L3Harris Trenchant: the exploit broker who investigated himself

Background

Trenchant is L3Harris's offensive-cyber division — built from two acquired boutique shops, Azimuth Security and Linchpin Labs, that specialized in finding and weaponizing software vulnerabilities before anyone else did. Its customers aren't the public. They're the US government and a short list of allied agencies, buying access to zero-day exploits that, properly used, let an intelligence or law-enforcement service get into a target's phone or computer without anyone else in the world knowing the flaw exists.

That business model only works if the exploits stay inside a very small, very trusted circle. Peter Williams, an Australian national with a background in his country's own signals-intelligence service, rose to become Trenchant's general manager — the person with legitimate, routine access to the division's most sensitive work product. This case study isn't about a hacker breaking in. It's about what happens when the person holding the keys decides to sell them, and the specific, almost absurd failure that let him keep doing it for years: the company investigating its own leak handed the investigation to the leaker.

A trust-abuse timeline, not a technical kill chain

What actually happened

There's no breach narrative here in the usual sense — no phishing email, no exploited vulnerability, no credential stuffing. Williams had the access he needed because his job gave it to him. Starting in April 2022, he began transmitting at least eight of Trenchant's exploits and exploit components to Operation Zero, a Russian broker that buys offensive tools and resells them — to whom, Trenchant's own customers don't get to find out. Williams was paid roughly $1.3 million in cryptocurrency for work the government estimates cost it $35 million in damage, once you account for exploits burned, operations compromised, and the cost of finding and fixing whatever those tools could reach.

The case broke open not because Trenchant caught it, but because the FBI did. In 2024, the Bureau told Trenchant it had reason to believe some of the company's software — including source code — had leaked. Trenchant ran an internal inquiry. Williams, as general manager, was the one who oversaw it. That inquiry concluded the secure network hadn't been breached, except for one unrelated incident where a former employee had improperly connected an air-gapped device to the internet. Trenchant handed the FBI those findings that November. They were wrong, and the person who delivered them was the person they should have been investigating.

The FBI didn't stop there. It ran its own parallel investigation, interviewing Trenchant staff and Williams himself more than once — including a direct confrontation in August 2025. By any normal read, being questioned by the FBI should have been the end of it. It wasn't. Williams kept transacting with Operation Zero anyway: in June 2025 (the date is reported inconsistently) he signed a new $500,000 sale agreement and transmitted stolen code days before a further scheduled FBI meeting. And in the window around that same confrontation, he closed on a $1.5 million house in Washington, D.C., putting down roughly $300,000 in cash days before meeting agents again.

He pleaded guilty in October 2025 to two counts of theft of trade secrets. In February 2026, he was sentenced to 87 months — seven years and three months — plus three years of supervised release, and ordered to forfeit the cryptocurrency and property tied to the case. The US Treasury sanctioned Operation Zero's owner, Sergey Zelenyuk, and several associated entities the same week, the first use of sanctions under the Protecting American Intellectual Property Act for a case like this. A restitution hearing was still pending as of sentencing — the prison term is final; the dollar figure Williams will be ordered to pay back is not, yet.

Root cause

Timeline

Detection

What to monitor for in your own environment

Containment, eradication & recovery

Security control analysis

Controls that would have prevented or limited this

Blast radius

What Williams made, against what it reportedly cost

What they got right

The thing that actually worked here wasn't anything internal to Trenchant — it was the FBI declining to simply accept the company's internal finding and continuing its own independent investigation anyway. That persistence, across multiple interviews and a direct confrontation that didn't immediately end the scheme, is what eventually produced an actual conviction rather than a closed, incorrect internal case file.

Once the case was made, the response was coordinated and fast: a guilty plea, a real custodial sentence, asset forfeiture, and Treasury sanctions against the buyer's side of the transaction in the same week — rather than treating this as purely a US-domestic prosecution with no consequence for the broker who paid for the stolen material.

Why this keeps happening

Offensive-cyber and exploit-development firms sit on intellectual property whose black-market resale value to a hostile state can dwarf what any salary or bonus structure could compete with. That's a structurally different insider-recruitment risk than most companies' IP-protection programs are built to catch, because the person being recruited usually doesn't need to steal anything in a technical sense — they already have the access the job requires.

