The assumption behind mandatory breach disclosure timing is that faster = better. Markets get cleaner signals. Firms recover faster. Uncertainty drops.
I've been testing that assumption for a while now. It doesn't hold up well.
Using event study methodology across 1,054 breach events, with the FCC's 2007 disclosure rule as a natural experiment, my research traces what regulatory timing actually does to pricing efficiency, post-disclosure uncertainty, and governance structures. The consistent finding: real costs, across all three channels, without the regulatory payoff. Faster disclosure moves the information asymmetry problem — it doesn't solve it.
That thread connects back to earlier work during my MBA on the cable and telecom industry, where the same gap kept showing up between policy intent and market reality.
Three ISACA Journal publications, a co-authored empirical paper in progress, and nearly 20 years in telecom operations underneath all of it.
Still a lot of work left on this. If any of it connects with work you're doing, I'd love to hear about it.
No. 001 in the Threshold Effects series. First published on LinkedIn, July 20, 2026.