a certified vendor is a safe vendor

what everyone assumed

You cannot audit every vendor yourself, so you rely on the signals that exist for exactly this reason: a signed SOC 2 report, an ISO certificate, a clean audit. Those signals mean someone competent looked and found the controls in place. When a vendor clears that bar and signs its releases, applying the update is the responsible thing to do, the thing your own auditors want you to do. Trusting a certified vendor is not negligence. It is the process working as designed.

what happened

Around September 2019, an intruder gained access to SolarWinds’ internal network and spent time understanding how the company built its Orion product. Between roughly March and June 2020, malicious code later named Sunburst was inserted into legitimate Orion software builds, and SolarWinds distributed those compromised updates to its customers. The updates were signed with SolarWinds’ own valid code-signing certificate, so every downstream security check said they were authentic. For most of a year, the backdoor sat inside a product that had passed its audits, shipping to customers who had done everything their own compliance frameworks asked of them.

how it surfaced

The security firm FireEye detected an intrusion in its own systems in December 2020, traced it back through the supply chain, and on December 13, 2020, the compromise was disclosed publicly. Up to roughly 18,000 SolarWinds customers had downloaded a version of Orion containing the backdoor, though the intruder pursued a much smaller set of high-value targets from there. The certifications had all been real. The audits had all been passed. The assumption retired itself the moment a signed update from a certified vendor turned out to be the delivery mechanism. In 2023, the SEC would charge SolarWinds and its security chief with misleading investors about the company’s security posture.

A certification tells you a vendor met a standard at a point in time.

It does not tell you the vendor has not been compromised, because a signed, audited, certified product is exactly what an attacker wants to ship through. The paperwork is a floor.