SolarWinds said it spent more than $3 million on cybersecurity costs in the fourth quarter due to its recent breach and sees security-related expenses of $20 million to $25 million in 2021.
The $20 million to $25 million security-related expenses include initiatives to bolster product defense, remediation, and consulting fees and insurance costs.
The company reported its fourth quarter results and had to address its cybersecurity troubles during the three months ended Dec. 31. SolarWinds said that it would face future cybersecurity costs. The company makes IT, network, systems, and database management software.
SolarWinds’ earnings report has cybersecurity costs broken out a few ways. Under generally accepted accounting, “cyber incident costs” were $3.48 million. Those expenses are also listed at $3.16 million depending on the non-GAAP to GAAP reconciliation.
Recent headlines include:
SolarWinds CEO Sudhakar Ramakrishna said:
The sophisticated cyberattack on us and our customers at the end of the fourth quarter has taught us a great deal about the resiliency of our business, the commitment of our employees, and the support we can expect from our customers and partners.
He added that the investigation into the cybersecurity issues continues and the company will emerge stronger. “We have a strong foundation from which to grow, and to establish a model for the future of the software industry by delivering powerful, affordable, and secure solutions,” he said.
On a conference call with analysts, Ramakrishna said:
The vast majority of the customers that I have spoken to understand that the cyber incident that affected us and others could have happened to any vendor, and especially a broadly deployed vendor like SolarWinds. Equally, they’re eager to see us address the issue and share our learnings which we are doing. The other opportunity that keeps coming up in these discussions is our ability to provide guidance and input to protect the entire environment of our customers as opposed to just focusing on our products, making us a more strategic partner. The majority of our customers that downloaded a version of the affected code have upgraded to our latest version and continue to renew their contracts with us. While the first priority continues to be ensure the safety and security of our customers our conversations with customers and partners have also given us the opportunity to discuss the strength of our entire portfolio and of our future plans.
Ramakrishna added that through Feb. 17, nine federal agencies and about 100 private sector companies were compromised. “While our attitude will always be that one impacted customer is one too many, we currently believe the total number of customers will be significantly lower than what was originally feared,” he said. “We are applying our learnings from this event and sharing our work more broadly. Internally, we are referring to our work as secure by design. And it’s premised on zero trust principles and developing a best-in-class secure software development model to ensure our customers can have the utmost confidence in our solutions.”
As for the fourth quarter results and outlook, it’s clear SolarWinds will take a hit from cybersecurity expenses. SolarWinds reported fourth quarter net income of $132.7 million on revenue of $265.3 million, up 7.2% from a year ago.
For the first quarter, SolarWinds said sales will be between $247 million and $252 million with non-GAAP earnings between 19 cents a share and 20 cents a share. Wall Street was expecting non-GAAP earnings of 21 cents a share on revenue of $252.7 million.
“We expect to incur significant legal and other professional services expenses associated with the Cyber Incident in future periods,” the company said.
Overall, SolarWinds executives said that there will be headwinds due to COVID-19 and the cybersecurity incident, but they are confident in the products and demand in the future.
“We’ve added a level of security and review through tools, processes, automation and where necessary, manual checks around our product development processes that we believe goes well beyond industry norms to ensure the integrity and security of all of our products. We firmly believe that the Orion software platform and related products as well as all of our other products can be used by our customers without risk of the Sunburst malicious code,” Ramakrishna.
