Political leaders are no longer speaking the language of seamless globalisation; they are describing a world defined by fragmentation, strategic rivalry and coercion below the threshold of war. They are calling out in plain terms that the era of frictionless integration is over and the era of managed competition has begun.
Technology companies operate in that same environment. Their customers face strategic pressure. Their supply chains are scrutinised. Their markets are politicised. In such a fragmented system, speaking plainly about state-linked coercion is not only strategically responsible; it is commercially smart.
A recent Strategist article by Justin Bassi highlighted that within days, two major US technology firms took different approaches to describing a global cyber campaign. Palo Alto Networks referred to unnamed actors—reportedly out of concerns that the firm or its clients could face retaliation. Whereas Google’s Threat Intelligence Group publicly assessed that China conducts more cyber threat campaigns by volume than any other country, including operations targeting defence suppliers and next-generation technologies such as drones and uncrewed systems.
The inconsistency carries commercial consequences as serious as its geostrategic implications.
Technology companies now trade on credibility. Whether building cybersecurity platforms, AI systems, hardware or cloud infrastructure, their value proposition rests not only on technical performance but on judgement: on independent analysis, transparent governance and a willingness to state what the evidence supports.
As ASPI analysts highlighted in a November report titled In Whose Tech We Trust, trust in technology is not just about efficacy; it is about institutional posture—governance, supply-chain integrity, alignment with democratic norms and resilience under pressure. Leaders across the global technology sector are now publicly advancing this orientation too, including in initiatives such as the Trusted Technology Alliance initiative which was launched at the recent Munich Security Conference and which seeks to embed trust as a defining characteristic of next-generation products and services.
In such a system, if public assessments—including the attribution of state-linked activity—are seen to vary according to geopolitical exposure or commercial calculus, customers, partners and governments will inevitably ask where risk management ends and strategic avoidance begins. Technical excellence alone will not suffice; credibility under pressure is becoming a critical market differentiator.
In a purely transactional market, silence might appear safer. But the global technology market is no longer purely transactional. Governments are re-evaluating supply chains. Critical infrastructure operators are scrutinising vendor exposure. Defence customers are assessing not just technical capability, but institutional posture. Standards are increasingly geopolitical.
The commercial question is therefore straightforward: is it caution or clarity that protects long-term value for technology firms?
In that environment, firms that demonstrate consistent, evidence-based attribution have an opportunity to build reputational capital in democratic markets. Conversely, perceived accommodation carries costs that are harder to reverse. Once customers suspect that reporting may be softened to protect market access, trust decreases. Even if the underlying analysis remains rigorous, the perception of constraint undermines the brand. Silence, if interpreted as self-censorship, is difficult to unwind.
This is not about moral grandstanding; it is about market share.
Defence and critical infrastructure customers are increasingly integrating security, governance and geopolitical exposure into procurement decisions. Insurance markets are adjusting risk models. Investment screens are expanding to include political and regulatory exposure. In that ecosystem, firms that can demonstrate institutional independence and consistency have an advantage.
As Bassi’s article notes, Google’s own history illustrates the tension. Its abandoned Project Dragonfly initiative exposed internal strain between market ambition and corporate values. The proposal was shelved in 2018.
Importantly, it proved to be an aberration rather than a trajectory. Recently, through its Threat Intelligence Group Google has explicitly framed attribution as part of helping democratic governments and industry ‘stay ahead’ of digital threats. That is a striking posture for a commercial firm: positioning transparency about state activity not merely as disclosure, but as a contribution to collective resilience. It is also investing heavily in disrupting state-enabled scam networks and fraud infrastructure that exploit the same coercive digital ecosystem. That posture is not cost-free. For sure, attribution at scale carries diplomatic and commercial consequences.
This is not to suggest that internal tensions have disappeared or that any firm is uniquely virtuous. Multinationals operate under enduring structural pressure in contested markets and remain accountable to shareholders. But institutional learning matters. It means recognising that long-term credibility in key democratic markets—and alignment with the security expectations of those governments—can ultimately carry greater strategic and commercial value than short-term insulation from coercive pressure.
As fragmentation deepens, markets are sorting. Democratic governments are building trusted supplier frameworks. Partnerships such as AUKUS are embedding security criteria into advanced capability development. Customers are asking not only ‘Can this firm deliver?’ but ‘Can this firm withstand pressure?’
Governments have a role in shaping the incentive structure that underpins such clarity. Procurement settings can reward consistent transparency. Trusted supplier regimes can differentiate firms that demonstrate evidence-based attribution and governance resilience. Collective signalling can reduce the individual exposure any single firm faces when naming state-linked activity.
Industry, in turn, should recognise that shared standards reduce vulnerability. Just as alliances distribute risk among states, collective clarity distributes risk among firms. When multiple leading companies speak consistently, the cost of retaliation against any one actor rises.
In a world explicitly described by political leaders as competitive and coercive, calling activity by its name is no longer only a matter of principle; it is a signal of institutional strength. Over time, that strength translates into trust, and trust translates into contracts, access and influence.
Under pressure, transparency is not just the right thing to do. It is a durable commercial strategy.
