By not investigating the underlying weakness in Microsoft software that was key to the SolarWinds hack, the Cyber Safety Review Board missed an opportunity to prevent future attacks, experts say.