INTERVIEW: Signal vulnerability exposes hidden security risk for government officials, SENTRIQS CEO warns
A recently disclosed vulnerability affecting the popular encrypted messaging app Signal highlights a broader security risk for government officials who rely on consumer messaging platforms, according to SENTRIQS CEO Damien Fortune.
Fortune, a cybersecurity entrepreneur whose company has worked with the U.S. Air Force and other security-conscious organizations, told the Washington Reporter that encrypted messaging apps can still leave users exposed even when the messages themselves are protected.
“Encryption alone does not equal security,” Fortune said.
Fortune leads SENTRIQS, a secure communications company that developed Glyph, a messaging and collaboration platform designed for government agencies, defense organizations, businesses and other users handling sensitive information.
His warning comes after security researchers disclosed a vulnerability involving Signal Desktop that could allow an attacker to manipulate how links appear inside messages, potentially disguising a malicious destination as a legitimate website.
The vulnerability did not break Signal’s underlying encryption. But Fortune said that distinction demonstrates the larger problem.
“The Signal vulnerability is a perfect example of why end-to-end encryption is only one piece of the security puzzle,” Fortune said. “If an attacker can manipulate what a user sees or where they are being directed, the encryption protecting the message itself doesn’t solve that problem.”
Signal has become widely used in government and political circles because of its end-to-end encryption and reputation for protecting private communications. The app drew even greater scrutiny after senior Trump administration officials used a Signal group chat to discuss military operations in Yemen earlier this year.
Fortune said government officials should be especially cautious about relying on consumer applications for sensitive communications.
“Government officials are high-value targets,” Fortune said. “They are targeted by nation-states, sophisticated criminal organizations and other adversaries who are constantly looking for ways around traditional security controls.”
SENTRIQS is pitching Glyph as an alternative built specifically around those risks. The company says the platform combines encrypted communications with tighter controls over users, devices, data and infrastructure.
According to Fortune, SENTRIQS also gives organizations greater control over where their data resides and how the system is managed, an important distinction for government and defense customers that may have security requirements beyond those of ordinary consumers.
“Glyph was built from the ground up for organizations that cannot afford to compromise on security, privacy or control,” Fortune said.
The company has already attracted attention inside the national security community. SENTRIQS has worked with the Air Force and participated in Cyber Dawg, an exercise led by the state of Georgia designed to test cyber capabilities and train personnel against sophisticated threats.
Fortune said those environments require a different security model than a mass-market messaging application.
“We are building for customers who assume they are going to be targeted,” he said. “That changes how you think about every part of the system.”
Fortune also cautioned that no communications platform can credibly promise absolute security. Instead, he said agencies should evaluate the entire security architecture behind a product, including identity management, device security, infrastructure and administrative controls.
The recent Signal vulnerability, he argued, should serve as a reminder that encrypted messaging is not necessarily the same thing as secure communications.
“Organizations need to look beyond whether an app says it has end-to-end encryption,” Fortune said. “The question is whether the entire communications environment is designed to withstand the threats that organization actually faces.”
