Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
On July 26, 2023, the Securities and Exchange Commission (SEC) adopted many of the proposed cybersecurity regulations first discussed well over a year ago to formally insist that public companies improve and demonstrate their cybersecurity rigor.
In very much the same manner that Sarbanes-Oxley (SOX) formalized disclosure methodology for financial reporting, these new regulations place focused emphasis on cybersecurity transparency and accountability for public companies.
These updated regulations demand that public companies explicitly describe how they prepare for cybersecurity threats, including how they evaluate vulnerabilities, monitor inappropriate behaviour, proactively mitigate, respond to, and ultimately remediate threats. These are all components of a professional cybersecurity risk management program and should not be considered onerous.
I believe that the SEC took the feedback gathered over the last 16 months (since the requirements were initially proposed in March 2022) quite seriously and either removed or softened the most onerous compliance components to enact a more tractable solution. So, it’s good to see that the rules have finally been adopted.
Per the SEC’s Final Rule documentation, here’s a summary of the requirements being adopted:
Item |
Summary of the Disclosure Requirement |
Regulation S-K Item 106(b) – Risk management and strategy |
Registrants must describe their processes, if any, for the assessment, identification, and management of material risks from cybersecurity threats, and describe whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect their business strategy, results of operations, or financial condition. |
Regulation S-K Item 106(c) – Governance |
Registrants must:
|
Form 8-K Item 1.05 – Material Cybersecurity Incidents |
Registrants must disclose any cybersecurity incident they experience that is determined to be material, and describe the material aspects of its:
An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material. A registrant may delay filing as described below, if the United States Attorney General (“Attorney General”) determines immediate disclosure would pose a substantial risk to national security or public safety. Registrants must amend a prior Item 1.05 Form 8-K to disclose any information called for in Item 1.05(a) that was not determined or was unavailable at the time of the initial Form 8-K filing. |
Form 20-F |
FPIs must:
|
Form 6-K |
FPIs must furnish on Form 6-K information on material cybersecurity incidents that they disclose or otherwise publicize in a foreign jurisdiction, to any stock exchange, or to security holders. |
The regulations also require C-suite executives and boards of directors recognize these risks, understand risk mitigation plans, and track progress regarding ongoing (and hopefully improving) cyber resilience. These board members will demand better instrumentation to track improvement and as a result, the CISO will find themselves under a brighter spotlight.
Although the original proposals had demanded that the board describe what cybersecurity education and knowledge existed within the board members themselves, they have walked back from this statement. It will likely be sufficient for CISOs to have consistent high-level data flowing up to board members themselves.
Ultimately, the most eyebrow-raising component (the "Four Business Day Incident Response") will demand that public enterprises will need to formally consider cybersecurity risk from the perspective of materiality. Materiality speaks to the need for transparency for investors participating in the public market, in which cybersecurity risks can directly and suddenly impact the enterprise's stock price (and conceivably undermine confidence in the financial system).
In the initial March 2022 proposal, there were concerns that the suggested timeline to disclose an incident was 48 hours, which in the scope of live incident response was universally acknowledged as decidedly insufficient. In the new ruling, the SEC leaves the definition of “material impact” up to the company itself, but they will need to make that definition public. This is important since there’s a fair amount of latitude in determining what is MATERIAL.
For example, “What would a reasonable shareholder consider important in making an investment decision, or would this significantly alter the ‘total mix’ of information made available?” These are BIG questions, especially since so much information is already “priced in.”
Moreover, I expect that as the SEC has formalized the “Four Business Day Disclosure Rule” for public companies, they will enact the same timing later this year for Investment Management firms (for the sake of consistency). Given that Investment Management firms are generally considerably smaller than most public firms, they wouldn’t necessarily have the same strict board structure. So, it will be very interesting to see how these interpretations filter out into the market and how this applies to private investment management firms (where there isn’t the same amount of public disclosure available to their investors).
It goes without saying that since we’ll continue to see more regulations like these being introduced in the coming years, there is some comfort in engaging a trusted security provider who can not only help you comply with these requirements, but more importantly, enable you to become more resilient against sophisticated cyberattacks. Here’s what I recommend:
Cybersecurity risk is an important risk encountered across enterprises – in addition to financial risks such as counter party risk, forex risk, and many others. It's high time that regulators formally recognize cyber risks as such and hold publicly companies accountable for materially serious and substantial threats in the cybersecurity realm.
Eldon Sprickerhoff is the original pioneer and inventor of what is now referred to as Managed Detection and Response (MDR). In founding eSentire, he responded to the incipient yet rapidly growing demand for a more proactive approach to preventing and investigating information security breaches. Now with over 20 years of tactical experience, Eldon is acknowledged as a subject matter expert in information security analysis. Eldon holds a Bachelor of Mathematics, Computer Science degree from the University of Waterloo.