If you are a publicly traded software company, and your customers access your product through a server, and you provide them with a default password to log into the server, and the default password is “password,” is that securities fraud? You know the answer!

Yesterday the US Securities and Exchange Commission sued “software company SolarWinds Corporation and its chief information security officer, Timothy G. Brown, for fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities.” SolarWinds sells network management software to companies and governments, including “an information technology infrastructure and management platform” called Orion. In 2020, Orion was famously hacked by Russian state actors, who inserted hidden code into Orion software updates and were “then able to remotely exploit the networks and systems of SolarWinds’ customers,” which they used “for the primary purpose of espionage.”