The SEC has signaled that it is willing to scrutinize the way companies handle cybersecurity risk and incidents. The SEC is charging SolarWinds and its CISO with fraud and internal control failures. It alleges that the company "misled investors by disclosing only generic and hypothetical risks."