The thing that was so egregious about Solarwinds is that, given their line of business, they were obvious targets for nation state actors. This is similar to an

The thing that was so egregious about Solarwinds is that, given their line of business, they were obvious targets for nation state actors. This is similar to any business that itself is a supplier of highly privileged software to large numbers of clients (e.g. password managers or cloud providers are in the same boat). And while the password example could have been a one-off, everything I've read about Solarwinds says they had a horrendously bad security culture. Bad security cultures are essentially unfixable without a top-down, CEO-driven initiative that places real carrots and sticks for individuals' security posture. Even then, 95% of these initiatives are bullshit, because they boil down to "Security is our top priority! Oh also if we miss our revenue targets a bunch of people are getting fired." I think the CISO's actions were pretty bad, but I also think there are lots of other execs at Solarwinds who are quite happy he's now the sacrificial lamb.