SEC Cyber Incident Disclosure Statistics: What 8-K Item 1.05 Filings Show

Nearly three years after the SEC's cyber incident disclosure rule took effect, the number of Form 8-K filings under Item 1.05 "Material Cybersecurity Incidents" is far smaller than the number of incidents companies disclose, because most now report under Item 8.01 instead. This page counts what US public companies have actually filed on EDGAR since 18 December 2023, shows how the mix between Item 1.05 and Item 8.01 changed after the SEC staff statement of May 2024, and explains how often first filings are later amended. It is for CISOs, disclosure committee members, general counsel and incident responders who need a factual baseline for their own disclosure decisions. The rule itself is explained in the SEC Cybersecurity Disclosure Rules Guide; this page does not repeat it.

Last reviewed: November 2026.

Key takeaways

• Item 1.05 filings are rare. Our EDGAR full-text search counted 39 Form 8-K or 8-K/A filings carrying the "Material Cybersecurity Incidents" caption in 2024, 17 in 2025 and 27 from 1 January to 7 November 2026.
• The May 2024 SEC staff statement changed behaviour. In 2024, 24 of the 39 Item 1.05 filings came in January to May and 15 in June to December, after the SEC's Division of Corporation Finance asked companies to use Item 8.01 for incidents not yet judged material.
• Item 8.01 is now the common route. Filings mentioning both "cybersecurity incident" and "Item 8.01" numbered 31 in 2024, 22 in 2025 and 33 in 2026 to 7 November, outnumbering Item 1.05 filings in every year after 2024.
• Many first filings are amended. 14 of 39 Item 1.05 filings in 2024 were 8-K/A amendments, as were 4 of 17 in 2025 and 6 of 27 in 2026, reflecting the rule's requirement to amend when impact information becomes available.
• Annual disclosure is far more common. Our 2025 EDGAR search found 6,355 Form 10-K filings matching "Item 1C" and "Cybersecurity", showing that risk management disclosure reaches thousands of annual reports while incident filings stay in the tens.

How these figures were produced

All counts on this page are NHI Mgmt Group tallies from the SEC's EDGAR full-text search, run on 8 November 2026. EDGAR full-text search returns an exact hit count for each query. We used these queries:

Limits: full-text search matches words, not the XBRL item tag, so a filing that cites Item 1.05 without its caption is missed, and an Item 8.01 filing that mentions an earlier cybersecurity incident in passing is included. Treat the figures as close indicators, not an official register. We did not find an official SEC count of Item 1.05 filings. Repeat the queries with the same terms to refresh this page.

Item 1.05 filings by year

The Form 8-K requirement applied from 18 December 2023 for most registrants, with smaller reporting companies given an additional 180 days, according to the SEC's adopting press release (2023-139). Item 1.05 filings are due within four business days of the company determining that an incident is material, and the adopting release (33-11216) requires that determination to be made without unreasonable delay.

A cross-check search for the phrase "Item 1.05" across the whole period returned 97 Form 8-K documents: 3 in 2023, 41 in 2024, 20 in 2025 and 33 in 2026. The small difference from the caption-based count comes from filings that refer to Item 1.05 without repeating its caption, including some that explain why they are not filing under it. Either way, the order of magnitude is the same: a few dozen material incident filings a year across thousands of US registrants.

The two partial-year windows illustrate how 2026 compares: 27 caption-matched filings in just over ten months of 2026 already exceeds the 17 in all of 2025, so the decline from 2024 has not continued.

Item 1.05 versus Item 8.01

On 21 May 2024 Erik Gerding, Director of the SEC's Division of Corporation Finance, issued a statement saying Item 1.05 is for incidents a company has determined to be material, and suggesting Item 8.01 for incidents with no materiality determination yet or judged immaterial. The statement says Item 1.05 "is not a voluntary disclosure" and that the staff did not intend to discourage voluntary disclosure. If an incident later becomes material, the company must file under Item 1.05 within four business days of that determination.

