SolarWinds
| Company type | Public (formerly), Private (since April 2025) |
|---|---|
| Industry | Software, IT management |
| Founded | January 1, 1999 Tulsa, Oklahoma, U.S. |
| Founder | Donald Yonce, David Yonce |
| Headquarters | Austin, Texas , United States |
Area served | Worldwide |
Key people | Sudhakar Ramakrishna (CEO) |
| Products | Orion, AppOptics, Pingdom, Papertrail, Loggly, MSP Manager software, remote monitoring, email security, database performance monitoring |
Number of employees | 1,770 (2015) |
| Website | solarwinds |
SolarWinds Corporation is a U.S.-based software firm that focuses on managing network, system, and IT infrastructure. Its headquarters are located in Austin, Texas, with sales and development teams distributed throughout the United States and abroad. Established in 1999 by brothers Donald and David Yonce, SolarWinds has expanded through a series of acquisitions, operating subsidiaries such as Pingdom, Papertrail, and Loggly. By December 2020, the company supported roughly 300,000 clients, which included nearly every Fortune 500 company as well as several U.S. federal government agencies.
The company's primary offering, Orion, which is utilized by about 33,000 customers across both public and private sectors, was at the center of a widely publicized cyberattack on U.S. federal government systems in 2020. This breach remained undetected for several months and is regarded as one of the most complex cyber intrusions ever recorded. In February 2021, Microsoft President Brad Smith characterized it as "the largest and most sophisticated attack the world has ever seen." Despite this incident, SolarWinds continues to prioritize broadening its product range and reinforcing its standing within the IT management software market.
History
SolarWinds began operations in 1999 in Tulsa, Oklahoma, founded by Donald Yonce—formerly an executive at Walmart—and his brother Dave Yonce. The company’s initial products, Trace Route and Ping Sweep, were released in March 1998, followed by the introduction of its first web-based network performance monitoring tool in November 2001. In 2006, SolarWinds moved its main office to Austin, Texas, where by 2011 most of its employees were located. The company maintained profitability from its inception through its IPO in 2009.
In 2007, SolarWinds attracted investment from Austin Ventures, Bain Capital, and Insight Venture Partners. It went public with a $112.5 million IPO in May 2009, closing above the initial share price—an achievement notable during a period when few technology firms were entering the stock market following the recession. After the IPO, Bain Capital and Insight Venture Partners divested some shares but retained ownership stakes.
Following its public offering, SolarWinds pursued expansion through acquisitions. CEO Bennett retired in 2010 and was replaced by former CFO Kevin Thompson. By 2013, the company had established an operational center in Salt Lake City, Utah, employed around 900 people, and was honored by Forbes as "Best Small Company in America" due to its affordable products and growth trajectory.
In late 2015, private equity groups Silver Lake Partners and Thoma Bravo, LLC acquired SolarWinds for $4.5 billion, taking it private again. At that point, the organization had about 1,770 employees worldwide and generated nearly $500 million in annual revenue.
November 2017 saw the launch of AppOptics, a consolidated software-as-a-service platform that integrated offerings such as Librato and TraceView while supporting compatibility with Amazon Web Services and Microsoft Azure.
SolarWinds filed for another public offering in September 2018 and completed its IPO on October 19 of that year.
On December 7, 2020, CEO Kevin Thompson stepped down; he was succeeded by Sudhakar Ramakrishna—previously CEO of Pulse Secure—starting January 4, 2021. Soon after this leadership change, SolarWinds enlisted former CISA director Chris Krebs to assist with efforts to recover cybersecurity integrity.
In July 2021, SolarWinds separated its managed service provider (MSP) division into a distinct publicly traded company called N-able.
In February 2025, private equity firm Turn/River Capital announced its purchase of SolarWinds for $4.4 billion—a transaction approved by majority shareholders Thoma Bravo and Silver Lake. The acquisition was finalized on April 18, 2025 at $18.50 per share, resulting in SolarWinds' removal from the New York Stock Exchange.
Acquisitions
SolarWinds has pursued a business model centered on providing free downloadable tools to draw in users, subsequently promoting premium editions via trial offers. After securing funding in 2007, the company expanded its portfolio by acquiring Neon Software and ipMonitor Corp., while also establishing a European sales presence through an office in Ireland.
Post its 2009 initial public offering, SolarWinds acquired Kiwi Enterprises, based in New Zealand. By 2011, when it ranked tenth among Forbes' fastest-growing technology firms, the company further grew by purchasing virtualization management specialist Hyper9 and network security provider TriGeo for $35 million. This period also saw operational expansion into Post Falls, Idaho, complementing existing locations in Dallas, Salt Lake City, Tulsa, and international offices in Australia, the Czech Republic, India, Ireland, and Singapore. In 2012, acquisitions included EminentWare, a patch management vendor, and RhinoSoft, which brought FTP Voyager into SolarWinds' product lineup.
The year 2013 marked the acquisition of N-able Technologies, a cloud IT services firm, for $120 million and Confio Software, a database performance management company, for $103 million. These deals added a London sales office and Confio’s Ignite software to SolarWinds' assets. Between 2014 and 2015, SolarWinds acquired Pingdom, a Swedish web monitoring company; Librato, a San Francisco-based metrics provider for $40 million; and Papertrail, a log management service purchased for $41 million.
