Looking for Smoke Signals in Financial Statements, for Cyber

The talk starts from a familiar problem: headline cost estimates for large breaches at companies such as MGM, UnitedHealth and SolarWinds vary widely, and their financial effects are hard to trace. The presenter points out that since December 2023, US public companies have been required to disclose material cyber incidents in SEC Form 8-K filings, which sit alongside annual 10-K reports. Together these documents form a new body of data that financial analysts already know how to read.

Using MGM as a worked case, the presenter compared the technical threat intelligence usually published after an incident, such as the help desk impersonation and the resulting week-long outage, with the company's financial trends across several years. He described screening filings for cyber terms and reading the surrounding paragraphs for changes in revenue, expenses, debt and operations. He also showed a stock price drop after the filing, reaching a low about 22% below the pre-filing level. Filtering was necessary, since some filings mention cyber only because of a company name.

Audience questions covered disclosure timing, interim updates, how the approach would be tested for false positives, and whether the data could be misused. The presenter said the dataset is still small and predictive testing is not yet complete. For practitioners, the main takeaway is that security leaders can express risk in the financial terms their CFOs use when arguing for budget, and that similar analysis may flag broader signs of organizational stress beyond cyber.