At JFrog’s swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development. In this exclusive sit-down interview from the event, former SolarWinds CISO TIM (now CISO in Residence at Team8) sits with JFrog CISO Paul Davis and reflects on the historic 2020 Sunburst breach that reshaped the cybersecurity industry. This conversation has been edited for length and clarity.
PAUL: Tim, you’ve had a remarkable journey. As partner and CISO in residence at Team8, how did you get there? What was your path, and what are you focused on today?
TIM: My path to CISO is different than many. I started as an engineer and wrote a lot of code. I was CTO for a couple of different companies. I had been telling CISOs what to do for about 20 years, and I decided I really should be one. That’s what I came to SolarWinds for. The first four years went swimmingly. All my crazy ideas were pretty good, and no little event occurred, right?
PAUL: And then the attack?
TIM: Yeah, Sunburst. As I said, it was a wake-up call for the industry.
On December 12th, 2020, I got a call that every CISO dreads. I got a call from my CEO, and essentially he said, “Mandiant just called us, and you shipped tainted code, and that tainted code is being exploited. The press knows, and it’s going to go public on Sunday.”
Our engineering team started looking. It wasn’t in source code—it had never been in source code. But we found three products or versions of the product produced between February and June that contained the code. We went back to our sales team and support team to figure out how many customers downloaded this thing, and 18,000 customers had downloaded those versions.
On that Saturday, I coined it a “build supply chain attack.” Why? Because it wasn’t in source code control, but somehow got into the product. We didn’t know how yet, so we called it a “build supply chain issue.” We found out more a little later, but that’s how we categorized it first.
The next day, I learned that SolarWinds was part of the big supply chain for everybody. We were part of the power grid, nuclear facilities, every military in the world, and 499 of the Fortune 500. It was spread out everywhere, so that payload could have been whatever it wanted to be.
We started the investigation, and DLA Piper, who was our external legal counsel, has an incredible crisis management team. That was one of our first calls. Legal comes in, and then through legal you hire CrowdStrike, KPMG, and Krebs Stamos. You hire different entities through that platform of legal, and then you start your investigation.
I had dealt with hundreds of little incidents before—a vulnerability in a product was an incident. We have 50 products and 300,000 customers, so we get vulnerabilities in products; my team handles them, we follow a process, and everything gets recorded. But this was of such scope and scale. When it went public on Sunday, it was on 60 Minutes, across the globe, and in every news outlet.
We were forced into being very transparent. We were as transparent as possible to explain how they accomplished the attack, what it looked like, how it flowed, and what we knew at that point in time. Communication became extremely important.
PAUL: CISOs are human, but this incident must have changed you personally. You went through litigation, and now CISOs have to consider personal liability insurance. How did it change you and your team?
TIM: First, I wanted to fix the problem and hoped I would be allowed to. Back then, the standard playbook after an event like this was to fire the CISO and move on. But because of my background in engineering and architecture, I had the skills needed to lead a recovery.
On December 13th, my job changed completely. I had to rely on my team to operate independently under tremendous pressure. In the first 30 days, I lost 25 pounds from working constantly. At the same time, while my Christmas was ruined, I also ruined Christmas for 18,000 customers who had to investigate if they were affected.
Then came the legal phase. The SEC looked to use us as an example to establish precedent by enforcement. After depositions and investigations, in September 2023, they issued a Wells Notice charging the company and me personally. That was the first time a CISO had ever been charged by the SEC.
My legal fees were over $1 million, which SolarWinds covered. But it alarmed the CISO community, sparking discussions with boards about whether companies would back their CISOs during an incident.
When I was charged, I was in Zurich and ended up having a heart attack. I had a 75% blockage in one artery and 90% in another. While sitting in the hospital bed, I thought about whether to sign a settlement paper to make it go away. The document claimed I was negligent, incompetent, and ran a bad security program. If I had signed it, I would have paid a $50,000 fine and walked away. But if I signed that paper, every CISO who experienced a security event in the future would be held personally liable. So I refused to sign it, and the company didn’t settle either. We fought for another three years.
Last December, the case against both SolarWinds and me was completely dismissed with prejudice, meaning it cannot be recharged. The SEC achieved their goal of elevating the CISO role and forcing board-level conversations, but we won our vindication in court.
PAUL: As we look at agentic code generation and protecting environments, have we learned the lessons, or do we still have gaps?
TIM: Some of the lessons have been learned. Pre-incident, SolarWinds was running at a 92% renewal rate and doing really well. Post-incident, it dropped to the 80s. We were sold to private equity about a year and a half ago, and our renewal rate got back up to 99% with our best quarters ever. We made a full recovery.
We accomplished that recovery by being exemplary in how we build, making sure people realized we took the incident seriously and were as resilient to this type of attack as possible. That took invention, new processes, and assuming breach across everything. It required not trusting people just because they were employees. We didn’t find an insider, but if I were going to execute this attack, it would definitely be through an insider.
How do we build resilience inside our systems? We externalized the build system completely. We moved it to AWS, defined it all in code (which it wasn’t before), assumed breach, and eliminated single points of failure.
For Orion, we now run three builds before we ship:
- Development Build: Roughly 400 people have access
- Staging Build: 36 people have access
- Production Build: Only 2 people have access
No single person has access to all three builds. The point is, we made it extremely difficult for anyone to compromise the build.
PAUL: In today’s world, it’s not necessarily a rogue person—it could be an agentic AI agent that doesn’t know what “rogue” means and goes off on its own.
TIM: Absolutely. Managing non-human identities (NHIs) was a key topic last year. As CISOs, we manage our paranoia. With the rush to push code, security needs to understand how you manage and protect those identities. AI models want to make you happy, but without proper guardrails and sandboxing, they can be clever, sneaky, and hallucinate. It requires a true partnership between security and developers.
PAUL: Time to exploit has shifted from weeks to hours, making annual audits and questionnaires obsolete. As software providers and JFrog partners, is moving faster with automated perspectives essential for tomorrow’s world?
TIM: 100%. As software producers, we must produce better software. As consumers, we must test more using agentic pen-testing and tools that adversaries use against us.
I don’t believe this is going to end the world. We’ve managed hundreds of thousands of vulnerabilities for years using firewalls, WAFs, and perimeter protections to limit reachability. But the baseline for good security hygiene has bumped up significantly. Doing what you did three years ago leaves you 100% exposed today. We must invest in proper controls before getting popped from the outside.
PAUL: Do you have any final words of wisdom for this audience of developers, security teams, and DevOps leaders?
TIM: Many CISOs came up through governance or security tooling rather than software engineering, so help them understand your world. They aren’t dumb; they just need help understanding software architecture risks.
Communicate openly with your security teams and executives about where real risks exist in the build pipeline. Ensure that risk gets captured on the risk register so the organization can address it. CISOs can be your greatest partner in moving security forward if you engage them directly.
