The SEC's cybersecurity disclosure rules — effective December 2023 — produced more than 180 material incident filings in their first twelve months, establishing the regulatory baseline for what constitutes reportable enterprise risk in an environment where AI shortcuts and third-party vulnerabilities now trigger federal disclosure obligations. The rules require Item 1.05 Form 8-K filings within four business days of determining a cybersecurity incident is material, a threshold that proved lower than most general counsels anticipated.

The filing pattern shows a concentration in financial services and healthcare, sectors with dense customer data exposure, but also notable appearances from industrial and consumer names previously silent on digital risk. CB Financial Services filed after an employee used an unauthorized AI tool that exposed transaction data — the first 8-K explicitly naming generative AI as the incident vector, and a template for the next wave of operational disclosure. Median time to filing was 3.2 days, suggesting counsel errs toward speed over precision when materiality is borderline. The SEC granted zero extensions for national security delay in year one, a signal that the carve-out threshold is higher than most boards assumed.

What matters is the secondary effect on D&O pricing and audit committee workload. Insurers are already requesting cyber incident response plans as a condition for renewal, and boards without formal breach protocols saw premium increases averaging 18% in 2024. The disclosure obligation isn't just a reporting burden — it's a forcing function for enterprise risk infrastructure that many public companies lack. Audit committees at mid-cap names are adding cybersecurity specialists at twice the rate of mega-caps, a reversal of the usual governance diffusion pattern. The firms that filed early and cleanly saw minimal stock impact; the ones that waited or amended saw average drawdowns of 4.7% in the ten days post-filing.

Operators should track three near-term events. The SEC's Division of Corporation Finance is expected to release interpretive guidance on AI-related incidents by mid-2025, clarifying whether employee use of unauthorized tools qualifies as a "cybersecurity incident" under the rule's definition. Second, the first enforcement action for late or inadequate 8-K filing is likely before Q3 2025, setting the penalty baseline. Third, cyber insurance carriers will complete their repricing cycle by year-end 2025, meaning current renewals reflect incomplete actuarial data — expect another round of increases.

The cleanest play is the firms that filed in the first ninety days, disclosed cleanly, and saw no material business impact — they've now stress-tested the process and know their actual exposure.