Most companies still can't determine whether a breach is material within the four days mandated by the SEC, skewing incident response.
Source: htdarkreading.com