In October 2023, the SEC did something unprecedented: they charged a Chief Information Security Officer personally for fraud. Not the company. Not the board. The CISO.
Timothy Brown, the security chief at SolarWinds during the massive SUNBURST breach, found himself facing potential civil penalties, disgorgement of profits, and a bar from serving as an officer or director at any public company — ever.
The message was clear: individual accountability had arrived in cybersecurity.
Then, in July 2024, a federal judge threw out most of the SEC’s case. The court called the company’s public security claims “non-actionable corporate puffery.” By late 2024, the remaining charges were dismissed with prejudice. Brown still has his job.
So the SEC lost. Case closed, right?
Not quite.
The Precedent That Matters
The SolarWinds case revealed something boards should pay attention to: the gap between what companies say publicly about their security posture and what they know internally.
The SEC’s surviving claims — before the final dismissal — centered on SolarWinds’ public “Security Statement” on their website. Internally, Brown had flagged the company’s security as “very vulnerable.” Externally, the company touted “sound security processes, procedures, and standards.”
That disconnect is what kept the case alive as long as it did.
And while boards weren’t personally targeted in SolarWinds, the downstream exposure is escalating. Research from WTW shows that companies experiencing a cyber event see their D&O claim risk jump from 5% historically to 68% post-breach. In 2024 alone, Google settled for $350 million, Zoom for $150 million, and Okta for $60 million — all tied to cyber-related shareholder claims.
The CISO Insurance Gap
Here’s where it gets uncomfortable for boards.
According to Heidrick & Struggles’ 2023 Global CISO Survey, 38% of CISOs are not covered by their organization’s D&O insurance. Another 18% don’t even know if they’re covered.
That’s more than half of the people responsible for your company’s cybersecurity operating without a safety net — or unaware whether one exists.
A 2024 BlackFog survey found that 70% of security professionals would be more hesitant to take a CISO role given the current legal climate. Some are already finding workarounds: one industry advisor now tells CISOs, “Don’t take the CISO title. Take ‘Director of Information Security,’ get paid the same, and reduce your liability.”
When your security leaders are engineering their titles to avoid personal exposure, you have a governance problem.
The Case That Actually Sent Shockwaves
SolarWinds got the headlines, but the case that changed behavior was Uber.
In 2022, Uber’s former CISO, Joe Sullivan, was criminally convicted — not civil charges, criminal — for concealing a data breach during an ongoing FTC investigation. That’s potential prison time, not just fines.
The combination of Sullivan’s conviction and the SEC’s aggressive posture on SolarWinds has fundamentally shifted how CISOs think about their roles. They’re no longer just technical leaders. They’re personal liability targets.
Is our CISO covered under D&O insurance?If you don’t know, find out before your next meeting. The cost to add one person to an existing policy is minimal compared to the exposure.
The Bottom Line
The SEC lost the SolarWinds case, but the era of individual accountability in cybersecurity isn’t over — it’s just beginning. Your CISO is now a personal liability target, and more than a third of them are operating without protection.
That’s not their problem to solve. It’s yours.
