@Munish No doubt. My point is rather cynical.

Reporting of incidents in a 96 hour window sounds fast to outsiders but is laughable inadequate from an oversight perspective, no matter what front line evaluations claim.

Voluntary means, as long as it doesnt make you look bad, or make your company lose any money or status, then you can report it. This is why we only hear about incidents which are too substantial to hide.

Software is our most vulnerable border.