The specific failure mode here — letting a conflicted person lead the inquiry into their own suspected conduct — isn't unique to this case. It's a known weakness in how organizations structure internal investigations generally: the person with the most information about what happened is often also the person with the most motive to shape the answer, and unless that's explicitly guarded against, it will happen again somewhere else.

Lessons for your own environment

1. A suspect cannot lead the investigation into themselves

   This sounds obvious stated plainly, and yet it's exactly what happened here. Any internal-investigation process needs a hard rule: the person under even preliminary suspicion is removed from any oversight or decision-making role in the inquiry, full stop, before the inquiry proceeds.

2. High-trust access to high-value IP needs its own monitoring tier

   Access controls that are fine for a typical employee aren't enough for someone who can single-handedly reach the company's most sensitive, most monetizable work product. That access level should carry proportionate monitoring — not surveillance for its own sake, but genuine anomaly detection on what that specific access touches.

3. Financial and lifestyle anomalies are a real, underused signal

   A sudden, cash-heavy six-figure purchase by someone in a position like this is exactly the kind of low-tech signal that insider-risk programs in cleared/sensitive industries are supposed to catch. It wasn't caught here, and that gap is fixable at relatively low cost compared to everything else on this list.

4. External tips deserve independent follow-through, not internal sign-off

   If Trenchant had simply accepted its own internal investigation's conclusion and the FBI hadn't kept pushing, this likely never surfaces. When an external party flags a concern, treat that as a reason to investigate independently — not a cue to produce a reassuring internal report and consider the matter closed.

5. Escalation discipline has to include containment, not just confrontation

   Being directly confronted by law enforcement didn't stop the behavior here, because confrontation alone isn't containment. An organization in this position should be moving in parallel to suspend access, preserve evidence, and involve legal — not just wait to see what an interview produces.

6. The money an insider makes is rarely close to what the theft actually costs

   Williams's roughly $1.3 million take against an estimated $35 million loss is a reminder that insider IP theft isn't a rational trade for the victim organization to simply write off as a cost of doing business — the asymmetry between what's stolen and what it's sold for is exactly why this kind of theft is so damaging and so hard to price in advance.

CISO & board lessons

• Build an explicit, written rule into your incident-response and investigation process: anyone under even preliminary suspicion is automatically recused from leading, overseeing, or receiving unredacted findings from the investigation into that suspicion — and make sure that rule doesn't quietly depend on someone remembering to apply it under pressure.
• For roles with outsized access to your most sensitive, most monetizable IP, treat financial and lifestyle anomaly monitoring as a proportionate control, not an invasive one — the alternative is finding out the same way Trenchant did, from someone else.
• When an external party (law enforcement, a partner, a customer) raises a concern your own systems didn't surface, resist the pull to treat your internal investigation's conclusion as the final word. If the stakes are high enough to warrant the external tip, they're high enough to warrant an investigation your own leadership doesn't control.
• Ask your general counsel and HR function, not just security, how your organization would actually remove someone from oversight of a sensitive matter under suspicion — if the honest answer is "we've never had to think about that," that's the gap to close before you need it.

Action plan

Could this happen in your organization?

• If someone in a senior, highly-trusted role came under suspicion today, is there a clear, pre-existing rule that removes them from any oversight of the resulting investigation — or would that decision be made ad hoc, under pressure, by people who report to them?
• Do you have any monitoring — even basic — for large, unexplained financial transactions or lifestyle changes among employees with access to your most sensitive intellectual property?
• Could your organization actually tell if a small amount of your most valuable IP left incrementally, over years, through a channel that looked like normal authorized use?
• If a law enforcement agency or external partner flagged a concern your own systems hadn't surfaced, would your default instinct be to investigate independently, or to produce a reassuring internal report and move on?
• Does anyone at your organization have access broad enough that, if they decided to misuse it, your current controls genuinely wouldn't catch it for years?
• Who has the actual authority to suspend a senior employee's access pending an investigation — and could that authority be exercised without that employee's cooperation or knowledge?

If this happened to you: what to ask, and what to say

Knowing the lesson isn’t the same as knowing what to do with it Monday morning. A security lead, a CISO, and a customer-facing team each need something different from this incident.