SEC materiality is the threshold a public company uses to decide whether a cyber incident must be disclosed to investors. An incident is generally material if a reasonable investor would consider it important to the company’s finances, operations, or risk profile. The test is not just about whether an intrusion happened; it is about the likely impact of the event.
This matters because cyber teams, lawyers, and executives may have to assess materiality while an investigation is still underway. Evidence of unauthorized access, data exfiltration, sensitive records, or disruption to critical systems can push an event toward disclosure. Defenders support that review by preserving logs, documenting scope, and identifying whether data left the environment. In practice, SEC materiality turns incident response into a parallel legal and technical process, especially for public companies handling regulated or sensitive data.