The SEC sued SolarWinds and its security chief, then dropped the case

What happened

On 30 October 2023, the SEC charged SolarWinds Corporation and its chief information security officer, Timothy G. Brown, with fraud and internal-control failures, alleging the company overstated its cybersecurity practices and understated known risks between its 2018 IPO and the December 2020 disclosure of the SUNBURST intrusion. The complaint quoted internal materials, including a 2018 engineering presentation calling remote access 'not very secure' and Brown's own presentations describing the company's security as 'a very vulnerable state.' Nine months later, the district court ruled on the motion to dismiss. Its opinion of 18 July 2024 let one claim proceed: that a public 'Security Statement' on SolarWinds' website, describing specific practices such as password policies and network monitoring, was pled as materially false. It dismissed claims built on other pre-breach statements, on the company's post-disclosure filings, which the court said relied on impermissible hindsight, and on the SEC's internal-controls theory, which it called ill-pled and novel. On 20 November 2025, the parties filed a joint stipulation dismissing the remaining claims with prejudice, ending the case. The SEC's release says the dismissal reflects the exercise of its discretion and does not necessarily bear on any other matter.

Confidence and limits

The SEC's own charging document, the court's own reasoned opinion, and the SEC's own dismissal filing together give an unusually complete documentary record of an enforcement action's full life. What they do not give is a resolution on the merits of the surviving claim: dismissal with prejudice ends the case without a trial, a settlement or an admission, so whether the Security Statement was in fact fraudulent was never tested in court.

Why it mattered

The court's line between what survived and what did not is instructive on its own terms. General statements in podcasts, blog posts and standard risk-factor language were treated as too vague or too routine to support fraud liability, while a specific, itemised public statement about named security controls was not. Post-breach disclosures were measured against what was reasonably known at the time they were made, not against what investigators later learned, and the SEC's attempt to treat cybersecurity weaknesses as an accounting-controls failure did not survive contact with existing accounting law.

Defensive takeaway

Review any public-facing statement describing your organisation's specific security practices, such as a trust page or security statement, for consistency with what your own internal assessments actually say, since specific claims of that kind are exactly what a court here treated as legally actionable.

• Does your public security or trust page make specific claims that internal assessments could contradict?
• Who reviews the gap between internal risk findings and external public security messaging before either is finalised?
• Would your disclosure decisions after an incident be defensible against what was known at the time, not against later findings?

Two years of litigation produced a narrower, more specific answer than the original complaint's broad allegations suggested: courts will weigh a concrete public security claim differently from marketing language or hindsight-driven disclosure critique, and a case can still end in dismissal even after part of it survives a motion to dismiss.