Okta's 10-Q References Two Incidents — and the New SEC Cyber Rule Looms

Timing makes this filing a marker. Okta's Form 10-Q filed December 1, 2023 references two incidents directly — "the January 2022 incident involving one of our third-party service providers and the October 2023 incident where a threat actor gained" access — and it lands in the same window that the SEC's new cybersecurity disclosure rule begins to bite.

That rule, adopted in July 2023, introduces Item 1.05 of Form 8-K: once a company determines a cybersecurity incident is material, it must disclose the nature, scope, and timing and the material impact (or reasonably likely material impact) within four business days. Compliance for larger registrants begins in December 2023. Okta's quarterly reference here is the kind of incident discussion that, going forward, may need to move into a timely, structured 8-K rather than waiting for the next periodic filing.

For readers tracking how disclosure changes, the contrast is sharp. The January 2022 incident surfaced, in earlier filings, through risk factors and litigation notes — the pre-rule channels. The October 2023 incident arrives just as the structured regime turns on. The same company, two incidents, two disclosure worlds.

The substance, again, is identity supply-chain. Okta sits at the authentication layer for its customers, so an incident in its support or service-provider chain reverberates outward. The filing's terse phrasing — a threat actor "gained" access — is the careful language of a company describing a confirmed event in a periodic report.

EdgarBeast surfaced the 10-Q from the SEC's index; the document on sec.gov is the primary record. What to watch from here is whether and how identity and security vendors translate this kind of quarterly incident reference into the new four-day 8-K format now that the clock exists.

Forward from this filing, the Item 1.05 era begins in earnest. The pre-rule pattern — incidents emerging late, in risk factors and litigation notes — gives way to a regime that forces an early materiality call. Okta's December 2023 10-Q sits precisely on that line.