A company should say what it has confirmed, what it has not confirmed yet, what affected people should do now and when the next update comes. The SEC requires public companies to file generally four business days after they determine an incident is material, so the first 24 hours go to confirmed facts and the materiality decision. IBM puts the average breach cost at $4.99 million.
When does the SEC disclosure clock start after a breach?
The SEC clock starts when a public company determines that a cybersecurity incident is material, not when the company discovers it. The SEC's 2023 rule added Item 1.05 to Form 8-K, and the filing must describe the material aspects of the incident's nature, scope and timing, plus its material impact.
The only built-in delay is narrow: the filing can wait if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and tells the SEC in writing. Materiality is a legal judgment, so counsel owns the call and communications supplies the language.
That makes the first communications task a question of process. Someone must be named to make the materiality decision, and the people who draft the statement must know when that decision is made.
What does the cost data say about speed?
IBM's 2026 Cost of a Data Breach Report puts the global average cost of a breach at a record $4.99 million, based on 602 organizations studied between March 2025 and February 2026. One in four malicious breaches in the study was AI-enabled, and those breaches averaged $6 million.
Suja Viswesan, vice president of IBM Security Software, said in the release that a long gap between discovery and remediation shows up directly in breach costs. Her point concerns technical response. The same logic applies to approvals: a holding statement that is still waiting on sign-offs late in the first day is a gap of its own. 5W's research on the shareholder cost of weak crisis communications, The Crisis Tax, covers the investor side.
What should happen in the first 24 hours?
The first 24 hours should produce four things: an incident log with one named decision owner, a holding statement with confirmed facts only, a list of affected audiences, and a live incident page with a set time for the next update. The table below orders that work.
| Window | Actions | Output |
|---|---|---|
| Hours 0 to 4 | Open an incident log, name one decision owner, bring in counsel, the security lead and the communications lead, and pause outside statements | Incident log and approved contact list |
| Hours 4 to 8 | Draft a holding statement from confirmed facts only, and draft an employee notice | Holding statement, first version |
| Hours 8 to 16 | List affected customers, employees, partners and regulators, and prepare notice drafts with counsel | Audience list and notice drafts |
| Hours 16 to 24 | Publish a dated incident page, brief customer support and executives, and set the next update time | Live page, support script, update schedule |
What belongs in a holding statement?
A holding statement states what happened in confirmed terms, what the company is doing, what affected people should do now, and when the next update arrives. Each line should be something security and counsel have confirmed.
- Leave out the cause, the attacker and any record count until security confirms them.
- Name the company and the systems involved, not "the incident" or "the matter."
- Give a specific time for the next update and keep it.
A number that changes later becomes the headline, so a smaller confirmed statement protects the company more than a larger guess. Illustrative scenario: at 9 a.m. a retailer's security team confirms that a vendor account exported customer email addresses. The holding statement names the vendor system, says passwords were not part of the export, tells customers to watch for phishing messages, and promises an update at 5 p.m.
Where should the incident page live?
The incident page should live on the company's own domain, dated and updated at the times it promised. Reporters and AI assistants that answer "was this company breached" retrieve whatever pages exist, and a current official page gives them one source for the confirmed facts instead of leaving older coverage to fill the gap. The reasoning behind that is covered in how PR, SEO and GEO work together.
Keep the page factual and add a time stamp to every update. Link the page from the home page and from the support script so customers reach the same words the press sees. 5W's guide to crisis communications in AI search covers how teams monitor those answers after publication.
Who should review the statement before it goes out?
Counsel should review every outside statement before release, because the same words reach regulators, customers, employees and reporters at once. Teams that expect litigation can read how litigation PR during legal cases works alongside counsel.
Agreeing on the agency, the retainer and the approval path before an incident saves days after one. Crisis PR retainers and emergency rates explains how agencies price that work, and choosing a cybersecurity PR agency lists the questions to ask first. For brand-level data, see the 5W AI Cybersecurity Visibility Index and the Cybersecurity edition of the Retrieval Index.
CONCLUSION
Breach communications come down to one decision made early: who makes the materiality call, and what confirmed language is ready when that call is made. Companies that want a tested 24-hour plan before an incident can work with 5W on the holding statement, the incident page and the approval path.
