Mandatory disclosure rules are built on an assumption that organizations will respond to transparency requirements with transparency.
The evidence suggests otherwise.
When the SEC required public companies to disclose material cybersecurity incidents within four business days, something unexpected happened. Instead of producing cleaner market signals, companies started filing mandatory disclosures for incidents that didn't even meet the materiality threshold. SEC officials had a name for it: "cover yourself 8-Ks." Firms were disclosing not because the incident warranted it — but because they were afraid of being second-guessed later.
The SEC had to issue clarifying guidance in May 2024 to correct the behavior. The guidance worked. But the episode reveals something worth paying attention to.
Organizations don't respond to regulatory intent. They respond to regulatory incentives. And those two things are not the same.
A rule designed to reduce information asymmetry between firms and investors produced strategic disclosure behavior instead — firms managing perception rather than informing markets. That gap between intent and outcome is where the real cost lives, and it shows up more often than the policy debate acknowledges.
The question regulators should be asking isn't just what information do markets need — it's how will organizations behave when required to provide it?
We're not great at answering that second question yet.
No. 002 in the Threshold Effects series. First published on LinkedIn, July 22, 2026.