Welcome to the Cybersecurity Disclosure Review

Reading between the lines in 8-K filings and post-mortems

Hello, my name is Joe Robertson and I've been in tech my entire life. When I was 13 years old, my mom used to drive me around town to fix computers. That’s how my technology career got started.

As the years went on, cybersecurity became more important. Eventually, it became all-consuming. In leadership roles, it boiled down to two expectations: make sure the systems work, and make sure we don’t get breached. That’s what executives really cared about.

I’ll be honest, it got to me. I was really good at it. But the stress of securing an environment, making sure everyone (IT and non-IT alike) did their part, and being on call 24/7 in case the worst happened... it added up. Eventually, I started exploring other paths.

These days, I still work in tech and dabble in real estate and other emerging technologies. But I never lost interest in cybersecurity, especially in how the industry communicates after incidents. And let’s be real, it’s generally not good.

In December 2023, the SEC amended its 8-K disclosure requirements to include material cybersecurity incidents. That, along with other public postmortems and breach statements, gives me plenty to write about.

Don't want to show up in one of my articles? You don't have to. Almost every breach was preventable, and the root cause is usually simpler than it sounds.

This newsletter is where I’ll read between the lines and share what I think happened, what could have been done better, and what’s being left unsaid. These are just my opinions. You should always refer directly to the company for the most accurate and current information.

Thanks for reading,
Joe