Every quarter (hopefully more often), someone will perform a phishing simulation. Within the email, it will have a slightly dodgy domain, and you will have to validate your credentials so that your account isn't locked. Some people will fall for it. We then log the number of people failing and how many people reported the email. Our leadership will nod if numbers have gone down or frown if they have gone up. I have run these programs at several companies and advised even more. I have sat in these meetings and watched how the click rate impacts the team.
I have been hesitant to say anything here. I don't like commenting on how people live their lives. But we have all seen the news stories regarding the personal life of the Nvidia CEO, and I am looking at this in a slightly different light.
Let me recap what happened. In late October 2026, The New York Times reported that U.S. intelligence officials suspected that China's Ministry of State Security had orchestrated a social engineering campaign targeting Nvidia CEO Jensen Huang. The method they were using would have been through a person. (Not great for catching through email filters.)
Huang admitted to being unfaithful to his wife Lori in an internal memo on November 8th. An independent investigation was opened by the Nvidia board with external legal counsel. This caused shares to drop by over 4% the following Monday. Three Republican chairpersons from House committees requested Huang appear for a closed-door meeting on the 18th. The CIA director and director of national intelligence briefed the "Gang of Eight."
The intelligence element is a different story. U.S. intelligence believed that Alice Huang, a Chinese citizen and executive at Megaspeed International (Singapore-based), was recruited by China's Ministry of State Security to gain intel on Nvidia — potentially to influence U.S. policy on AI chip exports. Between June 2024 and February 2026, a Malaysian company associated with Megaspeed purchased at least $4.8 billion worth of advanced AI equipment with Nvidia technology. Alice Huang and Megaspeed have not been charged at the time of writing. China denied the allegations, and Nvidia stated they had no reason to believe any confidential information or national security was compromised.
Investigations will be carried out by people with clearances I don't have. What I'm interested in is what a security team can learn from this scenario. If we accept that the intelligence assessment is true, then we understand that this is an old method….It's a Honey Trap.
This involves creating a relationship with someone who has access to information or influence — a friend, a lover, or just a business relationship. Over time you become someone they can trust, someone they'd tell their secrets to or do a favor for. This is why it's difficult to detect.
During the Cold War, Markus Wolf, the East German Spymaster, used Romeo spies to gain relationships with women in West German government offices, NATO, and defense companies. In 1986, Mordechai Vanunu was lured to Rome by an Israeli operative codenamed Cindy. More recently, a suspected Chinese operative created relationships with U.S. politicians, including Rep. Eric Swalwell and two Midwestern mayors. (The FBI got involved. Swalwell collaborated with authorities and has never been accused of anything. Having a seat on the House Intelligence Committee is a great reason to be briefed on these types of issues.)
People trust someone who keeps turning up. Intelligence services have known this for years. In the private sector, we still refer to social engineering as something that primarily occurs in the inbox. For most organizations, that's all they will ever see.
The Times reported that there were photos of Jensen and Alice Huang together at a bar in Taipei around the time of Computex in June 2024. Alice was an executive of a major Nvidia customer, so of course they had a reason to meet. Nvidia stated they were having normal interactions with this person. This is exactly why it's worth discussing. Great social engineers will make you think it's Tuesday.
The Times also reported that parts of Alice Huang's CV were hard to verify. She had a profile on a private fund database stating she had worked at Hunan TV, CCTV, HSBC, and CITIC Securities. An executive at Hunan TV stated he had never heard of her and couldn't find any records. HSBC and CITIC did not comment. Classic pretext. Imagine a fake gaming commission badge like in Ocean's Eleven. (Yes, I will keep referencing that. I wrote an entire article on it.)
If you have ever run a phishing simulation, you know that you provide a reason for people to trust the sender. An email that appears to come from IT and makes sense, with a deadline to suspend their account — now you've given them an incentive to click. Having a relationship means the request now has context. You have had conversations with this person for months and they are someone you trust. You may feel like you're continuing the conversation and answer the question without thinking about how you'd respond if they weren't someone you knew.
