The materiality call, made on evidence, not guesswork.

Determining materiality is the hardest call. You have four business days.

The SEC clock starts the moment you determine a cyber incident is material, and making that determination, then defending it, is exactly the call boards have had no rigorous way to make. That is the real problem, not the filing.

RiskD3M does the analysis and hands your executives a structured, evidence-grounded basis to make the call inside the four-business-day window. The AI does the work. Your executives do what only they can: review, approve, and decide. Item 106 then asks your board to show, each year, how it governs that risk.

A board-ready Cyber Financial Materiality Analysis

• A transparent materiality analysis. Every quantitative screen and every SEC qualitative factor, shown in full. Never a black box.
• The four-business-day clock, computed to the day. Weekend and federal-holiday math, anchored to your determination, not your discovery.
• An Item 1.05 materiality worksheet. Quantitative and qualitative factors, organized for the decision your executives must make.
• An Item 106 board governance narrative, drafted for review. For your annual disclosure, in the register of the 10-K.
• An auditable determination record. Who supplied each fact, who approved, and when. Preserved for later scrutiny.

High, medium and low are not amounts.

A severity rating cannot be set against a budget line, an insurance limit, or another department's request, because it is not denominated in anything. Cyber risk quantification translates the same technical findings into modeled money: expected annual loss, a tail figure, and a stated range, computed from your own financial anchors and the control efficacy actually observed in your environment.

Every parameter is disclosed and the arithmetic is deterministic, so the same facts always produce the same figure and anyone can check it. Where evidence is missing the range widens, rather than the number quietly filling in. An unobserved control domain is reported as unobserved, never scored as though it passed.

One language your board already speaks.

Stated in dollars, exposure stops being a security topic and becomes a governance one. Directors, executives and acquisition authorities can hold it against a stated risk tolerance, weigh it beside every other claim on capital, and ask the obvious next question: what does fixing this buy us.

The analysis answers that directly. Your report ranks each control domain by the expected annual loss it would remove, computed by re-running the same model with that domain brought to passing, so the ranking cannot disagree with the headline figure. A domain we did not measure is listed as unobserved and claims no reduction, because there is no measured posture to improve on. You set each reduction against your own cost. We publish no return-on-investment number, because the cost side is yours and inventing it would make the ratio fiction.

Your evidence never leaves your network.

Cyber underwriting still runs on annual questionnaires: self-reported, point-in-time, and impossible to falsify. Both sides know it, so the carrier prices the uncertainty into the premium and the well-run company subsidises the poorly-run one, because neither can prove which they are.

The obstacle is not willingness. It is that proving posture has meant handing over the evidence, and no company is going to ship engineering files, cloud configuration or identity data to a carrier or to a vendor cloud. So RiskD3M does not ask for it.

Three parties, three different views.

An insurance placement has three sides and standard compliance tooling has one. Here they are separate in the software, not by policy: you own the evidence and the decision to release anything about it. Your broker sees that an attestation exists and how complete it is, and only while a release naming them is live. Your underwriter receives the attestation issued to them, and never your findings.

Release is per carrier, it carries an expiry, and it can be withdrawn, and a withdrawal takes effect on the next request rather than the next cycle. There is no override path and no automatic approval anywhere in it.

Going dark is not a way to look clean.

The rule that matters most, and the reason this can be written into a policy at all: if a telemetry source is disconnected, that domain is reported unobserved. Never as passing, never as a cached earlier value, and never quietly dropped from the total. An attestation names which domains were dark, so incomplete coverage reads as incomplete rather than as a clean bill.

We supply a measurement and its provenance. The underwriting decision, including any discount, is the carrier's.

Where an AI agent is involved, whether a policy responds turns on how the event is classified. We publish the taxonomy we use openly, under CC BY 4.0, because it is worth more to this market as a shared language than as a private one.

The agent does the analysis. You keep the decision.