(Update, 10 p.m. Nov. 13: FAA says airlines can resume flights after hours-long ground stop, but delays and cancellations to continue.)
Two massive technology disruptions in roughly 24 hours. Microsoft 365 goes down, disrupting Outlook and other services worldwide. Then the Federal Aviation Administration orders a nationwide ground stop, bringing air travel to a halt.
And almost immediately, the conspiracy theories start flying.
Scroll through Facebook or X, and you'll find people connecting the two incidents, suggesting coordinated cyberattacks and pointing fingers at Iran. Apparently, two major systems can't experience problems within a day of each other without somebody deciding we're under attack. Surely, some speculate, these are the latest exploits to come from the same attackers who have tampered with European freezers in recent weeks.
Except that as of now, there's no evidence for any of it.
We don't know whether Friday's FAA disruption involved malicious activity. We have no evidence that it was connected to Thursday's Microsoft 365 outage. And we certainly have no basis for declaring that Iran, or any other foreign adversary, was responsible.
Yet the speculation is already taking on a life of its own.
This is how cybersecurity FUD is born. A little information, a lot of imagination, and suddenly people are treating theories as established facts.
I've spent years writing about threats to critical infrastructure. I take those threats seriously. But I also believe we do the cybersecurity community a disservice when we turn every unexplained technology failure into a presumed act of cyberwarfare.
Sometimes systems fail.
Sometimes those failures are spectacular.
And yes, in the fullness of time, these events are cautionary tales about how vulnerable systems may be exploited in the future. I wrote as much this morning regarding the Outlook 365 outage.
Dave Kennedy offers something increasingly rare: Restraint
Of all the reactions I've seen to Friday's FAA disruption, one of the most thoughtful came from my old friend Dave Kennedy, founder of TrustedSec.
In a post on X ahead of an appearance on CNN, Kennedy made the point that should be guiding every conversation about this incident:
Nobody knows exactly what happened yet. Not the public, and, according to Kennedy's assessment at the time, not even the agencies investigating it. Determining the cause takes time.
That didn't stop Kennedy from providing useful context.
He explained that much of the FAA's technology infrastructure is decades old, with some systems dating back to the 1980s. He pointed to longstanding concerns raised by the Government Accountability Office about the reliability and sustainability of air traffic control systems.
In a 2024 assessment, the GAO identified 105 of 138 FAA air traffic control systems as unsustainable or potentially unsustainable.
That's a legitimate concern. It's also documented evidence.
Kennedy went further, explaining that the FAA's modernization efforts introduce new considerations around connectivity, network segmentation and potential attack surfaces.
Again, legitimate concerns worth examining.
But here's what he didn't do: He didn't declare the outage a cyberattack. He didn't invent a connection to Microsoft. He didn't point fingers at a foreign government.
He distinguished what is known from what remains unknown. That shouldn't be remarkable.
In cybersecurity, unfortunately, it sometimes is.
Two outages don't make a conspiracy
I understand why people are connecting the dots.
Thursday's Microsoft 365 outage affected services millions of people depend on. Friday's FAA ground stop disrupted another essential piece of national infrastructure.
Put those events side by side, and it's easy to imagine something sinister.
I had a similar initial reaction myself.
After years of covering attacks against water utilities, transportation systems, energy infrastructure and other essential services, I couldn't help thinking about how much disruption a determined adversary might cause.
That remains a legitimate topic for future analysis.
Microsoft's outage involved reported problems with the infrastructure responsible for establishing secure connections. The company investigated a recent network configuration change and attempted multiple recovery measures. As of the reporting available Friday, there was no established evidence of malicious activity behind the Microsoft disruption. The FAA incident was still under investigation.
Neither fact supports the conclusion that the two events were connected.
And neither supports blaming Iran, North Korea or anyone else.
Could investigators eventually uncover evidence of malicious activity? Of course. That's why investigations exist.
But until that evidence emerges, the responsible position is to acknowledge what we don't know.
Not fill in the blanks with whichever geopolitical villain happens to be trending.
Cybersecurity has a credibility problem when speculation becomes certainty
There is a reason this bothers me beyond the immediate incidents.
Cybersecurity professionals have spent years trying to convince business leaders, policymakers and the public to take digital threats seriously.
We've warned about ransomware, attacks against operational technology, software supply-chain compromises, vulnerabilities in aging infrastructure and the dangers of increasingly interconnected systems.
Those warnings matter. But credibility is hard to build and remarkably easy to squander.
Every time someone declares an unexplained outage to be a cyberattack without evidence, they make it harder for the public to distinguish legitimate warnings from manufactured panic.
And when those claims spread through social media, they can quickly become accepted narratives that are difficult to correct.
A rumor gets shared. Somebody adds a speculative explanation. Another person repeats it as though it came from an official source. Before long, the original uncertainty has disappeared beneath layers of invented certainty.
We've seen this pattern play out with breaches, elections, natural disasters and countless other events.
The technology changes. The human behavior doesn't.
And in a world where AI can generate convincing explanations, fabricated evidence and authoritative-sounding analysis in seconds, the problem is only getting worse.
The cybersecurity community should be pushing back against that tendency, not feeding it.
There's plenty to learn without inventing an attacker
None of this means we should ignore the vulnerabilities these incidents may expose.
The FAA's aging infrastructure is a serious issue. Federal auditors have documented it repeatedly. Modernization is necessary, and the security implications of greater connectivity deserve scrutiny.
Microsoft's outage raises legitimate questions about cloud dependencies, availability, resilience and how organizations maintain operations when essential services become inaccessible.
Those are worthwhile conversations. But we can examine the consequences of an outage without pretending to know its cause.
We can identify weaknesses without claiming they've been exploited.
We can improve incident response planning without turning every infrastructure failure into a national security conspiracy.
In fact, doing those things responsibly makes the resulting lessons more valuable.
If investigators eventually determine that malicious actors were involved, I'll be among the first to examine what happened, how it happened and what defenders should do differently.
Until then, the evidence needs to lead the story.
Not the other way around.
