Corporate attorneys see myriad lessons from the Securities and Exchange Commission's decision to sue SolarWinds and its security chief, Tim Brown, over a colossal 2019-2020 data breach.

But one of those lessons is not that the SEC is going to Monday morning quarterback how companies handle every run-of-the-mill hack, essentially rubbing salt in the wound by micro-analyzing how a firm protected itself and how it managed every twist and turn of the response.

For regulators to get involved, allegedly egregious behavior is required, say the attorneys, whose views are shaped partly by the very direct guidance provided by top agency enforcement officials.