The INTEL
SEC 8-K cyber filings are a weak guide to how large cyber losses get. Of 205 incidents reported on 8-Ks since the 2023 SEC rule, the filing companies assessed only 6% as material or likely material, and only 22 included any estimate of financial impact, according to the Cyentia Institute’s analysis of filings tracked by Board Cybersecurity.
Cyentia’s IRIS Xtreme 2026 analyzed the 205 incidents in aggregate:
- Materiality: 7 assessed as material and 5 as likely material by the companies themselves; the other 94% were not material or still under evaluation
- Loss figures: 22 of 205 gave an estimate; Cyentia calls that sample “more of a curiosity than a basis for credible model parameters”
- Reputation: appears as a “possibly material” impact in 2 of the 205
- Operations: 91 of the 205 (44%) describe at least one operational impact, most often disruption to business operations and system outages
Cyentia also found “little overlap between ‘material’ and ’extreme’ events”: the incidents filed as material are mostly a lower tier than the costliest events in the study.
Why It Matters
Public disclosures are an easy input for a risk assessment, and the 8-K rule made them more visible. But Cyentia describes the 8-K record so far as “as much a record of regulatory uncertainty as it is a record of genuine material risk,” reflecting cautious early filing under a new rule and estimates that were often not updated.
That doesn’t make the filings useless. They are a good record of how incidents hit operations: outages, order fulfillment, production. What they don’t provide yet is a reliable basis for sizing losses. Loss data from confirmed events does that better.
The reputation finding is worth a second look too. Reputational damage often drives where cyber scenarios sit on a risk register, yet companies flagged it as possibly material in 2 of 205 filings.
What To Do — One Key Action
Use public disclosures for what they show well, operational impact, and size losses from outcome data such as loss studies by revenue band. If a scenario on your risk register is ranked mainly on reputational impact, check what evidence supports that ranking.
MITRE ATT&CK
- Not technique-specific. This INTEL is about the evidence used to size cyber risk.
Learn More
- IRIS Xtreme 2026 (Cyentia Institute) — Primary source; SEC 8-K analysis (pp22–24, Figure 15)
- FIR Risk Tuesday E96 — The Costliest 5%: What Confirmed Losses Teach Us About Planning — Full analysis
- FIR Risk INTEL-49 — Plan for the Tail, Not the Average — Sizing losses by revenue band
Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.