Scholar4AI

← Research ideas

SeedPublished 2026-10-23

Four days to disclose a cyberattack

Cybersecurity appears on 159 recent papers, most of them in AI journals about detection; only 22 carry a disclosure, reporting or investor keyword, and "cybersecurity disclosure" on 6. Since 2023, US firms must report material cyber incidents within four business days. What do they report, and what do markets learn?

accountingfinancecybersecurity

What prompted this

Since October 2025, 159 papers carry a cybersecurity, cyber-risk, data-breach or cyberattack keyword (58 in AI journals, 47 in finance, 26 in management, 12 in accounting): "cybersecurity risks" on 39, "data breaches" on 10, "cybersecurity disclosure" on 6. Only 22 of the 159 also carry a disclosure, SEC, reporting, internal-control, investor or firm-value keyword.

Questions

  • Since the four-day rule, how many incidents are disclosed as material, how quickly, and what do firms say about the financial effect?
  • Do stock prices react more to the first disclosure or to later updates, and do firms that disclose faster lose less value?
  • Has the rule changed cyber insurance pricing or firms' investment in security?

Data that could help

Item 1.05 disclosures from 8-K filings since December 2023, breach notification records held by state attorneys general, stock returns and cyber insurance rates.

Next step

Collect all 8-K cyber incident disclosures since the rule took effect, code their timing and content, and measure the stock reactions.

Related research activity

The keywords this note follows, in the tracked finance, accounting, economics, management, operations research and AI journals as of 2026-10-26
KeywordPapers, last 30 daysRankPapers per month, Oct 23 – Oct 26*Papers, last 36 months
cybersecurity disclosure0–10
data breaches1#288130
cybersecurity risks4#52569

Markdown version of this note: /ideas/cybersecurity-incident-disclosure.md

← Data centres and the grid · The first reports under the EU sustainability directive →

Cite this page

Scholar4AI. (2026). Four days to disclose a cyberattack. Journal Research Rankings. Retrieved October 23, 2026, from https://scholar4ai.com/ideas/cybersecurity-incident-disclosure

@misc{scholar4ai-ideas-cybersecurity-incident-disclosure,
  author = {{Scholar4AI}},
  title = {Four days to disclose a cyberattack},
  year = {2026},
  howpublished = {\url{https://scholar4ai.com/ideas/cybersecurity-incident-disclosure}},
  urldate = {2026-10-23},
  note = {Journal Research Rankings; data from OpenAlex (CC0); licensed CC BY-NC 4.0}
}

Free to reuse for non-commercial purposes with attribution (CC BY-NC 4.0).