Where was Nvidia’s security team?

Nvidia's chief security officer departed the company in August, and roughly two and a half months later CEO Jensen Huang stepped down amid scrutiny of his personal relationships — starting with an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China, and widening to reports of two affairs with Nvidia employees.

David Reber, who served four years as chief security officer and seven years at Nvidia overall, said he was leaving for health reasons, writing on LinkedIn in late August that family and health had to come first after a young-onset Parkinson's diagnosis made more than two years earlier. Saša Zdjelar, who spent 17 years at ExxonMobil before a year at Salesforce and several at the cybersecurity firm ReversingLabs, took over. Zdjelar did not respond to questions about the transition or what the security team knew; Reber and Nvidia also declined to answer. Nothing publicly links either role change to the Megaspeed matter, and Megaspeed has denied any wrongdoing.

Some insiders clearly saw part of the picture: Nvidia's top lawyer was engaged with the government's Megaspeed inquiry more than a year ago, and colleagues appear to have known of Huang's relationships with employees, though the company's code of conduct does not expressly forbid such relationships. Whether any of that reached the security function remains unanswered.

What rival intelligence services often want is policy insight rather than technology — who is pushing to change export rules and who the biggest blocker is, said Nicholas Eftimiades, a retired senior intelligence officer. He offered a hypothetical in which a CEO complains that he cannot act because a board member opposes him, effectively naming the obstacle an asset could then target through email and phone. The playbook, he added, is "particularly for China," where executives routinely report being approached, though relationships now typically last years rather than the weeks common in the Soviet era.

Structural limits matter too. Because security teams don't drive revenue, they are often underfunded, Eftimiades said, recalling that CEOs commonly answer warnings with "not a nickel more than compliance." Don Aviv of Interfor International and author Jeremy Hurewitz argued in The Hill that too many companies still treat security as protecting facilities, preventing cyberattacks and responding to physical threats, and that teams should instead track insider threats, cultivation of executives by foreign services, suspicious business relationships and conflicts of interest.

What to watch is whether further reporting establishes what Nvidia's security team knew and when, and whether Huang's departure pushes companies to widen the remit of corporate security beyond fences, firewalls and physical threats. Zdjelar, now leading that team, has yet to speak publicly about how the handover was handled or what concerns, if any, surfaced before August.