The Securities and Exchange Commission's mandatory cybersecurity incident disclosure rule generated 162 Form 8-K filings in its first twelve months, converting what had been discretionary breach announcements into a hard compliance deadline. The rule, effective July 26, 2023, requires all SEC-registered public companies to file within four business days of determining that a cyber incident is material. The volume represents a baseline, not a ceiling—most filings came from mid-cap and large-cap issuers with mature incident-response teams already in place.

The four-day clock starts when a company concludes an incident meets the materiality threshold, not when the breach occurs. That window has compressed legal review, board notification, and cyber-insurance coordination into a single workflow. Early filers included healthcare systems, financial services platforms, and software vendors—sectors where customer data exposure translates directly to litigation risk. Notably, zero filers requested the national security delay provision the SEC built into the rule, suggesting either that incidents did not meet that bar or that companies preferred disclosure over the procedural burden of seeking a postponement.

The rule's first-year data creates three pressure points for allocators. First, it has widened the spread between companies with pre-built incident-response infrastructure and those scrambling to hire outside counsel after a breach. Second-quartile filers—companies that disclosed between days three and four—showed materially higher legal and remediation costs in subsequent 10-Q filings than those disclosing on day one or two. Second, cyber insurance premiums for public companies rose an average of 18% in the six months following the rule's adoption, according to wholesale broker surveys, as carriers repriced policies to reflect the new disclosure liability. Third, the rule has made cybersecurity preparedness a line-item discussion in shareholder meetings and analyst calls, pulling what had been an IT budget conversation into the investor relations function.

Operators should track three follow-on developments over the next six months. The SEC is expected to issue interpretive guidance on materiality thresholds by Q2 2025, clarifying whether certain incident types—ransomware without data exfiltration, for example—automatically trigger the filing requirement. Meanwhile, plaintiff-side law firms have begun citing Form 8-K cyber filings as admissions in securities litigation, creating a new discovery vector in breach-related class actions. Finally, cyber-insurance carriers are embedding 8-K filing timelines into policy terms, with some issuers now requiring policyholders to notify underwriters within 24 hours of determining materiality, two full days ahead of the SEC deadline.

The 162 filings in year one will not be the long-run average. As incident-response playbooks mature and materiality standards clarify, the number will rise. The companies that have not yet filed are the ones allocators should worry about.