“…or to public safety, or to the chances of C level execs to get that boat this quarter.”

@bkryer 🤔🙄

I believe reporting in the public interest by private companies on cyber issues is severely compromised by commercial pressures, professional status sensitivity, and good old-fashioned denial.

@bkryer 🤔 doing the right thing is trying to be morally correct for society. It is good that at regional meet-ups, this is the drive forward.

No doubt. My point is rather cynical.

Reporting of incidents in a 96 hour window sounds fast to outsiders but is laughable inadequate from an oversight perspective, no matter what front line evaluations claim.

Voluntary means, as long as it doesnt make you look bad, or make your company lose any money or status, then you can report it. This is why we only hear about incidents which are too substantial to hide.

Software is our most vulnerable border.

@bkryer I know what you are saying. However, you also need to look at the perspective if it is not software related and ransomware or reliant on another party. It will get messy for sure.