SEC Dismisses SolarWinds Lawsuit: What CISOs Need To Know

The original lawsuit against SolarWinds, filed in October 2023 following the massive 2020 SUNBURST cyberattack, alleged that the company and its CISO misled investors about security practices and subsequently downplayed the incident's scope. The case was a rare instance of the SEC directly targeting a CISO, sending chilling effects throughout the industry. The dismissal, stipulated by the SEC, SolarWinds, and the CISO without admission of wrongdoing, concluded this years-long legal battle. Although the SEC noted that the dismissal was an "exercise of its discretion" and does not necessarily reflect its position on any other case, it is nearly impossible not to interpret the decision as signaling an adjustment to the SEC's approach to cybersecurity disclosures.