is the heart of the Three Questions framework in Cyber Risk Is Business Risk. What are we protecting? File-transfer and secure-email platforms are where your most sensitive documents pass through: contracts, patient records, financial data, legal files. Who is responsible? The vendor owns the patch, but you own the decision to go dark, the customer promises you miss, and the regulatory clock that keeps running. Are we ready when it happens? Most companies have a plan for when a system is breached. Far fewer have a plan for when a system is merely threatened, and that second plan is where the cost of the decision lands on the business, not the security team.

There is also a compliance-versus-security lesson. Every customer who shut down was making a business tradeoff the audit checklist never contemplated. No framework asks whether you can take a critical platform offline on less than a day’s notice, and no control test measures it. Yet this is exactly the kind of decision a board should expect to have pre-authorized, because the alternative is a late-night scramble with no one sure who holds the authority.

What to ask your CISO this week

• Which of our vendors handle our most sensitive files or communications, and do we have a current list of every system they run for us, including ones IT didn’t set up?
• If a vendor told us to shut a platform down for a day, who has authority to approve that, and what business processes would stop?
• Do we have a documented fallback for moving or sharing sensitive files when our primary tool is offline?
• Do our vendor contracts require them to notify us promptly of threats, not just confirmed breaches?
• Have we confirmed that every instance of these platforms, including forgotten test or departmental ones, is on the latest patched version?

What we still don’t know

I want to be clear about the limits here. No breach has been confirmed. The threat actor is unidentified. The federal source of the warning is unnamed. And the flaw Kiteworks fixed may or may not be related to the original warning. Until more comes out, the responsible reading is narrow: a vendor acted on a warning, found a real flaw while it was at it, and says nothing was exploited.

That is still a useful moment for every executive reading this. You just watched a well-run response to an unconfirmed threat, and it was disruptive even when it worked. The time to decide how your company would handle that Friday call is before it comes.