CISO Risk Dumpster Fires

The talk opens by framing a run of recent SEC actions against companies and their security leaders as the public fallout of breaches. The speakers use two casino operators hit by the same attacker as an example: they filed very different disclosures, and the one reporting larger losses had written far less in its filing. They then explain how SEC investigations often begin with tips, how the agency can compel testimony and documents, and how inquiries stay private until charges are filed.

The middle section covers the rules. Public companies must report material cyber incidents on a form 8-K within four days, and the speakers expect repeated corrective filings as facts change. New York's financial regulations overlap with the SEC rules and sometimes diverge from them. The SEC whistleblower program is growing, and agreements that discourage employees from speaking to regulators can draw enforcement, even at private companies.

For security leaders, the advice centers on written communication and personal exposure. Internal chat and email can be read later as evidence of intent, so sarcasm and casual admissions need care. Leaders should confirm their title and reporting line, check indemnification and insurance coverage for themselves, and document budget or staffing requests that were refused. Reading other companies' 8-K filings is suggested as a practical way to learn from their incidents.