Monthly pattern in 2024

Source: EDGAR full-text search, NHI Mgmt Group tally by filing date, November 2026. The first five months of 2024 average 4.8 filings a month; the last seven average 2.1. Monthly counts include 8-K/A amendments, so a month can rise when several earlier incidents are updated. In 2025 the monthly count never exceeded four (October), and in 2026 the highest month so far is July with seven.

Amendments and follow-up filings

The adopting release lets a company file Item 1.05 before the full impact is known, provided it states what is not yet determined and later files an amendment. Gerding's statement repeats this: a company that judges an incident material before knowing its impact should file under Item 1.05, say so, and amend once the information is available.

The falling amendment share suggests that companies now filing under Item 1.05 more often do so once impact is clearer, while early uncertainty is handled through Item 8.01. That is an interpretation, not a fact stated by the SEC.

Timing rules behind the numbers

• Four business days: runs from the materiality determination, not from discovery of the incident (SEC press release 2023-139).
• Without unreasonable delay: the determination itself must be made without unreasonable delay after discovery (Release 33-11216, Instruction 1 to Item 1.05).
• National security delay: disclosure can be delayed if the US Attorney General determines immediate disclosure poses a substantial risk to national security or public safety and notifies the SEC in writing. The release allows an initial delay of up to 30 days, a further period of up to 30 days, and in extraordinary circumstances a final delay of up to 60 days for national security.
• Annual disclosure: Regulation S-K Item 106 requires a description of cybersecurity risk management, strategy and governance in the annual report, from fiscal years ending on or after 15 December 2023. In Form 10-K this appears as Item 1C, which is why our 2025 query returned 6,355 matching annual reports.

Where identity fits

The SEC staff statement lists qualitative materiality factors such as harm to reputation and to customer and vendor relationships, and those often turn on what an attacker could reach. Disclosure committees need fast answers to identity questions: which accounts and service credentials were used, what they could reach, and whether they have been revoked. A current inventory of non-human identities and their owners shortens the four-day clock in practice. See the Stolen credential breaches lessons.

What the numbers mean for defenders

• Expect to file under Item 8.01 first: the data shows most companies disclose an incident before deciding materiality. Prepare an Item 8.01 template as well as an Item 1.05 template.
• Document the materiality decision: the clock starts at the decision, so record when the disclosure committee met, what it knew and why it decided as it did. See the SEC Cyber Disclosure Executive Briefing.
• Plan for an amendment: about a quarter to a third of Item 1.05 filings are amendments, so build the follow-up into the incident plan. See the Incident Response Plan Template.
• Benchmark peers by searching EDGAR yourself: the queries above take minutes and show how companies in your sector worded their filings.
• Measure your own readiness: time from detection to materiality decision; time from decision to filing (target four business days or fewer); percentage of incident playbooks with a disclosure step; percentage of critical service credentials with a named owner.

Framework mapping

Practitioner checklist

• Keep both an Item 1.05 and an Item 8.01 draft template approved by counsel.
• Name the disclosure committee members and their deputies, with out-of-hours contacts.
• Record the timestamp and reasoning of every materiality determination.
• Include qualitative factors from the SEC staff statement (reputation, customer and vendor relationships, litigation) in the materiality assessment.
• Build an amendment step into the incident plan for impact information that arrives later.
• Maintain an inventory of human and non-human identities with owners so access scope can be confirmed quickly.
• Review peer filings on EDGAR twice a year and update templates.
• Rehearse the four-business-day timeline in a tabletop exercise each year.

Standards and references

• SEC: Release 33-11216 Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
• SEC: Press Release 2023-139 SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
• SEC: Statement by Erik Gerding on Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents
• SEC: EDGAR Full-Text Search, Material Cybersecurity Incidents in Form 8-K
• SEC: EDGAR Full-Text Search, Item 8.01 cybersecurity incident filings
• SEC: EDGAR Full-Text Search, Form 10-K Item 1C Cybersecurity

Related NHI Mgmt Group resources: SEC Cybersecurity Disclosure Rules Guide · SEC Cyber Disclosure Executive Briefing · Cyber Incident Reporting Requirements Map · Board Cyber Risk Reporting Guide