The turn
A qualifying report cannot be used against the person who filed it. Pilots report near misses because it is safe to.
CIRCIA, the US 72-hour reporting law for critical infrastructure, passed in 2022. Its final rule missed the statutory deadline, then a September 2026 target. It went to the White House for review on 1 October 2026 and is still not published.
Verizon DBIR 2025, built on what does get shared: the human element in about 60% of breaches, third parties doubling to 30%.
Now add an actor that is neither.