Rejecting SolarWinds' argument that the website statement claims were not actionable because they were directed at customers rather than investors, the court held that the website security statement could constitute securities fraud because it altered the "total mix of information" available to investors. The court also rejected the SEC's claims that SolarWinds' risk disclosures in its Forms S-1 and 10-K were "unacceptably boilerplate" and "opaque," instead holding that they "enumerated in stark and dire terms the risks the company faced were its cybersecurity measures to fail" and that a reasonable investor "could not have been misled by the risk disclosure." The court similarly dismissed the claims related to the SUNBURST disclosures, finding them "sufficient to alert the investing public," particularly given the "short turn-around" of the filings, the first of which was published "just two days after" discovery of the security vulnerability.