2025 - Building Against a Breach…. Out of a disclosure?

### Overview In this talk, attorney Liz Wharton examines the wealth of passive intelligence inadvertently broadcasted by non-technical business units ("the suits")—including legal counsel, public relations, human resources, and finance. Drawing on her 20 years of legal experience (including working for the City of Atlanta during its major ransomware incident), Wharton explains how public filings, corporate communications, and administrative artifacts leak critical insights into an organization's security posture and ongoing crises. Rather than focusing solely on direct technical telemetry, security teams can use automated tools, LLMs, and AI agents to ingest publicly available data—such as SEC 8-K disclosures, court documents, and job postings—to expose hidden risks, track shared third-party vendors, and build more resilient defensive playbooks.

### Key Topics - **Contrasting Disclosures (MGM vs. Caesars):** Analyzing how both organizations responded to 2023 social engineering and ransomware attacks (associated with threat groups like Scattered Spider / The Com). Caesars quickly paid the ransom and submitted voluminous SEC and state filings that minimized the incident without mentioning "ransomware." Conversely, MGM reported approximately $100 million in estimated losses and issued minimal 8-K filings directing readers to brief boilerplate press releases. - **The Signal in "Copy-Pasta" and Boilerplate:** Because legal and PR teams frequently reuse boilerplate templates and formulaic language to bill efficiently or handle crises, text analysis can detect anomalies. Identifying deviations from standard language—or tracking when boilerplate is used—often reveals the true severity of an incident or indicates panic. - **Metadata and Administrative Leakage:** Non-security professionals frequently neglect to strip metadata from public filings, contracts, or court submissions. These documents expose author identities, filing timelines, external vendors, and unredacted client names. - **Business Operational Footprints:** HR job listings reveal upcoming technology deployments, pending litigation preparations, overworked transitional roles susceptible to social engineering, and internal software stacks. - **Shared Vendor and Ecosystem Risk:** Many enterprises rely on overlapping, insurer-approved third parties (law firms, PR agencies, DFIR firms, accounting providers). Identifying common templates and connections allows teams to anticipate supply chain and third-party compromise.

### Technical Details - **SEC 8-K Filings & EDGAR API:** The SEC requires reporting of material cybersecurity incidents within four days under updated rules. Over 67,000 8-K forms were filed in 2024. The SEC provides raw filings and data via EDGAR APIs, enabling automated ingestion and parsing. - **Filing Timing Patterns:** Cross-referencing filing metadata reveals behavioral patterns. For example, severe or critical 8-K disclosures are disproportionately submitted after 4:00 PM on Wednesdays or Fridays, whereas immaterial or routine updates occur on Tuesdays or Thursdays. - **LLM Similarity Scoring:** Running public text through LLMs allows defenders to measure textual similarity across filings. High similarity between an organization's filings reflects internal template reuse, while high cross-company similarity highlights shared law firms, accounting partners, or PR agencies. - **Loss Metrics:** Wharton cites broader business impacts to help security teams communicate with executives, noting that business email compromise (BEC) accounted for $2.9 billion in losses and referencing statistics where 78% of organizations paying a ransom suffered a subsequent attack.

### Takeaways - **Turn OSINT Against Yourself:** Security teams should proactively scrape and feed their own public artifacts—press releases, SEC filings, annual reports, financial statements, and job descriptions—into LLMs to map out what adversaries can see. - **Early Warning Radar:** By mapping the outside counsel, accountants, and vendors an organization shares with peers, defenders can establish alerting mechanisms when a shared partner or industry peer experiences a breach. - **Implement Administrative Hygiene:** Security teams must collaborate with legal, HR, and PR to enforce strict hygiene practices, such as stripping metadata from public uploads, sanitizing job postings to remove explicit technology requirements, and avoiding exploitable disclosure timing habits. - **Bridge the Gap with Legal:** Effective incident response requires established trust and continuous dialogue between security professionals and legal teams well before an active incident unfolds.