SolarWinds Securities Enforcement Case: The Security Promises Behind a Dismissed Action

The Securities and Exchange Commission ended the SolarWinds securities enforcement case through a November 20, 2025 agreement to dismiss its cybersecurity disclosure action against the company and its chief information security officer. The agency had alleged a gap between what SolarWinds promised publicly and what its engineers, audits and internal presentations said about security. If you work on those systems or disclosures, that gap may be familiar: a warning inside the business and an assurance still going out.

This page follows the SolarWinds allegations and the agreement that ended the action. Our broader account of cybersecurity disclosure and controls cases compares how security information reaches management, investors and decisions about client assets.

Why SolarWinds’ Security Promises Mattered to Investors

SolarWinds sold software that businesses and government agencies used to monitor and manage their computer networks. The SEC’s original complaint described Orion as its flagship platform, accounting for 45% of company revenue in 2020. Customers installed the company’s software to help run their own systems, making the supplier’s security practices part of the product they were buying.

The complaint alleged that SolarWinds used its public Security Statement to answer customers’ questions about cybersecurity. Employees sent links to the statement when explaining how the company reduced the risk of cyberattacks. The Securities and Exchange Commission connected those assurances to investors through the business itself: cybersecurity failures could damage sales and revenue, and securities analysts considered customers’ views when assessing the stock.

The action named both SolarWinds and the executive responsible for its overall security program. According to the complaint, the executive served as vice president of security and architecture during the alleged conduct and became chief information security officer in January 2021. The SEC alleged that he helped create and approve the Security Statement, acted as a cybersecurity spokesperson and signed certifications used by executives preparing SEC reports.

The Security Statement Promised Practices Employees Said Were Missing

The SEC alleged that the website’s Security Statement misrepresented how SolarWinds developed software, enforced passwords and limited access to its systems. It also challenged the company’s claim to follow the National Institute of Standards and Technology cybersecurity framework. The complaint supported those allegations with internal assessments, audit findings, presentations and messages.

Secure Development Was Still Being Introduced

The Security Statement said its secure development lifecycle included security testing throughout the software development process. According to the complaint, an engineering manager told senior managers that SolarWinds did not do some of the things the statement described. His January 2018 email then described work still to come:

The complaint alleged that the mismatch continued into 2020, when engineers questioned whether the Orion Improvement Program, a component of Orion, followed the promised secure development process. The exchange included an engineer’s view that the component was not covered and was forwarded to the chief information officer and the security executive. In the SEC’s account, engineering still had to introduce what the website promised. We call that a promise ahead of the product.

Password and Access Claims Met the Audit File

The complaint alleged that SolarWinds promised complex passwords across its systems while internal audits found shared database login credentials and passwords stored in plain text in configuration files. An audit shared with the chief information officer identified those problems, and later reviews continued to flag unmet password requirements. The SEC alleged that the public Security Statement stayed unchanged despite those findings.

Access controls raised a separate, practical question: who could enter a system and what could they do there? The Security Statement said access followed the least privilege necessary for an employee’s job. The SEC alleged that SolarWinds routinely granted unnecessary administrator rights, giving employees broader powers than their work required.

The complaint also described a network engineer’s warning about employees connecting to the corporate network from computers and phones the company did not manage. According to the SEC, that access could bypass monitoring designed to detect data leaving the company. The engineer’s presentation reached the security executive, but the vulnerability was neither fixed nor raised with the disclosure committee as the complaint said it should have been.

For an insider, those are different records with different jobs. The audit describes the password problem, the access review shows who held permissions, and the presentation and its recipients show where a warning went. We compare those records with the public assurance they may contradict.

Customer Incidents Became a Disclosure Allegation

The Securities and Exchange Commission alleged that attackers inserted malicious code into Orion software builds that SolarWinds distributed to customers. In the complaint’s account, the code created a backdoor into customer networks when infected software was installed on systems connected to the internet. The agency described additional attacks on approximately 100 companies and government agencies through SUNBURST.

The disclosure allegations depended on what SolarWinds learned as customer reports arrived. According to the complaint, a federal agency reported suspicious Orion activity, and a cybersecurity company later reported similar behavior. SolarWinds employees allegedly recognized similarities internally while telling the cybersecurity customer they had not seen that activity before. The complaint quotes the employee’s message to a colleague during the customer call:

The SEC alleged that another cybersecurity customer eventually identified the malicious code and shared it with SolarWinds. According to the complaint, the security executive then connected that code to the earlier customer incidents. Those internal connections were central to the SEC’s challenge to what SolarWinds told investors next.

SolarWinds disclosed the SUNBURST attack in a December 14, 2020 Form 8-K, a report used for specified events. The SEC alleged that its language presented successful exploitation as something still being investigated even though the company already knew of earlier attacks using the vulnerability. The complaint attributed approximately a 35% stock-price decline by the end of that month to the disclosures and reporting about the company’s preexisting security problems.

The SEC Challenged Both Statements and Internal Controls

The original complaint challenged several kinds of communication: the website Security Statement, public promotions, risk disclosures in SEC filings and the announcement of SUNBURST. Its allegation about the filings was that SolarWinds repeated hypothetical risk language while internal information described known vulnerabilities and attacks.

The original complaint also accused SolarWinds of failing to guard its systems and source code, and failing to get significant security information to the executives preparing investor reports. The agency alleged that the security executive helped the company commit both failures.

One concrete allegation concerned the company’s incident response plan. The complaint said only incidents affecting multiple customers moved upward to management responsible for disclosure, leaving important issues unreported. It alleged that the earlier customer incidents were treated separately even after security staff had linked them.

That distinction matters to someone inside the business. A record showing that an engineer recognized a connection answers one question. A record showing that the connection reached the people approving investor statements answers another. Our securities fraud evidence page follows those comparisons across internal records and public representations.

How the SolarWinds Action Ended

The Securities and Exchange Commission and both defendants agreed to end the action permanently over the conduct covered by its revised complaint up to the agreement’s filing date. In its dismissal announcement, the agency said it chose to end this action and that the decision did not necessarily reflect its position on other cases. We read the allegations alongside the outcome, as we do across securities fraud cases and their official records.

What Your Cybersecurity Records Can Explain

An insider may know how a security finding changed as it moved from an engineering discussion to a management presentation and then to a public statement. The SolarWinds complaint makes those handoffs concrete: audit findings, customer reports, internal messages, risk acceptance forms and approval of disclosure language. We work with you to connect what you knew at the time to the representations the company made.

For securities misconduct, the SEC whistleblower program can pay eligible whistleblowers awards totaling 10% to 30% of qualifying sanctions collected in qualifying actions with sanctions exceeding $1 million. We assess those award questions with you and securities fraud whistleblower lawyers. The work begins with what your information can show about the company’s conduct.

The complaint also alleged that a sales employee misrepresented compliance with a federal security program to persuade a government agency to buy Orion. When a false security promise helps win a government sale, we also assess whether the evidence supports a False Claims Act case. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

You Know What the Security Review Said

Speak to one of our Whistleblower Experts about the security promise the internal review could not support. We build your strongest securities whistleblower case around the systems, statements and decisions you understand, bring in securities fraud whistleblower lawyers with disclosure experience, and stay beside you through the case.