Free tools Windows power users keep installed
One-click scans. No signup required.
A federal judge dismissed most of the SEC’s claims against SolarWinds and its chief information security officer in July 2024, but allowed claims tied to the company’s website Security Statement to proceed. That was a partial dismissal, not the end of the case: on November 20, 2025, the SEC and defendants filed a joint stipulation dismissing the action with prejudice.
What did the judge dismiss in the SolarWinds SEC case?
In an order dated July 18, 2024, U.S. District Judge Paul A. Engelmayer granted in part and denied in part SolarWinds Corp. and CISO Timothy G. Brown’s motion to dismiss the SEC’s amended complaint. The decision concerned whether the SEC had plausibly stated claims; it was not a trial or a final determination of disputed facts. Read the court’s opinion.
| Claim category | July 2024 outcome |
|---|---|
| Alleged securities fraud based on SolarWinds’ website Security Statement | Survived the motion to dismiss. |
| Securities-fraud and false-filing claims based on other public statements and securities filings | Dismissed. |
| Claims based on disclosures after the SUNBURST compromise | Dismissed. |
| Internal accounting-controls and disclosure-controls claims | Dismissed. |
The SEC’s complaint alleged misleading cybersecurity statements before and after the SUNBURST compromise, including statements on SolarWinds’ website, in marketing materials and filings, and in post-incident reports. It also alleged internal-controls violations. Those descriptions were allegations in the complaint, not findings that the defendants had violated securities law.
Why did the Security Statement claims survive?
The court concluded that the SEC had plausibly pleaded securities-fraud claims based on SolarWinds’ website Security Statement. Those claims were allowed to continue past the motion-to-dismiss stage; that ruling did not establish that the statement was false or that SolarWinds or Brown was liable.
The court treated promotional statements in press releases, blogs, and podcasts differently, describing them as “non-actionable corporate puffery.” The distinction was among the statements and claim theories pleaded—not a ruling that every cybersecurity statement by a company is legally immaterial.
What did the judge say about post-SUNBURST disclosures?
Judge Engelmayer dismissed claims based on the company’s post-incident disclosures, writing: “These do not plausibly plead actionable deficiencies in the company’s reporting of the cybersecurity hack. They impermissibly rely on hindsight and speculation.” The court’s point was that the SEC had not plausibly alleged actionable deficiencies in those disclosures through the theories presented in its complaint.
The order evaluated the pleadings, not evidence after a trial. Its reasoning should therefore be read as a decision about whether those allegations stated claims, rather than as a factual finding that every post-incident disclosure was accurate.
Did the 2024 ruling interpret the SEC’s cybersecurity disclosure rules?
No. The opinion stated that the SEC’s 2023 cybersecurity disclosure rules were not implicated because the case concerned conduct predating their effective date. The decision is not an interpretation of those later rules.
Rank #3
How did the case end?
The July 2024 order left the Security Statement claims alive, so it did not itself terminate the litigation. On November 20, 2025, the SEC announced that it and SolarWinds and Brown had filed a joint stipulation dismissing the civil action with prejudice. The SEC characterized its decision as made “in the exercise of its discretion” and said it “does not necessarily reflect the Commission’s position on any other case.” The release does not give a more specific explanation for the decision. See the SEC’s litigation release.
Dismissal with prejudice ended this action; it does not mean the court found the defendants innocent, that the SEC conceded its allegations were false, or that the SEC announced a general change in enforcement policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Case timeline and context
- October 30, 2023: The SEC filed the enforcement case against SolarWinds and Brown in the Southern District of New York.
- July 18, 2024: Judge Engelmayer dismissed most claim categories but let the claims based on the website Security Statement proceed.
- November 20, 2025: The SEC and defendants filed a joint stipulation dismissing the remaining action with prejudice.
The 2024 opinion recited complaint-derived background figures: Orion accounted for 45% of SolarWinds’ revenue during the first nine months of 2020, and SolarWinds had more than 300,000 customers, including 499 Fortune 500 companies, during the relevant period. These figures appear in the opinion’s account of the complaint; they were not statistics independently established at trial.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
