-
No. 002
Cover-Yourself 8-Ks
When the SEC required four-business-day incident disclosure, firms responded with “cover yourself 8-Ks.” Organizations don't respond to regulatory intent — they respond to regulatory incentives.
-
No. 001
The Faster-Is-Better Assumption
The assumption behind mandatory breach disclosure timing is that faster equals better. Across 1,054 breach events and three empirical channels, that assumption doesn't hold up well.