Since mandatory reporting regimes will increase both the volume and the timeliness of incident reporting, governments will have an increased ability to warn businesses about emerging threats or potential problems before they occur. Intelligence agencies use the term “indications and warning” for this activity, and it enables recipients to take preparatory actions before something bad happens.
Governments could also use reported data to develop a better understanding of the threat and detect trends or changes in the environment. At present, we lack a good baseline rate for cyber incidents across the ecosystem. For example, whether the number of ransomware incidents increased or decreased in 2022 compared to 2021 depends on the entity writing the report. Unlike many other crime or economic statistics, we have no source of ground truth.
Despite these mitigations, reporting regimes will impose real costs on businesses. Reporting incidents takes effort. Someone at the company has to take the time to write the report and figure out who to send it to. The company must then deal with whatever questions the receiving agency has. If the organization is in the middle of a cyber incident that meets the reporting criteria, then, by definition, the organization is in extremis.
If the secret service also reported vulnerabilities they know about to the equipment manufacturers then they could be fixed... But they don't!
Nope