Loading story…
The U.S. Securities and Exchange Commission (SEC) has dismissed its lawsuit against SolarWinds and its Chief Information Security Officer, Tim Brown, a decision that has been met with widespread relief among cybersecurity leaders. The case, which followed the high-profile SolarWinds supply chain breach, had placed significant scrutiny on the personal and professional accountability of CISOs, raising concerns about the risks faced by security executives in the wake of major cyber incidents. Industry experts note that while the dismissal alleviates immediate legal pressure, it does not eliminate the broader challenges and responsibilities that CISOs continue to face regarding cybersecurity governance and risk management.
The outcome of the lawsuit is seen as a potential turning point in how regulators, boards, and executives approach cybersecurity accountability, emphasizing the need for shared responsibility across organizations. However, experts caution that the legal and regulatory landscape remains uncertain, and future policy shifts could once again place CISOs under regulatory scrutiny. The case has also sparked discussions about the structural tensions in cybersecurity leadership, particularly the gap between responsibility and authority for security professionals in large organizations.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The U.S. Securities and Exchange Commission dismissed its lawsuit against SolarWinds and its CISO, Tim Brown. The decision was widely viewed by cybersecurity leaders as reducing immediate personal legal risk for CISOs, even as broader liability concerns remained unresolved.
Joe Sullivan's conviction became an earlier high-profile example of personal legal exposure for security leaders. The case later served as a point of comparison in discussions about CISO accountability in the SolarWinds matter.
The tainted Orion updates distributed SUNBURST malware to thousands of organizations, including U.S. government agencies. The campaign significantly expanded the impact of the original SolarWinds compromise.
In 2019 and 2020, Russian threat actors compromised SolarWinds' Orion software supply chain, laying the groundwork for the SUNBURST backdoor campaign. The intrusion became one of the most consequential software supply-chain attacks on record.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Securities and Exchange Commission (SEC) has officially dropped its high-profile lawsuit against SolarWinds and its Chief Information Security Officer, Timothy Brown, which alleged that the company misled investors about its cybersecurity practices prior to the 2020 SUNBURST supply chain attack. The SEC, SolarWinds, and Brown jointly requested the court to dismiss the civil enforcement action, with the SEC stating the dismissal was at its discretion and not indicative of its stance on other cases. The lawsuit, filed in 2023, accused SolarWinds and its CISO of failing to disclose cybersecurity weaknesses between the company's IPO in 2018 and the discovery of the SUNBURST attack in December 2020, which allowed Russian state actors to compromise the Orion IT management software and breach numerous high-profile organizations and U.S. government agencies. SolarWinds expressed relief and satisfaction with the outcome, emphasizing that the facts demonstrated appropriate conduct by its security team and hoping the resolution would alleviate concerns among CISOs about personal liability in similar cases. The SEC's action had previously sparked significant debate within the cybersecurity community, with many leaders warning of a potential chilling effect on security disclosures. The SUNBURST attack, attributed to Russia's Cozy Bear, resulted in approximately 18,000 organizations downloading compromised software, with about 100 suffering further breaches, including major corporations and several U.S. federal departments. The conclusion of the lawsuit marks a significant moment in the ongoing discussion about corporate cybersecurity accountability and regulatory oversight.
Jun 29, 2026
Legal exposure for **CISOs** is increasing as regulators and courts treat cybersecurity leadership as an executive accountability function rather than a purely technical role. The reporting argues that high-profile actions tied to **SolarWinds** and **Uber** have made personal liability, board documentation, and **D&O insurance** considerations central to the job, with security leaders facing scrutiny not just for breaches but for how risks were communicated and governed. The coverage is **not fluff** because it addresses a substantive governance and litigation trend with direct implications for cyber risk management, executive oversight, and disclosure practices. Both articles present the same argument: the long-sought "seat at the table" has brought greater authority but also the possibility that regulators may single out named security executives when cyber incidents expose gaps between internal knowledge, public statements, and board-level accountability.
Jun 29, 2026
A widely discussed resignation letter, purportedly from a Chief Information Security Officer (CISO), has sparked debate within the cybersecurity community about the structural challenges CISOs face. The letter, whether factual or illustrative, highlights recurring issues: CISOs are often denied necessary resources, must document and escalate risks, and are later held solely accountable when breaches occur due to known vulnerabilities. This situation underscores the persistent tension between security leaders and executive boards, where risk is frequently accepted quietly and accountability is enforced retroactively, leading to burnout and career uncertainty for CISOs. Industry commentary suggests that the root of these challenges lies not in individual failings but in organizational structures and communication practices. When cybersecurity is framed as a technical rather than a business issue, the burden consolidates on the CISO. Experts advocate for a shift toward transparent, business-oriented risk communication and shared accountability between CISOs and boards. This approach aims to transform the CISO's role from a reactive firefighter to a proactive steward of risk, fostering sustainability and trust within organizations.
Jun 29, 2026