Cybersecurity incident disclosure
Cybersecurity incident disclosure obligations for Technology, AI, and Competition sector firms have tightened considerably, driven by the U.S. Securities and Exchange Commission's 2023 final rule requiring public companies to report material cybersecurity incidents within four business days of determining materiality. The U.S. Cybersecurity and Infrastructure Security Agency and the European Union Agency for Cybersecurity are each advancing parallel notification frameworks that create overlapping timelines compliance teams are now reconciling across jurisdictions. For technology firms operating in AI and data-intensive markets, the gap between a security event and a defensible disclosure is shrinking fast.
Watch
- SEC 4-business-day materiality clock: how courts are testing the standard
- EU NIS2 Directive incident reporting thresholds take effect for digital infrastructure operators
- CISA's proposed mandatory cyber incident reporting rule under CIRCIA, rulemaking still open
- AI system breaches: whether SEC disclosure duties extend to model compromise events
- FTC enforcement posture on delayed consumer notification in data breach cases
Recent material activity in Technology, AI & Competition
A selection of recent published briefs; this is not a complete archive.
US CISA Cybersecurity release pending Cresthaven Analytics full analysis: KEV addition: CVE-2026-87902 — WordPress Core (WordPress Core Remote File Inclusion Vulnerability)
US CISA Cybersecurity published a regulatory release titled 'KEV addition: CVE-2026-87902 — WordPress Core (WordPress Core Remote File Inclusion Vulnerability)'. Cresthaven Analytics' full intelligence brief is pending r…
Read a full sample brief →CISA adds Microsoft SharePoint code injection flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 28 2026
CISA added CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint, to its Known Exploited Vulnerabilities catalog on September 25, 2026. The addition triggers mandatory remediation obligations for federal…
Read a full sample brief →CISA adds MikroTik RouterOS behavioral-workflow vulnerability to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 28 2026
CISA added CVE-2026-67279, an improper enforcement of behavioral workflow vulnerability in MikroTik RouterOS, to its Known Exploited Vulnerabilities catalog on September 25, 2026. The vulnerability permits an unauthentic…
Read a full sample brief →Canada Competition Bureau release pending Cresthaven Analytics full analysis: Competition Bureau to publish a call for information on pricing rules in retail grocery
Canada Competition Bureau published a regulatory release titled 'Competition Bureau to publish a call for information on pricing rules in retail grocery'. Cresthaven Analytics' full intelligence brief is pending re-analy…
Read a full sample brief →UK CMA Competition release pending Cresthaven Analytics full analysis: Macquarie Asset Management / Energy Assets Group merger inquiry
UK CMA Competition published a regulatory release titled 'Macquarie Asset Management / Energy Assets Group merger inquiry'. Cresthaven Analytics' full intelligence brief is pending re-analysis; see the source link below …
Read a full sample brief →CMA publishes interim market study update on early years education and childcare services in England
The CMA published a market study update on September 25, 2026, covering evidence gathered since the study launched on July 1, 2026. The update sets out findings to date and signals how the CMA's analytical thinking is de…
Read a full sample brief →China's SAMR publishes antitrust penalty decisions against two Chongqing municipal gas distributors for cartel conduct
The State Administration for Market Regulation published administrative penalty decisions by the Chongqing Municipal Market Supervision and Administration Bureau against two piped-gas enterprises in Jiangjin District. Th…
Read a full sample brief →China's SAMR publishes five administrative penalty decisions against Tibet concrete firms for cartel conduct
The Tibet Autonomous Region Market Supervision and Administration Bureau concluded a monopoly-agreement investigation against five concrete enterprises, including Linzhi Lantian Concrete Co. Ltd. The investigation opened…
Read a full sample brief →CISA adds Adobe Commerce and Magento authorization flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 27 2026
CISA added CVE-2026-71362, an incorrect authorization vulnerability in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog on September 24, 2026. The vulnerability allows unauthenticated privilege …
Read a full sample brief →CISA adds WSO2 path traversal vulnerability to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 27, 2026
CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on September 24, 2026. The vulnerability is a path traversal flaw affecting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gate…
Read a full sample brief →