“100% Safeguard”: When Your Security Marketing Becomes Your Legal Exposure

Five U.S. states are now suing a router maker over what it said about its own security. Not over a breach. Not over a data leak. Over marketing claims.

On October 6, the attorneys general of Florida, Iowa, Montana, and Nebraska filed consumer protection suits against TP-Link Systems, joining Texas, which sued in February. The states allege the company misled buyers about how secure its routers are and how separate the company is from China. TP-Link denies the claims and says it will fight them in court. These are allegations, not findings. But the theory of the case should get a board's attention, because it has nothing to do with routers.

The claim that became the complaint

According to reporting on the complaints, the states point to TP-Link's HomeShield marketing, which said the product "covers all security scenarios," and to a website claim, still up as recently as November 2025, of a "100 percent safeguard" for network security. The states argue those statements were misleading because the company's routers had known, serious firmware vulnerabilities, some of which were allegedly exploited by state-backed hackers from China and Russia.

They also allege that some of the named router models no longer receive security updates and lack automatic updates, leaving consumers holding devices that were sold as protected. The complaints seek injunctions, civil penalties, and restitution. Florida's complaint reportedly seeks penalties of $10,000 per willful violation.

Read that again as a director. The legal exposure isn't that the product was vulnerable. Every product is. The exposure is the gap between what the company said about its security and what was true.

This is the compliance-versus-security problem in a new costume

In Cyber Risk Is Business Risk, I argue that passing an audit and being secure are different things, and that the distance between them is where boards get hurt. Here is the mirror image: the distance between your security claims and your security reality is a liability in its own right.

Most companies make security statements constantly. They appear in privacy policies, vendor questionnaires, sales decks, RFP responses, investor filings, and cyber insurance applications. Each one is a representation that someone, someday, may hold you to. "We take security seriously" is harmless. "Industry-leading," "fully protected," "bank-grade," "we encrypt everything" are specific enough to be tested against the facts.

The states' approach is also a reminder that the regulators who can come after you are not just the ones with "cyber" in their name. State attorneys general, the FTC, and the SEC all use deception and disclosure theories. If what you told customers, investors, or partners about security was not accurate, the breach is optional.

The supply chain claim is the second shoe

The suits make a second, separate allegation: that TP-Link overstated its independence from China. The states say, for example, that only 0.5 percent of components at its Vietnam factory, by value, are sourced in Vietnam, with the rest coming from or through China. TP-Link says its U.S.-sold devices are made in Vietnam, that no foreign government owns or controls it, and that it does not and will not share customer network data with foreign governments.

Whoever is right, this is a third-party risk lesson. Reporting on the complaints cites congressional testimony that TP-Link holds at least 60 percent of the U.S. retail market for home and small-office routers. If you have remote workers, branch offices, or a hybrid workforce, there is a real chance this vendor's hardware sits somewhere in your environment, on networks you do not manage, carrying traffic you care about.

Most boards have never been asked whether the equipment their people use at home to reach corporate systems is supported, patched, or even known. That question belongs to the Three Questions framework: What are we protecting? From whom? And how do we know it's working? An unmanaged, unsupported router is a gap in the second and third answers.

What to ask your CISO this week

1. What do we say publicly about our security, and who verified it? Ask for an inventory of security claims in marketing, contracts, privacy policies, and investor materials. Ask who in legal or security signs off before they go out.
2. Where do our claims outrun our controls? If a sales deck says "all data encrypted" and the answer is "most," fix the deck or fix the control, and do it before a customer or regulator finds the difference.
3. What end-of-life hardware touches our business? That includes network gear at branch offices and the home equipment remote staff use. If no one owns the answer, that is itself the finding.
4. Which of our vendors make security promises we are relying on, and what is our recourse if they are wrong? Check contracts for support-lifecycle commitments, not just uptime.
5. Does our cyber insurance application match reality? Misstatements there can cost you coverage at the worst possible moment.

The takeaway

The most expensive sentence in cybersecurity may be a confident one. "100 percent safeguard" reads like marketing until it reads like Exhibit A. Boards cannot make a company invulnerable, but they can insist that what the company says about its security is something it can prove.

The TP-Link cases will take a long time to resolve, and the outcome is not predetermined. The lesson doesn't depend on the verdict: align what you claim with what is true, before someone else does the comparison for you.