I think we're talking across purposes here. I'm asserting that the fact that they were compromised isn't particularly bad. People get hit all the time. The fact

I think we're talking across purposes here. I'm asserting that the fact that they were compromised isn't particularly bad. People get hit all the time. The fact that they were hit by an SQL injection bug is unfortunate and should've been picked up but these things happen all the time. I'd also say that while they're a security firm they should still be held to the same standards as everyone else, there's nothing inherently special about a security firm being compromised anymore than a plumber's getting a leak - what matters is the damage and how they fix it. The red flags as you call them are not the facts nor the means of the compromise alone, it's the data that is lost and whether or not HBGary Federal a) practiced what they preached and b) followed appropriate processes and policies to protect the information assets according to their sensitivity. My hope is that on balance they did b fairly well and maybe some of a. My expectation is that they did some of a and probably not a lot of b, the results of which would be the red flag. Again, I don't think that security companies should be held to higher standards than others as on balance we tend to hold less sensitive data than our customers (although that which we hold we should handle correctly). If this were an online pet shop people would talk about the attacks being quite advanced, laugh a little and move on. HBGary Federal aren't the first security firm to get hacked into and won't be the last.