Top 10 Cybersecurity and AI Blog Posts from SEC in 2024

As we’re nearing the end of the year, let’s take a look at the most popular SEC Cyber/AI posts on the Debevoise Data Blog in 2024, based on page views. If you’re not already subscribed to the blog, you can sign up here.

1. “100 Days of Cybersecurity Incident Reporting on Form 8-K: Lessons Learned” (March 28, 2024): Since the SEC’s rule on disclosing cybersecurity incidents came into effect on December 18, 2023, 11 companies revealed cybersecurity incidents on Form 8-K within an average of 5.45 days. This post provides valuable insights for companies considering Form 8-K disclosure.

2. “SEC Charges Four Companies for Misleading Cyber Disclosures” (October 28, 2024): The SEC announced charges against four technology companies that were victims of the 2020 SUNBURST cyber-attack. This marks the SEC’s initial resolutions from investigations into the accuracy of disclosures by cyber-attack victims. This post discusses materiality assessments and best practices for cybersecurity disclosures.

3. “The SEC Adopts Significant Cybersecurity Amendments to Reg S-P” (May 17, 2024): On May 16, 2024, the SEC made substantial cybersecurity amendments to Regulation S-P. This post outlines key compliance requirements under this enhanced regulation.

4. “AI Enforcement Starts with Washing: The SEC Charges its First AI Fraud Cases” (March 19, 2024): The SEC settled charges against two registered investment advisers for misleading statements regarding their use of AI in providing investment advice. These cases were the SEC’s first involving AI disclosure violations. This post details the charges and compliance insights for SEC registrants.

5. “Have You Reviewed Your Form ADV AI Disclosures?” (February 26, 2024): With the widespread use of AI in securities markets, the SEC focuses on “AI washing” in examinations and enforcement actions. This post discusses best practices for updating annual Form ADV disclosures to align with the SEC’s scrutiny of AI usage.

6. “SEC Releases New Guidance on Material Cybersecurity Incident Disclosure” (June 27, 2024): The SEC issued new Compliance & Disclosure Interpretations pertaining to the disclosure of material cybersecurity incidents on Form 8-K. This article summarizes the new guidance and its implications for issuers.

7. “Introducing the Debevoise Tracker for Cybersecurity Incident Disclosure on Form 8-K” (March 6, 2024): This post introduces the Debevoise tracker for monitoring Item 1.05 8-K filings related to material cybersecurity incidents. The tracker is regularly updated with links to cybersecurity filings.

8. “SEC Targets AI Washing in Private Capital Markets: ‘Old School Fraud Using New School Buzzwords'” (June 14, 2024): The SEC filed its first litigated case involving AI washing in a private capital markets transaction. This post explores the SEC’s approach to charging AI-related cases and emphasizes the importance of clear and accurate statements regarding technology use.

9. “Internal Accounting Controls Claim Rejected in SolarWinds Case” (July 23, 2024): In a case against SolarWinds, a federal district court dismissed most charges brought by the SEC, including a claim that cybersecurity control deficiencies could violate internal accounting control requirements.