SolarWinds SUNBURST: Breach Impact & Remediation Strategy

Independent case study Strategy Operations Technology & systems

I treated the 2020 SolarWinds supply-chain attack as a consulting engagement: what did it cost the business, why did it happen, and what should a similar company do about it, in what order, and at what cost?

About this project. This is an independent case study built entirely from public sources (SEC filings, court and government reports, and press coverage). It was not a client engagement and I have no affiliation with SolarWinds. The “client” in my recommendations is a hypothetical mid-sized software vendor, and the cost ranges for the roadmap are my own planning assumptions, not vendor quotes.

The Problem

In 2020, attackers compromised the way SolarWinds built its Orion software and used its trusted update channel to reach customers. SolarWinds notified about 33,000 Orion customers, and fewer than 18,000 were believed to have installed the tainted update. The U.S. government identified 9 federal agencies and about 100 private companies as compromised.

The business question: for a company that ships software the same way, how much could an incident like this cost, and where should leadership invest first to reduce the risk?

My Approach

Built a fact base. Collected the timeline and scale from SolarWinds’ own statements, government briefings, and reporting.
Quantified business impact. Pulled disclosed costs from SolarWinds’ SEC filings and the class action settlement notice, and tracked the stock reaction.
Analyzed root causes across technology, process, people, and governance, separating established facts from SEC allegations.
Prioritized remedies. Scored eight recommendations on impact and effort, mapped them to CIS Controls v8, and plotted a prioritization matrix.
Built a 30/60/90-day roadmap with estimated costs and a cost-versus-risk comparison.
Communicated it. Wrote a 2-page executive memo and a 10-slide leadership deck.

Key Findings

$52.6M

gross incident expenses SolarWinds disclosed for 2020–2021

$26M

securities class action settlement, expected to be covered by insurers

~35%

stock decline by end of December 2020, per the SEC

<1/3

share of 2021 gross expenses covered by SolarWinds’ $15M cyber insurance

The breach turned a technical weakness into a financial, legal, and regulatory event: direct costs, a shareholder suit, and an SEC action that was largely dismissed in 2024 and ended in 2025 without any admission of wrongdoing.
The SEC alleged SolarWinds’ public statements about its security practices did not match internal assessments. Those are allegations, and I treated them that way in the analysis.
My recommended program costs an estimated $1.2M–$2.8M, roughly 2–5% of the gross expenses SolarWinds disclosed. The comparison is illustrative, not a probability estimate.

Recommendations

#	Action	CIS v8	Est. cost	Timing
R1	Harden build pipeline: ephemeral, parallel builds; signed steps; SBOM	16	$600K–$1.2M	Pilot by day 90
R2	MFA and privileged-access controls on VPN, admin, and build systems	5, 6	$80K–$200K	Days 0–30
R3	Secrets vaulting, credential rotation, enforced password policy	5	$40K–$120K	Days 0–30
R4	Remote access only from managed, compliant devices	12, 13	$100K–$300K	Days 31–60
R5	Central logging and detection across dev, build, and release systems	8, 13	$250K–$600K	Days 31–90
R6	Framework baseline, independent testing, board-level reporting	18	$75K–$200K	Days 31–60
R7	Incident-response plan, tabletop exercise, security-to-disclosure process	17	$50K–$150K	Days 0–30
R8	Review cyber and D&O insurance limits against realistic loss	n/a	$10K–$30K	Days 0–30

What I Learned

Framed security as a business decision. Leadership responds to cost, risk, and sequencing, so I translated technical gaps into dollars and created a phased plan.
Separated facts from allegations. A good majority of the root-cause story comes from an SEC complaint that was largely dismissed, so I labeled each claim by how well it was established.
Trusted channels deserve the most scrutiny. The update mechanism that customers relied on became the primary attack path, which changed how I think about third-party and vendor risks.
Assumptions must be explicit. My cost ranges are estimates, so I flagged them clearly and showed how they feed the comparison.

Deliverables

Executive memo (PDF) Leadership deck (PDF) Deck (PowerPoint) Memo (Word)

SolarWinds SUNBURST: Breach Impact & Remediation Strategy

The Problem

My Approach

Key Findings

Recommendations

What I Learned

Deliverables

Sources