Value Creation · Living Tracker

Security Catalyst Tracker

By Atul Tiwary, El Dorado Capital · Last updated: 7 October 2026

Regulatory and demand catalysts move on their own clocks. This page carries the dates — status, shape and the planning consequence of each — so the evergreen framework does not age with them. Updated as the dates move.

Status board — 7 October 2026

Catalyst	Shape	Key date	Current status	What it means for a plan
CISA 2015 (US information-sharing protections)	Withdraws a protection	Sunset 11 Dec 2026	Extended by P.L. 119-103 §2011, signed 2 Sep 2026 — fifth short-term deadline, again attached to a spending measure	Legal-basis review of pooled-indicator sharing is answerable now, at counsel cost; a G&A line, not a tooling line
CIRCIA (US incident reporting, 300,000+ entities)	Creates demand	No published date	Sep 2026 projection missed; final rule at OMB review since 1 Oct 2026 — the fourth slip	Size to the certainty of the obligation, not the date; spend routes to visibility, forensics and retainers
EU Cyber Resilience Act (reporting obligations)	Imposes an obligation	In force 11 Sep 2026; full obligations 11 Dec 2027	Live, on schedule; ENISA reporting platform operational	Standing PSIRT to a 24h/72h/14d clock — a permanent opex line and a testable diligence question
CMMC (US defense supply-chain certification)	Demand, deferred	Phase II suspended 13 Jul 2026	Suspension carried into acquisition guidance by 3 Sep class deviation; 117 assessors vs 120,000+ firms in scope	Capacity ceiling, not cost ceiling — automation is the route to revenue that cannot otherwise be served
AEPD AI-agent breach notification (Spain)	Creates demand	Published 16 Sep 2026	First notified GDPR breach executed through an AI agent; one case, no disclosed victim or sector	Direction of travel for automated detection and response under a 72-hour clock; not a sizing input
Watershed 250 / OpenAI Daybreak (subsidised tooling)	Subsidy window	Ends ~Mar 2027	Six-month programs launched 31 Aug / 3 Sep 2026; tooling subsidised, headcount not	A window in which a subsidised competitor prices below cost, and a renewal date a plan can act on

Each entry in full, below. The framework these feed — the three shapes of regulatory catalyst and where each belongs in a plan — lives on the value creation deep dive; this page carries the dates so that page does not have to.

The record

The triage-cost argument acquired a regulatory leg on 16 September 2026, when Spain’s data protection authority published the first notification it had received of a personal data breach carried out through an AI agent used as the instrument of the attack — login, vulnerability search, modification of personal data and access to invoices, chained by the agent itself. The statutory obligation is unchanged: GDPR Article 33 gives a controller 72 hours from awareness to notify, and the text does not distinguish a human attacker from an automated one. What changes is what it takes to meet that clock. The regulator’s own fourth conclusion is that the required improvements cannot be achieved by manual intervention alone, which is a specification for automated detection, containment and response rather than for additional analysts. For a value creation plan this is the cleanest available bridge between the security thesis and the services-to-software thesis on this page: the same automation that lifts gross margin on the delivery side is what a shortened compliance clock now argues for on the demand side, and it lands in the compliance budget as well as the security budget. One notification, one member state, no disclosed victim, model or sector — so it establishes the category and nothing about its economics, and a plan should cite it as a direction of travel rather than as a sizing input.

A second demand asymmetry acquired a date in the first week of September 2026, and it runs the other way — toward the tool being given away while the labor is not. Two six-month programs aimed at the same under-resourced buyer were announced four days apart. Project Watershed 250, launched 31 August by the Office of the National Cyber Director and Texas Cyber Command, supplies Texas water and wastewater utilities with red teaming, system hardening and AI tooling at no cost, contributed by twelve named vendors. OpenAI's Daybreak for Frontline Defenders, announced 3 September, commits $1B of subsidised model access, training and technical assistance targeted for consumption over six months, prioritizing water and grid operators, state and local government, community and regional banks and nonprofits, and delivered through more than 35 partner products. For scale: the federal grant program aimed at the same buyers authorised $1B across four years, an average of $250M a year, and allocated $91.75M in its final year. Neither commitment is appropriated cash, and a supplier valuing discounts against its own undisclosed list prices is not a grant.

The shape matters more than the sum. Both programs subsidise tooling and not headcount, in a segment defined by having no security staff, so the binding constraint is unchanged and the near-term revenue sits with whoever supplies the people. And both carry a stated six-month horizon, which places a cost on the buyer in the first days of March 2027. For a services or managed asset with municipal, utility or community-banking exposure that is two things a plan can act on: a defined window in which a subsidised competitor can price below its own cost, and a date on which the subsidy stops and the renewal conversation happens. Who absorbs that cost — the operator, a reauthorised grant, or the managed-services provider taking it into a fixed price and the margin compression with it — is a diligence question with a deadline rather than a scenario.

