SEC Ends SolarWinds Suit After Major Legal Setbacks

By Chris Riotta for BankInfoSecurity
Saturday, November 22, 2025

• 514
• More

The agency's approach quickly became a flashpoint for security leaders and corporate counsel who warned the case could stretch securities law far beyond its traditional boundaries. By targeting Brown directly and leaning on internal controls provisions to challenge day-to-day security program decisions, the SEC signaled a willingness to hold individual executives responsible for gaps that many saw as operational rather than financial in nature.

"For obvious reasons, the SEC did not want to take a risk in this highly publicized and closely watched case, instead preserving its resources for upcoming lawsuits where it can prevail in court with certainty," said Ilia Kolochenko, CEO of the application security firm ImmuniWeb and vice chair of the American Bar Association's Information Security Committee.

Kolochenko warned that security leaders should not view the dismissal as protection from personal exposure, saying "it would be imprudent to believe that the risk of personal liability for data breaches has now vanished." He added that even a friendlier federal climate may not prevent agencies like the Federal Trade Commission, Federal Communications Commission or the SEC from pursuing major data protection failures "while being much better prepared after its SolarWinds experience."

Analysts say the outcome reflects a change in leadership at the commission. The SEC's posture on cybersecurity enforcement was shaped largely by President Joe Biden, when a Democratic commission majority backed more aggressive enforcement actions. They drew criticism from Republican commissioners Hester Peirce and Mark Uyeda, who argued the agency was overreaching and relying on hindsight. Read Full Article