SEC’s New 30-Day Reporting Rule Puts Vendors in Cybersecurity Crosshairs

The public narrative around third-party cyber risk has traditionally focused on downstream fallout. When a software provider or financial services vendor suffered a breach, the attention typically shifted to the systemically important enterprises exposed through the compromise . Those narratives, however, tended to be based on a worldview where cyberattacks and data breaches were episodic and responses were largely delegated to IT teams, outside consultants and legal advisers.