Former SolarWinds CISO Details 2020 Sunburst Build Supply Chain Attack
Tim Brown explains how the 2020 breach bypassed source code controls and impacted nearly 18,000 customers globally.
Key points
- The Sunburst breach involved tainted code that was not present in source code repositories.
- Approximately 18,000 customers downloaded affected product versions released between February and June 2020.
- Tim Brown coined the term "build supply chain attack" to describe how the malicious code entered the product.
Former SolarWinds CISO Tim Brown discussed the mechanics of the 2020 Sunburst breach during an interview at JFrog’s swampUP 2026 conference in New York. Speaking with JFrog CISO Paul Davis, Brown reflected on how the incident reshaped industry approaches to software supply chain security and AI-driven development.
Brown revealed that he learned of the compromise on December 12, 2020, when his CEO informed him that Mandiant had identified tainted code being exploited. The press was aware, and disclosure was imminent. Brown noted that the malicious code had never existed in the source code control system, leading him to categorize it as a "build supply chain attack" that Saturday.
The investigation determined that three product versions produced between February and June 2020 contained the compromised code. Brown stated that his team worked with sales and support to identify that 18,000 customers had downloaded those specific versions. This discovery highlighted a critical gap in traditional security monitoring that focused primarily on source code integrity.
Attack Scope and Response
By December 13, 2020, Brown realized SolarWinds was embedded in critical infrastructure, including power grids, nuclear facilities, and military systems worldwide. The company’s software was also used by 499 of the Fortune 500 companies. Brown emphasized that the widespread presence of the payload meant it could have been modified to perform various malicious functions.
The incident forced SolarWinds into high-profile transparency. Brown said the company had to explain the attack flow and known details to a global audience, including coverage on 60 Minutes. He engaged external legal counsel DLA Piper, which helped hire CrowdStrike, KPMG, and Krebs Stamos to assist with the investigation and crisis management.
Personal and Professional Impact
Brown described the first 30 days of the response as intensely stressful, noting he lost 25 pounds while working constantly. He had to rely on his team to operate independently under extreme pressure. Unlike typical post-breach scenarios where CISOs are dismissed, Brown retained his role due to his engineering and architecture background, which he deemed essential for leading the recovery efforts.
He contrasted this event with hundreds of smaller product vulnerabilities his team handled routinely. The scale of Sunburst, involving 50 products and 300,000 customers, required a different approach. Brown said the experience changed his perspective on personal liability and the importance of communication during a crisis.
What should you do?
Security leaders should review their build pipeline controls to ensure integrity checks are performed at every stage, not just in source code. Organizations must verify that the software they deploy matches the expected build artifacts. Monitoring for anomalous behavior in trusted vendors' products is essential, as supply chain attacks can bypass traditional perimeter defenses.
What to do and how to stay safe: SolarWinds
- Audit your software supply chain to identify any third-party components that may have been compromised during the build process.
- Implement strict verification of build artifacts to ensure they match the expected source code and configuration.
- Monitor for unusual network activity or behavior in software from trusted vendors, as supply chain attacks can mimic legitimate updates.
- Review your incident response plan to ensure it addresses large-scale supply chain compromises and includes clear communication protocols.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the Sunburst breach differ from typical software vulnerabilities?
The Sunburst breach involved tainted code that was not present in the source code repositories, indicating a compromise in the build process rather than the source code itself.
How many customers were affected by the compromised SolarWinds software?
Approximately 18,000 customers downloaded the affected product versions that contained the malicious code.
What term did Tim Brown use to describe the Sunburst breach?
Tim Brown coined the term "build supply chain attack" to describe how the malicious code entered the product without being in the source code control system.
