SEC action raises the bar on software transparency

The SEC announced nearly $7M in penalties against Unisys ($4M), Avaya ($1M), Check Point ($995k), and Mimecast ($990k) for inadequately disclosing the material impacts of the SolarWinds/SunBurst supply chain attack, signaling tougher enforcement of cyber incident materiality and 8-K/10-K reporting rules. The article urges publicly traded companies to strengthen incident response, third‑party risk oversight, and software supply chain detection with modern binary analysis and reproducible builds, and promotes ReversingLabs’ Spectra Assure as a solution.