The demand line most often underwritten badly now has a measurable slip rather than a date. CISA's CIRCIA final rule — mandatory reporting of substantial cyber incidents within 72 hours and of ransomware payments within 24 hours, across the sixteen critical-infrastructure sectors and a scope the proposed rule estimated at over 300,000 entities — missed its September 2026 projection: CISA sent the final rule to OMB's Office of Information and Regulatory Affairs, where it was logged as pending review on 1 October 2026. The operative detail for a value creation plan is what the clock actually buys. A 72-hour deadline is not primarily a reporting-workflow problem; it is a data visibility problem, because an organization cannot report inside three days what it cannot see, cannot attribute to an owner, and cannot scope. That routes the spend toward asset inventory, forensic readiness and incident-response retainers rather than toward another compliance module — a different product roadmap and a different acquisition list than "CIRCIA is coming" implies on its own.

The caveat is the whole discipline, and it applies to every dated catalyst on this page. CIRCIA has now slipped four times: a statutory October 2025 deadline, an internal May 2026 target, a September 2026 projection, and now OMB review with no published date — a Unified Agenda entry records an agency's own expectation, not a commitment. The obligation has never been in doubt since the statute passed in March 2022; only the date has moved. So the plan is sized to the certainty of the obligation and not to the announced date. A portfolio company that has built the visibility capability is right whenever the rule lands; one that built a launch campaign around September is now living through exactly that slip. That is the general form: regulatory catalysts are reliable as demand and unreliable as timing, and value creation plans should book them accordingly.

One catalyst on this page has now discharged that test rather than failed it, and its shape is different from every other entry here. The EU Cyber Resilience Act's reporting obligations took effect on 11 September 2026, on the date they were set, with ENISA's Single Reporting Platform operational the same day. Manufacturers of products with digital elements sold into the EU owe an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident, a full notification within 72 hours, and a final report within 14 days of a corrective measure becoming available. Full product obligations follow on 11 December 2027.

What makes it worth a paragraph is that it lands on the vendor rather than on the buyer. Every other catalyst above creates demand a portfolio company can sell into. This one creates an obligation a portfolio company must discharge, and it is shaped unusually in two ways. It is continuous rather than periodic: it is satisfied by a standing product-security incident response capability running to a fixed clock, which is a permanent operating-expense line and a staffing requirement, not an audit a consultant closes out once. And it attaches to products already on the market, not only to new placements, so the legacy estate carries the duty alongside the current catalog — which means the cost scales with how much a company has ever shipped into Europe, not with what it sells next year.

For a value creation plan with EU product revenue that converts into two concrete items. The obligation is a margin line to be sized deliberately — staffed internally, bought as a managed product-security function, or absorbed unbudgeted, which is the outcome that shows up later as an unexplained cost. And it is now a testable diligence question rather than a forecast: a target either has a PSIRT that can meet a 24-hour clock across its installed base or it does not, and unlike CIRCIA there is no date left to slip behind. That is the version of a regulatory catalyst worth underwriting — one where the obligation, the clock and the evidence all exist at the same time.

There is a third shape, and it is the one a value creation plan is least likely to have budgeted, because it does not create demand and it does not impose an obligation — it withdraws a protection. The Cybersecurity Information Sharing Act of 2015 supplies the liability limits, the Freedom of Information Act exemption and the privilege safeguards under which US companies share cyber threat indicators with the government and with one another. Its information-sharing provisions were extended to 11 December 2026 by Section 2011 of the Continuing Appropriations and Extensions Act, 2027 (P.L. 119-103), signed 2 September 2026 — the fifth deadline in the sequence, and like its predecessors it arrived attached to a spending measure: the statute carried a ten-year sunset and lapsed on 30 September 2025, staying lapsed 43 days until a renewal that ran only to 30 January 2026; it lapsed a second time for four days before the spending bill signed 3 February 2026 extended it a further 239 days. Across the twelve months to 30 September 2026 the statute was inoperative for 47 of 365 days — 12.9% of the period.

Two features make it worth sizing rather than watching. First, the exposure attaches to an activity a portfolio company is already performing: ISAC participation, threat-intelligence exchange, and the customer-telemetry pooling that managed detection and threat-intelligence businesses run on. A lapse does not create a purchase; it puts a standing operating practice on a weaker legal footing, and the work it generates is legal review of existing sharing agreements and identification of alternative bases for sharing — a general-and-administrative line, not a tooling line. Second, its renewal risk is not independent of appropriations risk: both lapses occurred during government shutdowns, both renewals arrived bolted to spending bills, and the expiry falls at the federal fiscal year-end. Continuity is therefore correlated with the budget calendar rather than decided on the statute's merits, which is why the renewals keep coming in short increments.

What this does not establish should be stated as plainly as what it does. No measured commercial effect is claimed: no vendor has disclosed a change in sharing volume, contract terms or pricing across either of the two prior lapses, and none is asserted here. The 43-day and four-day lapses are the natural test window if such data is ever published. The actionable point is narrower and survives the absence of that evidence — for any business whose delivery model depends on pooled indicators, the question of which legal basis supports that pooling after 11 December is answerable now, in advance, and at the cost of counsel time. Across three catalysts the page now holds a usable distinction: one creates demand to sell into, one imposes an obligation to discharge, and one removes a protection already relied upon. They belong on different lines of a plan.