[Material-Incidents] No. 10

Hey everyone,

Back after a couple of weeks off. I’ve been working on a larger analysis that has been taking a bit longer than initially expected, I’m hoping to have an update on that sometime over the next week or two, stay tuned! In the meantime, I was thinking about a newsletter a couple of weeks back on companies that believe they don’t face any cybersecurity risk. This got me thinking about the other end of the spectrum: companies that believe they’re facing extreme security risk. There isn’t a perfect proxy for determining a companies perceived level of risk when looking at 10Ks, outside of ‘we don’t face any cybersecurity risk’. I decided to focus on companies that reference ‘nation state’ or ‘nation-state’ actors in their 10K filings. This isn’t a perfect indicator of perceived risk but mentioning it in your annual 10K likely means your company believes the threat is real. Let’s take a look at the data:

To date there’s been ~4500 10K filings with an Item 1C. Currently, there are 41 filings that mention a ‘nation-state’ or ‘nation state’ risk to their company. Slightly less than 1% of all companies who have made a filing are self reporting a nation state risk 🤔

No surprise the technology sector is leading the pack with ten mentions of nation state threats, with the industrial sector falling close behind with nine. The sectors paint a high level picture, but diving into specific industries (see below) you can see Aerospace and Defense companies actually have the highest perceived nation state risk followed by software infrastructure. 

I only graphed industries that contained more than one entry, there were 22 additional unique industries that I’ve attached as an addendum table at the bottom of this post. 

Addendum: