He's probably protected because of qualified privilege: https://www.law.cornell.edu/wex/defamation

They would have to prove that he was malicious in writing the article and since it's his job to write articles about security, they're going to have a real hard time doing that.