Emails can make you feel like you know someone in 30 seconds. With a person, you could have spent months or years building a relationship. Both rely on us trusting people based on who we think they are and how well it fits with the situation. How do we train people for the latter? In most places I have worked, we don't even get to this stage.
Checking the sender and hovering over the link are great habits. But there is a whole conversation around trusting people that we're not having. When does a completely innocent conversation turn into something sensitive? What do you do if it's someone you see at every conference?
I have seen simulations where people receive an urgent email from IT-Department@cornpany.com — yes, cornpany — requesting them to verify their account. If you catch it, you get a digital gold star. If you click, you get a module explaining how to check the sender. Everyone completes the module and the compliance box is ticked. I have shown these results to leadership and explained that the click rate tells me how people reacted to this email. It makes people happy if there are failures and upset if there aren't.
Imagine your CFO constantly seeing the same person at industry dinners. Or a vendor representative everyone knows so well they just wave them through security without a visitor pass. Maybe it's a conference friend who slowly starts to learn more about your infrastructure than they should. Good luck adding this to your KnowBe4 dashboard.
Robert Cialdini originally came up with six principles of influence. Authority and Scarcity are easy to spot with a fake IT email asking you to act within 10 minutes. With a relationship you have Liking, Reciprocity, and Commitment. You will want to help someone you like, pay them back, or give your old friend the benefit of the doubt. These are natural human traits. They can also be exploited by a patient adversary.
I don't know how I would defend against this in Jensen Huang's role. Forget the allegations for a moment and imagine how difficult that role would be. You meet thousands of people a year — customers, investors, government officials. You have to build relationships. Can you build relationships with everyone you meet while also wondering if they're an intelligence operative?
I can think of a dozen relationships I've had where someone with bad intentions could have exploited my trust. Conference friends I've had a good rant to. Vendor representatives I've become friends with. Ex-colleagues who still know where the bodies are buried (metaphorically). I have said things in a relaxed manner that could have been used to build a plausible story about a colleague. If you have spent any time getting to know your colleagues, you'll be able to think of some examples.
What do we do? I have looked at the frameworks. I have yet to find a maturity score for someone building a relationship with your CEO. Start with what we already ask people to do — but be honest about its limits. If our whole awareness program is about detecting a bad email, we are telling people to lock the front door and hoping no one asks about the windows.
Give people with sensitive access an honest threat briefing. Explain why they may be targeted and how a normal professional relationship can lead to requests for sensitive information. Tell them who to speak to if they feel something isn't right. If the CISO can find time to brief the board on ransomware and phishing stats, the leadership team can find time to explain why certain people may be targeted.
Make it easy for people to raise concerns. Don't make them feel silly for trusting someone they had every reason to trust. Intelligent people have been targeted — diplomats, scientists, intelligence officers. If the assessment on the Nvidia case is true, I wouldn't expect Jensen's ability to build a tech company to have given him immunity from that.
Look at what any individual can share, approve, or give access to. Least privilege and segregation of duties still apply. Even if they have a corner office, requiring a second approval for any sensitive information disclosure or exception provides an opportunity to catch issues before they become problems.
Make travel briefings a regular occurrence for anyone handling sensitive information and attending international conferences. If you must cover the hotel Wi-Fi, use some of that time to explain why major tech conferences — Computex, CES, Mobile World Congress — are of genuine interest to foreign intelligence services. Tell them who they can contact if they have concerns during any interactions.
The difficulty is knowing that the person asking about your project may also remember your children's names. The conversation may feel like any other you've had with them. Keep the phishing simulation, but be honest with people about what the click rate actually measures. If this is the only thing leadership sees, then no one has to ask how we would handle a request from someone they trust.
What stands out to me is that Huang reportedly wasn't briefed on the potential threat from foreign intelligence. If they recognized the risk, there is a gap in how we provide useful information to the people who need it. It's like watching someone walk toward a hole in the floor and waiting for the training manual to tell us what to say.
Your phishing simulation has a click rate…the real attack doesn't.