From 2015 through 2020, SolarWinds broadened its offerings by acquiring several companies: Capzure Technology (MSP Manager software), LogicNow (remote monitoring), SpamExperts (email security), Loggly (log management and analytics), Trusted Metrics (threat monitoring), Samanage (IT service desk and asset management), VividCortex (database performance monitoring), and SentryOne (database management). These strategic acquisitions enhanced SolarWinds’ global footprint, diversified its product range, and solidified its position within the IT management solutions market.
SUNBURST
On December 13, 2020, multiple U.S. government entities experienced breaches linked to compromised updates of SolarWinds' Orion platform. According to an SEC filing by the company, fewer than 18,000 out of approximately 33,000 Orion customers were impacted by malicious updates issued from March to June 2020. Attackers gained elevated privileges by exploiting superuser access to SAML token-signing certificates, allowing them to create forged tokens that granted extensive network permissions. In response, the Cybersecurity and Infrastructure Security Agency issued an emergency directive instructing federal agencies to disable Orion software installations.
This cyberattack was attributed to APT29 (also known as Cozy Bear), an advanced persistent threat group associated with Russia’s SVR intelligence agency. High-profile victims included cybersecurity firm FireEye; the U.S. Treasury Department; the National Telecommunications and Information Administration within the Department of Commerce; and the Department of Homeland Security. Internationally affected parties under investigation encompassed NATO, the European Parliament, UK government bodies including the NHS, as well as AstraZeneca. FireEye identified the malware involved as SUNBURST; Microsoft labeled it Solorigate.
The breach leveraged a backdoor embedded within a SolarWinds software library by injecting malicious code into trusted update packages. Notably, weak FTP credentials ("solarwinds123") had been reported as early as November 2019 but were not adequately addressed. Further reports highlighted that SolarWinds lacked a chief information security officer at the time and had inadvertently exposed employee passwords publicly during 2019.
SolarWinds disclosed the breach to the SEC on December 15 but continued distributing compromised updates before promptly revoking affected digital certificates. By December 17, the company announced intentions to revoke these certificates by December 21. German IT media noted that SolarWinds had advised customers to disable anti-malware defenses prior to installation.
Attorney General William Barr confirmed Russia as the probable source of the attack, contradicting President Trump's suggestion of Chinese involvement. Later in December 2020, cybersecurity firm Trustwave revealed additional vulnerabilities within SolarWinds software products that raised further security alarms.
Financially, insurers projected losses related to this cyber incident would exceed $90 million by early 2021. On March 1, 2021, CEO Sudhakar Ramakrishna partially attributed the breach to an intern's insecure password practices; however, cybersecurity experts emphasized this was indicative of systemic weaknesses in SolarWinds’ overall security culture rather than an isolated mistake.
Following the incident, scrutiny also focused on Microsoft’s involvement due to a "golden SAML" vulnerability in its directory services exploited during the attack. Concerns were raised regarding Microsoft's transparency about this flaw and government procurement decisions involving its software products. Senator Ron Wyden notably criticized the absence of warnings about this hacking method despite significant federal investments in Microsoft technologies.
SUPERNOVA
On December 19, 2020, Microsoft disclosed a second supply chain attack targeting SolarWinds, separate from the previously identified SUNBURST malware incident. This newly discovered threat was designated SUPERNOVA.
Palo Alto Networks characterized SUPERNOVA as a covert malware variant that involved minimal modifications to the Orion platform's source code, enabling the deployment of a web shell used as a remote access tool. The web shell is constructed dynamically in memory during runtime, which minimizes its forensic detectability.
In contrast to SUNBURST, SUPERNOVA did not possess a digital signature, indicating it likely originated from a different adversary.
Insider trading allegations
Following the public revelation of the SUNBURST compromise, SolarWinds’s stock value declined by 25% within several days and approximately 40% after one week. Prior to the breach announcement, insiders sold shares worth nearly $280 million, although these transactions took place months after the initial intrusion. According to an official company statement, those who sold shares had no knowledge of the breach at the time of their sales.
Microsoft advisory on attacks targeting service providers and downstream businesses
In November 2021, Microsoft issued a warning concerning the advanced persistent threat actor Nobelium (also known as APT29 or Cozy Bear), which was responsible for the 2020 SolarWinds supply chain compromise. Nobelium targeted cloud service providers (CSPs), managed service providers (MSPs), and other IT service firms. Microsoft’s Threat Intelligence Center (MSTIC) released guidance aimed at helping these service providers and their downstream clients defend against such threats.
Class action litigation
A class action lawsuit was initiated against SolarWinds in January 2021, citing security lapses and the subsequent decline in share price. Although SolarWinds moved to dismiss the case, a judge permitted it to proceed in March 2022. The matter was resolved with a $26 million settlement in November 2022. Following this, the Securities and Exchange Commission (SEC) informed the company of its intention to pursue enforcement actions related to the breach.