Cyber Mentions per 10-K Risk Factors

## What this measures

Regex count of cybersecurity, cyberattack, data breach, and ransomware references in the full Item 1A text, averaged across the latest 10-K per company.

## Why it matters

The risk everyone names is the one that has already cost someone.

## How to read it

A rise means more S&P 500 companies are devoting more text to cyber threats in their mandatory risk disclosures. Compare levels across quarters or years to see whether the industry's written attention to digital security is expanding or plateauing. The count reflects disclosure practice, not the actual frequency or severity of attacks.

## What it does not say

The measure does not distinguish boilerplate from substantive disclosure, does not capture whether a company was breached, and does not weight mentions by the size or materiality of the risk. A high count may indicate genuine concern or simply longer risk sections.

## Source

Palanor collects Item 1A text from every S&P 500 company's latest 10-K filing and applies a regular expression to count references to cybersecurity, cyberattack, data breach and ransomware. The series aggregates these counts into a mean across the index.